CN1722030A - Vehicle control system - Google Patents

Abstract

A vehicle control device includes a sensor controller which uses the network connection to obtain sensor signals that represent the state quantity of a vehicle and the manipulated variable of a driver, a command controller which generates the control target value according to the sensor signals which are obtained by the sensor controller and an actuator controller which receives the control target value from the command controller to actuate the actuator for controlling the vehicle. The actuator controller is equipped with a control target value generation device which generates the control target value according to the sensor value of the sensor controller that is received by the actuator controller on the internet when the control target value generating from the command controller is abnormal. The actuator is controller through the control target value which is generated from the control target value generation device. The vehicle control device does not improve the prolixity degree of every controller above the required level. Through preventing errors in the whole system, the device can guarantee the reliability, the real-time character and the expansibility with simple ECU composition and low cost.

Description

Controller of vehicle

Technical field

The present invention relates to control the controller of vehicle (vehicle control system) of the transport condition of vehicle, relate in particular to driving, the steering of prime mover of a kind of vehicle that carries out automobile etc. by Electronic Control, the controller of vehicle of braking.

Background technology

As controller of vehicle, the operation controller (for example, patent documentation 1) that relates to the control device at damping force and driving force and steering angle by electronic-controlled installation, the centralized control that constitutes a main frame was arranged in the past.

In recent years, driver comfort and security with the raising automobile are target, be not the combination of machinery, but by Electronic Control with driver's acceleration, turn to the exploitation of the controller of vehicle of the operant response of (steering), braking etc. on the driving force of vehicle, steering force, the damping force generating mechanism to become very active.To such controller of vehicle,, require to have high reliability in order not lose the function of the driving that relates to vehicle, steering, braking.

In the past, will put the mechanism that converts electrical equipment to by the control that the mechanism of machinery realizes carries out.In aircraft control Fly-by-Wire, X-by-Wire is its good example in automobile control.In these purposes, in the past, prepared to have the backup mechanism of machinery for fault, but, just needed the high reliability of electrical apparatus mechanism along with mechanical mechanism disappears.

Even in the X-by-Wire of electric control automobile (XBW system), require the Brake-by-Wire of the Steer-by-Wire of electric control steering gear and electric control detent not produce misoperation and move reliably, and require to have high reliability.Steer-by-Wire particularly owing to guarantee the steering position of safety (fail-safe) when not existing in fault, then requires high reliability more.

In addition, think that advantage as X-by-Wire is to turn to by synthetically being controlled by Electronic Control, brake the so-called vehicle stabilization control that improves intact stability, can improve the active safety (for example, patent documentation 3) of vehicle safety thus more.

In addition, example in the past as highly reliable controller of vehicle, have by two-foldization and have ABS (AntiLock Brake System), the example that the master controller of TCS functions such as (Transmission Controlled System) improves reliability (for example, non-patent literature 1), even with the control module (failure operation) that also can continue regular event ground formation front wheel brake by making a mistake, when making a mistake, stop this constituting the control module (fault is reactionless) of trailing wheel braking functionally and reach the example (for example, patent documentation 2) of high reliability.

For example, a kind of as controller of vehicle has the driver to be transformed into electric signal to the operational ton of the operating control of brake pedal etc. and this communicator by CAN (Control Area Network) etc. is transferred in the control computer that arrestment mechanism has and carries out electronically controlled controller of vehicle.

[patent documentation 1] spy opens the 2003-263235 communique

[patent documentation 2] spy opens the 2002-347602 communique

[patent documentation 3] spy opens flat 10-291489 communique

[non-patent literature 1] D﹠amp; 3～6 pages of the 1st " X-by-Wire " symposial data that M Nikkei mechanical engineering etc. is sponsored, the lower-left figure of lantern slide 12.

Such controller of vehicle, generally known as the X-by-Wire system, with by the mechanism of in the past machinery and hydraulic mechanism transmission manner relatively, be considered to can realize using a computer and the lightweight of the travel Comprehensive Control and the vehicle weight of the height that brings and improve design freedom.

In controller of vehicle in the past, has following problem, promptly, the sensor that monitors the state of driver's operational ton and vehicle is input in the electronic-controlled installation (main ECU) that constitutes 1 main frame, Comprehensive Control is as combustion engine control and the arrester control device and the steering gear control device of the executive component of vehicle control usefulness, thus, when main ECU breaks down, because of not carrying out all manipulations, then, should improve the reliability of main ECU especially in order to ensure security.

, make main multipleization of ECU can guarantee that the gimmick of reliability is known here, but require highly main multipleization of ECU of processing, the problem that raises the cost is just arranged.

In type hierarchy of control structure in the past, constitute vehicle integral body by the subsystem of internal combustion engine, steering gear, detent.This be because, as accelerator and internal combustion engine, bearing circle and steering gear, brake pedal and detent, 1 pair 1 ground correspondence of operating means and executive component.

The present XBW system of practicability, situation about designing as the prolongation of the aforesaid hierarchy of control of type in the past structure is more.That is, the function of pressing Drive-by-Wire, Steer-by-Wire and Brake-by-Wire constitutes subsystem, realizes vehicle movement control by the coordination between these subsystems.

The investigation these conventional arts (type hierarchy of control structure in the past) problem the time as can be known, in order to ensure the reliability that requires controller of vehicle, real-time, extendability, the problem that just has cost to become very high.The problem of below having shown conventional art.

In the comprehensive controller of vehicle of vehicle, need high reliability.That is, even must guarantee controller and sensor executive component just in case when breaking down, vehicle also can safety traffic.

In the prior art, owing to carry out functional development, then need the failure operation (when fault is arranged, can carry out operability) of each subsystem by each subsystem.That is, in the prior art, there is the ECU that comes control actuating component (steering gear, detent etc.) by each subsystem, according to sensor (bearing circle, pedal etc.).

Because ECU concentrated area control sensor executive component is so in order to make entire system have failure operation, need make the ECU of each subsystem have failure operation.In order to make ECU have failure operation, need carry out multipleization etc., the rising that then brings cost of products.

In order to realize highly-reliable system with low cost, make each subsystem have ECU, this ECU had in the formation in the past of failure operation be difficult to realize.

To this, present inventors have considered that the control function that ECU is had is separated into vehicle Comprehensive Control, executive component control, sensor control, on the basis that gives fully necessary reliability by each function, for the executive component control function, even when the vehicle integrated control functions is unusual, also can give standby functions,, just can realize effectively the highly reliable and low-cost system as long as can accomplish this point based on the controllable self-discipline of sensor information.

In addition, in controller of vehicle, the hard real-time processing of satisfying tight time restriction is basic.Promptly need occupant's the manipulation and the variation of pavement behavior are reflected in binding hours in the control, in the prior art, owing to carry out functional development by each subsystem, so the real-time in subsystem is guaranteed to be relatively easy to.

But, for example, in the control of comprehensive a plurality of executive components, be difficult to guarantee real-time as the control of sideslip posture.That is,, transmit the vehicle control function of a plurality of subsystems such as detent, steering gear, internal combustion engine, so be difficult to guarantee for the interior action of control needed " dead wire " owing to the information that obtains from a sensor.

And then, because data transfer delay, for guaranteeing that the while comparable data also is difficult in each subsystem.Therefore,, the adaptation of system and subsystem, the man-hour of adjustment be increased, cost of development can be increased in order to realize the coordination of the height that vehicle movement is controlled in the prior art.

In formation in the past, be difficult to realize in order to realize real time comprehensive control with low cost, vehicle control logic module and device driver to be distributed among each ECU and between ECU to obtain coordination.

To this, present inventors consider control function are divided into vehicle Comprehensive Control ECU and equipment (executive component, sensor) controller, as long as can move respectively and shared data, just can realize real time comprehensive control effectively with restraining oneself.

In addition, in the exploitation of new car, in order to cut down cost of development, the method for using common flat to develop many car types is general the employing.Therefore, need to implement the function increase of each car type and the change of parts easily.But, in the prior art, owing to realize function by the ECU of subsystem level, so be difficult to realize the standardization of sensor executive component level.

That is,, have two sides of the device drives part of logic, abstract controlling application program and working control sensor executive component as the control logic module that ECU has.

Though the standardized action of device drives is also arranged,, aspect resource of real-time and ECU etc., is closely related with controlling application program in any case all be the standardization of interface aspect.

Therefore,, then can occur in the change in design of control task on the subsystem level etc., with regard to the problem of rising that the cost of development brought is arranged if any the appending, change of sensor executive component.

For the system that realizes that extendability is high,, need in disperseing controller of vehicle, imaginary shared memory be set having on the basis of controller with the form of the action of can restraining oneself.To this, present inventors consider each sensor executive component user mode information Control desired value etc. the higher-dimension interface, in shared memory, propagate, simultaneously, the data that each sensor executive component needs was obtained, controlled on self-discipline ground are effective.

Problem towards the practicability of controller of vehicle with high reliability, be not increase cost significantly and realize high reliability, but conventional art, constitute with the part of master controller or Control Component, by complicated hardware such as tediously longization and to realize failure operation, can't think that aspect cost best system constitutes.

In addition, in above-mentioned conventional art, even when the boundary that the driver surpasses vehicle is operated also with electronics correction brake operating etc., can avoid vehicle slip, rotation etc. and with the anti-possible trouble that terminates in of accident.

But, because detent from the information of brake pedal and various sensors to each wheel, by electronic control unit (ECU) centralized control, so at electronic control unit (ECU) when breaking down, because inoperation detent, so (ECU) requires high reliability to electronic control unit, more need further to consider for the reliability of control device.

Summary of the invention

The present invention in view of the above problems, its purpose be to provide a kind of by the tediously long degree of each controller is not brought up to need above, with the wrong mode of entire system defence realize with simple ECU constitute, the low-cost controller of vehicle of guaranteeing high reliability and real-time and extendability.

Controller of vehicle of the present invention, sensor slave computer (sensor controller) output transducer value on consolidated network, principal computer (instruction control unit) receives the sensor value and based on sensor values calculation control desired value, when on above-mentioned network, exporting, executive component slave computer (executive component controller) receives above-mentioned control target, and control actuating component; When above-mentioned executive component slave computer can not correctly receive above-mentioned control target, above-mentioned executive component slave computer, receiving the sensor slave computer outputs to the sensor value on the above-mentioned consolidated network and comes s operation control desired value, control actuating component based on this sensor values.

Relevant controller of vehicle of the present invention, come the operational ton of arithmetic operation amount command value to generate node by require signal and Vehicular status signal based on the driver, come the executive component drive node of control actuating component to constitute based on the operational ton designated value that provides from this operational ton generation node, carry out the driving of vehicle, steering, braking, above-mentioned each node, has fault detection capability, when detecting the fault of intranodal by this fault detection capability, to this node outside, do not relate to and notify this node to be in malfunction effect in addition, when on arbitrary node, breaking down, based on the fault detect notice that provides from certain node that is in this malfunction, by in the normal node beyond this node, carrying out switching controls, continue regular event as entire system.

Detect the sensor of above-mentioned driver's requirement, be connected on the communication network, in the fault in detecting this sensor,, do not relate to and notify this node to be in malfunction effect in addition this node outside.

Sensor, particularly by a plurality of sensor elements, will these a plurality of sensor elements output transform become the A/D transducer of digital value, consistent measuring ability, filter function and the communication interface of a plurality of A/D transformed values to constitute.

The aforesaid operations amount generates node, when receiving the fault detect notice that provides from the node that is in malfunction, by the switching controls corresponding to the fault place, stably keeps the transport condition of vehicle.

Above-mentioned executive component drive node, have can not receive generate the operational ton command value that node provides from the aforesaid operations amount in, based on the signal of the sensor of the requirement that detects above-mentioned driver and the function of generating run amount command value, can not receive in the operational ton command value that aforesaid operations amount generation node provides the transport condition that stably keeps vehicle by switch to the control that realizes this function from common control.

The sensor, operational ton generation node and the executive component drive node that detect driver's requirement are connected on the same communication network.This communication network is made of main bus and standby bus, on main bus, the all sensors of joint detection driver's requirement, operational ton generate node and executive component drive node, on standby bus, the part of the part of the sensor of joint detection driver's requirement and executive component drive node, when main bus had fault, the executive component drive node stably kept the transport condition of vehicle.

More specifically, in controller of vehicle of the present invention, detect the sensor of above-mentioned driver's requirement, it is the steering angle transducer of measuring the anglec of rotation of steering gear, measure the brake pedal position sensor of the amount of entering into of brake pedal, accelerator pedal position sensor with the amount of entering into of measuring accelerator pedal, operational ton generates node, be synthetically to control the vehicle movement general controller of vehicle movement according to the signal interpretation driver's of the sensor of the requirement that detects above-mentioned driver intention and with the sensor signal that detects vehicle-state, synthetically control the drive system general controller of the drive system of vehicle, the executive component drive node, it is the steering gear executive component driving governor that the steering gear executive component of steering force takes place in control, with the detent executive component driving governor of controlling the detent executive component that generates damping force, with the suspension executive component driving governor of controlling the suspension executive component that damping force is adjusted, these nodes are connected on the same communication network.In addition, detect the radar or the camera of the extraneous state of vehicle, also can be connected on the above-mentioned communication network.

And then, above-mentioned accelerator pedal position sensor, on being connected to above-mentioned communication network in, receive torque instruction value from above-mentioned drive system Comprehensive Control controller, also can be directly connected on the engine control controller of controlling combustion engine based on this.

In such controller of vehicle, in not mechanically in conjunction with brake pedal and damping force generating mechanism, make brake pedal position sensor when single failure, also continue regular event at least.

In not mechanically in conjunction with steering gear and steering force generating mechanism, make steering angle transducer and steering gear executive component driving governor when single failure, also continue regular event at least, and, make tediously longization of steering gear executive component.

It is characterized by, the power that each steering gear executive component takes place, the force rate that takes place with the steering gear executive component that uses in the system that mechanically combines steering gear and steering force generating mechanism is little.

In addition, above-mentioned steering gear executive component driving governor, when detecting the fault of intranodal, to this node outside, do not relate to and notify this node to be in the effect beyond the malfunction and make tediously longization of drive node, this drive node drives the above-mentioned tediously long steering gear executive component of having changed respectively independently.

There is not relevant detent, in the controller of vehicle of the backup mechanism of steering gear, above-mentioned brake pedal position sensor and steering angle transducer, be will be by a plurality of sensor elements, the output transform of these a plurality of sensor elements is become the A/D transducer of digital value, the consistent checking function of a plurality of A/D transformed values, filter function, the unresponsive sensor of fault that constitutes with communication interface is carried out the sensor of tediously longization, or by at least three sensor elements, the output transform of these a plurality of sensor elements is become the A/D transducer of digital value, most decision-making functions of a plurality of A/D transformed values, filter function, the sensor of the failure operation that constitutes with communication interface.

Controller of vehicle of the present invention, have operational ton and generate node and correction generation node and executive component drive node, on the executive component drive node, when correction generation node is normal, to generate by operational ton operational ton that node provides apply from correction generate correction that node provides, to come control actuating component as control target, correction generate node unusual in, will generate the operational ton that node provides by operational ton and come control actuating component as control target.

Its result, even when correction generation node breaks down, do not revise yet, can control actuating component but be based on operational ton.

In addition, controller of vehicle of the present invention, have: a plurality of executive component drive units and the communicator that is connected a plurality of executive component drive units that come control actuating component based on driver's requirement or vehicle-state, and driving, the steering of control vehicle, at least one of braking, the executive component drive unit has operating state and other the operating state of the executive component drive unit control method selecting arrangement of selecting the control method of executive component based on oneself.

In addition, controller of vehicle of the present invention, have: a plurality of executive component drive units that come control actuating component based on driver's requirement or vehicle-state, with the communicator that is connected a plurality of executive component drive units, and the driving of control vehicle, steering, at least one of braking, the executive component drive unit has fault that detects oneself and the failure detector of notifying fault to take place to other executive component drive unit by communicator, with malfunction and other the malfunction of the executive component drive unit control method selecting arrangement of selecting the control method of executive component based on oneself.

In addition, controller of vehicle of the present invention is, have: a plurality of executive component drive units and the communicator that is connected a plurality of executive component drive units that come control actuating component based on driver's requirement or vehicle-state, and driving, the steering of control vehicle, at least one of braking, the executive component drive unit has based on the control method selecting arrangement of selecting the control method of executive component by communicator from the accepting state of the short message of other executive component drive unit reception.

In addition, controller of vehicle of the present invention, have: a plurality of executive component drive units that come control actuating component based on driver's requirement or vehicle-state, with the communicator that is connected a plurality of executive component drive units, and the driving of control vehicle, steering, at least one of braking, the executive component drive unit, have the short message of the notification action state being used by communicator send to above-mentioned other the executive component drive unit and receive said short message based on whether from other executive component drive unit and cease the control method selecting arrangement of selecting the executive component control method.

In addition, controller of vehicle of the present invention, have: at least 1 the operational ton generating apparatus that comes arithmetic operation amount command value based on driver's requirement or vehicle-state, with a plurality of executive component drive units that come control actuating component based on the operational ton command value that provides from the operational ton generating apparatus, communicator with attended operation amount generating apparatus and executive component drive unit, and the driving of control vehicle, steering, at least one of braking, the executive component drive unit has the operating state based on oneself, with other the operating state of executive component drive unit, select the control method selecting arrangement of the control method of executive component with the operating state of operational ton generating apparatus.

In addition, controller of vehicle of the present invention, have: at least 1 the operational ton generating apparatus that comes arithmetic operation amount command value based on driver's requirement or vehicle-state, with a plurality of executive component drive units that come control actuating component based on the operational ton command value that provides from the operational ton generating apparatus, communicator with attended operation amount generating apparatus and above-mentioned executive component drive unit, and the driving of control vehicle, steering, at least one of braking, the operational ton generating apparatus, have fault that detects oneself and the failure detector of above-mentioned executive component drive unit or operational ton generating apparatus being notified the fault generation by communicator, the executive component drive unit has the fault that detects oneself, based on by executive component drive unit or the operational ton generating apparatus notice fault failure detector that take place of communicator to other, the malfunction of oneself, the malfunction of other executive component drive unit, select the control method selecting arrangement of the control method of executive component with the fault generation state of operational ton generating apparatus.

In addition, controller of vehicle of the present invention, have: at least 1 the operational ton generating apparatus that comes arithmetic operation amount command value based on driver's requirement or vehicle-state, with a plurality of executive component drive units that come control actuating component based on the operational ton command value that provides from the operational ton generating apparatus, communicator with attended operation amount generating apparatus and above-mentioned executive component drive unit, and the driving of control vehicle, steering, at least one of braking, the executive component drive unit has the control method selecting arrangement of selecting the control method of executive component based on the accepting state of the short message that provides from other executive component drive unit or operational ton generating apparatus.

In addition, controller of vehicle of the present invention, have: come at least 1 operational ton generating apparatus of arithmetic operation amount command value and come a plurality of executive component drive units of control actuating component and the communicator of attended operation amount generating apparatus and above-mentioned executive component drive unit based on the operational ton command value that provides from the operational ton generating apparatus based on driver's requirement or vehicle-state, and driving, the steering of control vehicle, at least one of braking, the operational ton generating apparatus sends to the operational ton command value on each executive component drive unit by communicator; The executive component drive unit, when receiving the operational ton command value, to reply short message by above-mentioned communicator delivers in operational ton generating apparatus or other the executive component drive unit, the executive component drive unit, has the control method selecting arrangement, this control method selecting arrangement is based on whether receiving the operational ton command value that provides from the operational ton generating apparatus or replying the control method that short message is selected executive component from what other executive component drive unit provided.

In addition, controller of vehicle of the present invention, have: detect driver's the requirement or the sensor device of vehicle-state, with at least 1 the operational ton generating apparatus that comes arithmetic operation amount command value based on the information that provides from sensor device, with based on the operational ton command value that provides from the operational ton generating apparatus or come a plurality of executive component drive units of control actuating component from the information that the sensor provides, with the communicator that is connected sensor device and operational ton generating apparatus and executive component drive unit, and the driving of control vehicle, steering, at least one of braking, the executive component drive unit, has the control method selecting arrangement, this control method selecting arrangement, based on the operating state of oneself and the operating state of other executive component drive unit, with the operating state of the fault of operational ton generating apparatus, select to use the control method of the operational ton command value that provides from the operational ton generating apparatus, the control method of the information that use provides from sensor, making executive component is any one method in the control method of state of regulation.

In addition, controller of vehicle of the present invention, have: detect driver's the requirement or the sensor device of vehicle-state, come at least 1 operational ton generating apparatus of arithmetic operation amount command value based on the information that provides from sensor device, based on the operational ton command value that provides from the operational ton generating apparatus or come a plurality of executive component drive units of control actuating component from the information that the sensor provides, with the communicator that is connected sensor device and operational ton generating apparatus and executive component drive unit, and the driving of control vehicle, steering, at least one of braking, the operational ton generating apparatus, cubing has the fault of surveying oneself and the failure detector of executive component drive unit or operational ton generating apparatus being notified the fault generation by communicator, the executive component drive unit, has the control method selecting arrangement, this control method selecting arrangement, based on detect own fault and by communicator to other the executive component drive unit or the failure detector of operational ton generating apparatus notice fault generation, the malfunction of oneself, the malfunction of other executive component drive unit, with the generation state of the fault of operational ton generating apparatus, select to use the control method of the operational ton command value that provides from the operational ton generating apparatus, the control method of the information that use provides from sensor, making executive component is any one method in the control method of state of regulation.

In addition, controller of vehicle of the present invention, have: detect driver's the requirement or the sensor device of vehicle-state, come at least 1 operational ton generating apparatus of arithmetic operation amount command value based on the information that provides from sensor device, based on the operational ton command value that provides from the operational ton generating apparatus or come a plurality of executive component drive units of control actuating component from the information that sensor provides, with the communicator that is connected sensor device and aforesaid operations amount generating apparatus and executive component drive unit, and the driving of control vehicle, steering, at least one of braking, the executive component drive unit, has the control method selecting arrangement, this control method selecting arrangement, based on from other the executive component drive unit or the accepting state of the short message that provides of operational ton generating apparatus, select to use the control method of the operational ton command value that provides from the operational ton generating apparatus, the control method of the information that use provides from sensor, making executive component is any one method in the control method of state of regulation.

In addition, controller of vehicle of the present invention, have: detect driver's the requirement or the sensor device of vehicle-state, come at least 1 operational ton generating apparatus of arithmetic operation amount command value based on the information that provides from sensor device, based on the operational ton command value that provides from the operational ton generating apparatus or come a plurality of executive component drive units of control actuating component from the information that sensor provides, with the communicator that is connected sensor device and aforesaid operations amount generating apparatus and executive component drive unit, and the driving of control vehicle, steering, at least one of braking, the operational ton generating apparatus sends to the operational ton command value on each executive component drive unit by communicator; The executive component drive unit, when receiving the operational ton command value, to reply short message by communicator delivers in operational ton generating apparatus or above-mentioned other the executive component drive unit, the executive component drive unit, has the control method selecting arrangement, this control method selecting arrangement, based on whether receiving the operational ton command value that provides from the operational ton generating apparatus or replying short message, select to use the control method of the operational ton command value that provides from the operational ton generating apparatus from what other executive component drive unit provided, the control method of the information that use provides from sensor, making executive component is any one method in the control method of state of regulation.

In addition, controller of vehicle of the present invention, in the driving of carrying out vehicle, steering, braking, have following formation, decentralized configuration: detect driver's requirement and output signal node, require signal to come arithmetic operation amount command value and the operational ton that carries out signal output generates node and comes the executive component drive node of control actuating component based on generate operational ton command value that node provides from this operational ton based on this; Above-mentioned each node is provided with the Data Receiving table that stores each signal output, and have judge its content, to the fault detection capability of other node.

In addition, controller of vehicle of the present invention, the information that comprises the moment of representing short message in the Data Receiving table when the value that the retardation ratio constantly pre-establishes is big, is judged as transmission place or its communication road does not have operate as normal or turned back to normal condition.

In addition, controller of vehicle of the present invention comprises fault ballot portion in the Data Receiving table, and has according to the algorithm that pre-establishes to come the specific fault node or return to the function of the node of normal condition.Thus, fault that can predicate node takes place and recovers, and can continue vehicle control safely.

In addition, controller of vehicle of the present invention is to export by the failure diagnosis information of other node is voted as fault, and have the fault verification situation of each node.Thus, because the fault verification unanimity of each node, so can continue vehicle control safely.

(invention effect)

Even controller of vehicle of the present invention can not control operation amount generating apparatus or executive component drive unit arbitrarily, also can continue vehicle control safely by other executive component drive unit.Thus, tediously long degree that will each controller bring up to required more than, constitute, low-costly just can guarantee high reliability and real-time and extendability with simple ECU.

Description of drawings

Fig. 1 is the calcspar of basic formation of the embodiment 1 of expression controller of vehicle of the present invention.

Fig. 2 (a) and (b) are data flowcharts of representing the concrete example of the communication data flow process in the controller of vehicle of embodiment 1 respectively.

Fig. 3 is the synoptic diagram of vehicle of the controller of vehicle of Application Example 1.

Fig. 4 is the control calcspar of vehicle movement Comprehensive Control ECU of the controller of vehicle of embodiment 1.

Fig. 5 is the key diagram of expression state of motion of vehicle.

Fig. 6 is the process flow diagram that vehicle-state that expression is undertaken by the vehicle-state portion of inferring of vehicle movement Comprehensive Control ECU is inferred treatment scheme.

The process flow diagram of Fig. 7 dbjective state calculation process flow process that to be expression undertaken by the dbjective state operational part of vehicle movement Comprehensive Control ECU.

Fig. 8 is the key diagram of expression car body operating vector operational torque.

The process flow diagram of Fig. 9 operational ton calculation process flow process that to be expression undertaken by the operational ton operational part of vehicle movement Comprehensive Control ECU.

Figure 10 is the key diagram of the tire vector of expression car body operation.

Figure 11 (a) and (b) are synoptic diagrams that the expression operation quantity distribution is handled.

Figure 12 is the control calcspar according to the Comprehensive Control ECU of the DBW system of the controller of vehicle of embodiment 1.

Figure 13 is the comprehensive controller of vehicle of vehicle of future generation of the application-oriented controller of vehicle of the present invention of expression, the calcspar of self-discipline decentralised control platform (embodiment 2).

Figure 14 (a) and (b) are calcspars of summary of the data field of expression self-discipline decentralised control platform.

Figure 15 is the calcspar of summary of action of the self-discipline of expression decentralised control platform, is the synoptic diagram of state of motion of vehicle amount.

Figure 16 is the calcspar of the supervision summary of expression self-discipline.

Figure 17 is the figure of expression executive component node action flow process.

Figure 18 (a) and (b) are calcspars of the configuration example of expression XBW controller of vehicle.

Figure 19 is the calcspar of basic comprising of the embodiment 2 of expression controller of vehicle of the present invention.

Figure 20 is the calcspar that the expression operational ton generates nodal function.

Figure 21 is the calcspar of the function of expression executive component drive node.

Figure 22 is the synoptic diagram of the vehicle of the expression embodiment 3 that uses controller of vehicle of the present invention.

Figure 23 is the key diagram that is illustrated in the fault detection method of the node in the TDM communication.

Figure 24 is the function constitution map of table not without the sensor node of fault reaction.

Figure 25 is the hardware structure diagram of the sensor node of expression non-fault reaction.

Figure 26 is the synoptic diagram of the vehicle of the expression embodiment 4 that uses controller of vehicle of the present invention.

Figure 27 is the synoptic diagram of the vehicle of the expression embodiment 5 that uses controller of vehicle of the present invention.

Figure 28 is the synoptic diagram of the vehicle of the expression embodiment 6 that uses controller of vehicle of the present invention.

Figure 29 is the synoptic diagram of the vehicle of the expression embodiment 7 that uses controller of vehicle of the present invention.

Figure 30 is the calcspar that expression executive component drive node constitutes.

Figure 31 is that expression makes operational ton generate the calcspar of the embodiment of node, tediously longization of correction generation node.

Figure 32 is the calcspar of embodiment that expression has the executive component drive node of a plurality of functions, comparing function.

Figure 33 is a calcspar of making to remove the embodiment that changes the executive component drive node of doing when being illustrated in fault.

The time diagram that removes change work when Figure 34 is the expression fault.

Figure 35 is the calcspar that each node of expression is connected to the embodiment on same communication road.

Figure 36 is the figure that expression transmits the information flow on same communication road.

Figure 37 is illustrated in the calcspar of using the concrete example of present embodiment in the Steer-by-Wire system.

Figure 38 is illustrated in the calcspar of using the concrete example of present embodiment among the Brake-by-Wire.

Figure 39 is illustrated in the calcspar of using the concrete example of present embodiment in the system ensemble of comprehensive Steerr-by-Wire and Brake-by-Wire.

Figure 40 is the calcspar of basic comprising of the embodiment 8 of expression controller of vehicle of the present invention.

Figure 41 is the calcspar of variation of the embodiment 8 of expression controller of vehicle of the present invention.

Figure 42 is the calcspar of another variation of the embodiment 8 of expression controller of vehicle of the present invention.

Figure 43 is the calcspar that the expression operational ton generates nodal function.

Figure 44 is the calcspar of expression executive component drive node function.

Figure 45 is the time diagram of expression executive component drive node action.

Figure 46 is the process flow diagram that the expression control program is selected processing.

Figure 47 (a) and (b) are key diagrams of representing the example of control program option table respectively.

Figure 48 is the time diagram that the operational ton in beginning period of expression braking control generates node and the action of executive component drive node.

Figure 49 is illustrated in the time diagram that the operational ton of braking in the control generates the action of node and executive component drive node.

Figure 50 is the processing flow chart that expression selects to carry out the wheel of braking control.

Figure 51 (a) and (b) are key diagrams of representing the example of brake wheel option table respectively.

Figure 52 is the time diagram that the operational ton when being illustrated in the executive component drive node of braking control beginning period, left rear wheel or executive component and breaking down generates the action of node and executive component drive node.

Figure 53 is the time diagram that the operational ton when being illustrated in the executive component drive node of left rear wheel in the braking control or executive component and breaking down generates the action of node and executive component drive node.

Figure 54 is the time diagram that the operational ton when being illustrated in the executive component drive node of the left rear wheel that breaks down for the moment in the braking control or executive component and recovering generates the action of node and executive component drive node.

Figure 55 is the time diagram that is illustrated in the action of the executive component drive node when operational ton generation node breaks down in the braking control.

Figure 56 is the time diagram that the operational ton when being illustrated in the operational ton generation node recovery of breaking down for the moment in the braking control generates the action of node and executive component drive node.

Figure 57 is the time diagram of the action of the executive component drive node when being illustrated in operational ton in the braking control and generating the executive component drive node of node and left rear wheel or executive component and break down.

Figure 58 is the calcspar of other variation of the embodiment 8 of expression controller of vehicle of the present invention.

Figure 59 is the calcspar of the embodiment 9 of expression controller of vehicle of the present invention.

Figure 60 is the figure of the concrete example of expression Data Receiving table.

Figure 61 is the process flow diagram that the fault diagnosis of other node of expression is handled.

Figure 62 is other the calcspar of embodiment of expression controller of vehicle of the present invention.

Among the figure: 1-principal computer, the 1A-function of tonic chord, 2-sensor slave computer, 2A-sensor processing capacity, 3-executive component slave computer, 3A-executive component control function, the simple and easy function of tonic chord of 3B-, 4-sensor, 5-executive component, 10-vehicle movement composite control apparatus, 11-steering amount control device, 12-gradual braking device, the 13-driving-force control apparatus, 20-DBW system synthesis control ECU, 21-internal combustion engine control ECU, 22-variator control ECU, 23-electro-motor control ECU, 24-accumulator control ECU, 25-HMIECU, 30-vehicle movement Comprehensive Control ECU, 31-rudder angle indicating device, the 32-deceleration indication unit, 33-quickens indicating device, 35-control system gateway, 36-body system gateway, 41,41A-rotation direction sensor (steering angle transducer), 42, the 42A-brake pedal position sensor, the 43-accelerator pedal position sensor, 44-millimetre-wave radar/camera, 50-vehicle, the 51-steering wheel, 52-brake pedal, 53-accelerator pedal, 54-VGR mechanism, 60A, the 60B-sensor element, 61A, the 61B-A/D transducer, the consistent effect function of 62-, 63-filter function, 64-communication controler, 65A, the 65B-communications driver, 71-front-wheel helmsman, 72R, the 72L-front-wheel, 73-front wheel brake mechanism, 74-trailing wheel helmsman, 75R, the 75L-trailing wheel, 76-trailing wheel arrestment mechanism, 77-front wheel suspension mechanism, 78-rear wheel suspension mechanism, 81,81A-SBWVGR driver ECU, the simple and easy steering logic of 811-portion, 82-SBW driver ECU, 83A～83D-BBW driver ECU, the simple and easy steering logic of 831-portion, 84A～84D-EAS driver ECU, 85-air bag ECU, the 100-operational ton generates node, and the 101-vehicle-state is inferred portion, 102-dbjective state operational part, 103-car body operating vector operational torque operational part, 104-operational ton operational part, 105-vehicle parameter memory portion, 110-SBW driver ECU, 120-operational ton command value, the 201-Vehicular status signal, 210-fault detection capability, 210A～210D-fault detection capability, 220-control program selection function, 230-fault detect notice, 300-executive component drive node, the 320-controller, 400-executive component, 500, the 550-sensor, the 600-network, the 610-operational ton generates node, the anti-fault function of 611-, 612,612a～c-operational ton, 614, the 624-time slot, the 615-steering column, the 616-brake pedal, the 620-correction generates node, 621-fault detection capability, 622,622a, the 622b-correction, 623-fault detect result, 625-acceleration sensor Yaw rate sensor, 630,630-0～4-executive component drive node, 631-comparer, 632-controller, the most decision-making functions of 633-, 634-switch, 635-controller, 636-gain-variable device, 637-ramp generator, 640-executive component, 641, the 641-0-steering apparatus, 642-1～4-detent, 650,651, the 652-road of communicating by letter, 9100-Data Receiving table, 3000-1-sensor controller, 3000-2-steering wheel angle sensor, the 3001-1-sensor controller, 3001-2-brake pedal position sensor, 3002-1-executive component controller, 3002-2-steering control motor, 3003-1-executive component controller, 3003-2-electrodynamic braking pincers, 3010-1-general controller A, 3010-2-general controller B, A10, the A100-controller node, the A11-handling procedure, the A12-time conditions, A13-is from monitor, the A20-sensor node, the A21-handling procedure, the A22-time conditions, A23-is from monitor, A30-executive component node, the A31-handling procedure, the A32-time conditions, A33-is from monitor, A200-brake pedal sensor node, A210-radar node, A300-front wheel brake executive component node, A310-off-front wheel detent executive component node, A320-the near front wheel detent executive component node, A400-node, A410-are in the action of normal condition, and the A411-function stop is handled, A430-is from function for monitoring, the AA30-executive component, AA300-the near front wheel detent executive component, AA301-left rear wheel detent executive component, AA310-off-front wheel detent executive component, AA320-the near front wheel detent executive component, the overall Control Node of B10-vehicle movement, B101-communications driver, B102-vehicle movement observer, B103-driver intention assurance portion, B20-brake pedal node, B201-communications driver, B202-filtering correcting process parts, the B203-A/D transducer, B204-data normalization portion, B30-detent executive component node, the B301-communications driver, B302-caliper control part, B303-A/D transducer, B304-pre-driver, B305-self-discipline decentralised control function, D1, D2, the D3B-data flow, D11-steering amount desired value, D12-damping force desired value, D13-driving force desired value, D31-rudder angle indicating device operational ton, D32-deceleration indication unit operational ton, D33-quickens the indicating device operational ton, D3000-steering wheel angle information, the D3001-brake pedal amount of entering into information, D3010-1-target rudder angle, D3010-2-target braking force, the DA10-controller data, the DA20-sensing data, DA100-off-front wheel target braking force, DA101-the near front wheel target braking force, DA200-brake pedal status amount, the DA210-vehicle headway, DF10, DF20, the DF30-data field, the N1-network, the N11-communication bus, N1A-control system network (main bus), N1B-control system backup network (backup bus), the secondary network of N2-DBW system, the N3-overall network, the N3000-in-vehicle network, M1, M1A, M1B, M2, M3A～M3D, M4A～M4D, M5, the M6-electro-motor, the SA20-sensor, the SA200-brake pedal, the SA21-radar.

Embodiment

(embodiment 1)

At first, the basic comprising to controller of vehicle of the present invention describes with reference to Fig. 1.

Controller of vehicle, has principal computer (instruction control unit) 1, with sensor slave computer (sensor controller) 2, with executive component slave computer (executive component controller) 3, these parts can be carried out data communication ground at twocouese and connect by wired formula, wireless type, bus-type, grid type, network N 1 such as star-like, ring-like.

Principal computer 1 is the instruction control unit of s operation control desired value, has main control function (main control unit) 1A.

The sensor 4 that the state of connection observation (instrumentation) controlling object is used on sensor device slave computer 2.Sensor slave computer 2 has sensor processing capacity (sensor treating apparatus) 2A of the sensor signal that processing provides by sensor 4.

On executive component slave computer 3, connect and act on the executive component 5 that controlling object is used.Executive component slave computer 3 is the slave computers that are used for control actuating component 5, it has based on the executive component control function of the control target control actuating component 5 that is provided by principal computer 1 (executive component control device) 3A and the simple and easy function of tonic chord (controlled target value generation device) 3B that control target carried out computing.

On network N 1, there are the data stream D1 of control target and the data stream D2 of sensor instrumentation value.

The data stream D2 of sensor instrumentation value is the data stream of the sensor values of sensor slave computer 2 outputs, the sensor values of both sides' receiving sensor slave computer 2 outputs of the main control function 1A of principal computer 1 and the simple and easy function of tonic chord 3B of executive component slave computer 3.

The data stream D1 of control target is the data stream of the control target of principal computer 1 output, and the executive component control function 3A of executive component slave computer 3 receives the control target of principal computer 1 output.

When moving usually, executive component slave computer 3 comes control actuating component 5 based on executive component control function 3A from the control target that the principal computer 1 that is received by data stream D1 provides.

But when data stream D1 generation was unusual, executive component slave computer 3 came control actuating component 5 based on the control target of simple and easy function of tonic chord 3B computing.Promptly, simple and easy function of tonic chord 3B, come the s operation control desired value based on the sensor instrumentation value that is obtained by data stream D2, executive component control function 3A comes control actuating component 5 based on the control target of the operation result of the simple and easy function of tonic chord 3B that is obtained by the data stream D3B in the executive component slave computer 3.

By taking above-mentioned formation, just in case sink into to use the state of the main control function 1A of principal computer 1, but operation result based on simple and easy function of tonic chord 3B, can carry out executive component control, driver's the operation or the state variation of vehicle can be reflected, the controller of vehicle that reliability is high can be realized.

In addition, in Fig. 1, principal computer 1 as a computer representation, but also can be separated the main control function and is contained in a plurality of computing machines.

Concrete example to the communication stream in the controller of vehicle shown in Figure 1 describes with reference to Fig. 2 (a) and (b).

As principal computer, has the vehicle movement integration unit 10 of the motion of synthetically controlling vehicle integral body.

As the sensor slave computer, have, by the rudder angle indicating device (steering angle sensor-based system) 31 of driver's operation, deceleration indication unit (brake pedal enter into quantity sensor system) 32 with quicken indicating device (accelerator pedal enter into quantity sensor system) 33.

As the executive component slave computer, has the driving-force control apparatus 13 of the driving force of the steering amount control device 11 at the steering angle of control vehicle, the gradual braking device 12 of controlling vehicles whose braking forces and control vehicle.

Rudder angle indicating device 31, deceleration indication unit 32, acceleration indicating device 33, steering amount control device 11, gradual braking device 12, driving-force control apparatus 13 and vehicle movement composite control apparatus 10, N11 interconnects by communication bus.

Data stream during Fig. 2 (a) expression vehicle movement composite control apparatus 10 regular events.

In this data stream, symbol D31 is the operational ton of driver's rudder angle indicating device 31, is transformed into electric signal by rudder angle indicating device 31, outputs among the communication bus N11.

Symbol D32 is the operational ton of the deceleration indication unit 32 that undertaken by the driver, is transformed into electric signal by deceleration indication unit 32, and outputs among the communication bus N11.

Symbol D33 is the operational ton of the acceleration indicating device 33 that undertaken by the driver, by being transformed into electric signal by quickening indicating device 33, and outputs among the communication bus N11.

Vehicle movement composite control apparatus 10 receives rudder angle indicating device operational ton D31, deceleration indication unit operational ton D32, quickens indicating device operational ton D33 from communication bus N11, and synthetically controls the sporting computing of vehicle.

Thereafter, vehicle movement composite control apparatus 10 as the desired value of the control device that is used to control vehicle, outputs to steering amount desired value D11 and damping force desired value D12 and driving force desired value D13 among the communication bus N11.

Steering force control device 11 receives steering amount desired value D11 from communication bus N11, controls the steering apparatus of rudder actuator etc. for realizing steering amount desired value.

Gradual braking device 12 receives damping force desired value D12 from communication bus N11, controls clamping device such as dynamo-electric brake for realizing the damping force desired value.

Driving-force control apparatus 13 receives driving force desired value D13 from communication bus N11, for realizing drive force source, power drive systems such as driving force desired value controlling combustion engine, variator, electro-motor.

Fig. 2 (b) is illustrated in the data stream when producing mistake in the vehicle movement composite control apparatus 10.

When vehicle movement composite control apparatus 10 broke down, steering amount desired value D11 and damping force desired value D12 and driving force desired value D13 did not export to communication bus N11.But, need intention control vehicle by the driver.

Here, steering force control device 11 is judged and has been produced in vehicle movement composite control apparatus 10 when wrong, receives rudder angle indicating device operational ton D31 from communication bus N11, based on steering apparatuss such as rudder angle indicating device operational ton D31 control steering gears.

Gradual braking device 12 has produced in judging vehicle movement composite control apparatus 10 when wrong, receives deceleration indication unit operational ton D32 from communication bus N11, and D32 controls clamping device such as dynamo-electric brake based on the deceleration indication unit operational ton.

Driving-force control apparatus 13, in judging vehicle movement composite control apparatus 10, produced when wrong, receive acceleration indicating device operational ton D33 from communication bus N11, come drive force source such as controlling combustion engine, variator, electro-motor based on quickening indicating device operational ton D33.

For in vehicle movement composite control apparatus 10, producing mistake, use items such as not having certain hour to the data output of communication bus N11, and judge in the Data Receiving side.In addition, also can when vehicle movement composite control apparatus 10 self makes a mistake, its meaning be exported as short message.

Then, an embodiment to the vehicle (automobile) of using controller of vehicle of the present invention describes with reference to Fig. 3.

Control system network N 1A is equivalent to order wire of the present invention, is used to relate to the communication of the data of vehicle movement control.Control system backup network N1B also is equivalent to order wire of the present invention, and the preparation device when in control system network N 1A obstacle taking place as the force majeure at broken string that brings because of collision accident etc. etc. is used.

Rotation direction sensor 41 is equivalent to rudder angle indicating device 31.The operational ton of the steering wheel 51 of rotation direction sensor 41 instrumentation driver's operation (steering angle) carries out signal Processing such as filtering, and the steering wheel operational ton is outputed among control system network N 1A and the control system backup network N1B as electric signal.

In addition, steering wheel 51, even the mechanism of machinery also is connected with front-wheel helmsman 71, even making control system network N 1A or rotation direction sensor 41 or SBWVGR driver ECU (Electronic Control Unit) 81 that obstacle takes place because of force majeure when, also can control the steering angle of front-wheel 72R, the 72L of vehicle 50.

Brake pedal position sensor 42 is equivalent to deceleration indication unit 22.The operational ton of the brake pedal 52 of brake pedal position sensor 42 instrumentation driver's operation, and carry out signal Processing such as filtering, the brake pedal operational ton is outputed among control system network N 1A and the control system backup network N1B as electric signal.

In addition, brake pedal 52, even oil hydraulic system also can be connected with front wheel brake 73,, also can control the damping force of vehicle 50 even making control system network N 1A or brake pedal position sensor 52 or BBW driver ECU83A, 83B etc. that obstacle takes place by force majeure when.

Accelerator pedal position sensor 43 is equivalent to acceleration indicating device 33.The operational ton of the accelerator pedal 53 of accelerator pedal position sensor 43 instrumentation driver's operation, and carry out signal Processing such as filtering, will speed up amount of pedal operation and output among the control system network N 1A as electric signal.

In addition, accelerator pedal position sensor 43, be connected even other order wire also can be controlled ECU21 with internal combustion engine,, also can control the internal combustion engine of vehicle 50 even making control system network N 1A or DBW system synthesis control ECU20 that obstacle takes place by force majeure when.

Millimetre-wave radar/camera 44 detects the white line recognition of the transport condition of other car at the place aheads and rear, the fare in travelling etc., and is used to the identification of the external status of vehicle 50.Millimetre-wave radar/camera 44 identification external status are for example undertaken and computings such as the relative angle of the vehicle that travels forwardly, relative distance, relative velocity by signal Processing, and output among the control system network N 1A as electric signal.

Rotation direction sensor 41, brake pedal position sensor 42, accelerator pedal position sensor 43, millimetre-wave radar/camera 44 are equivalent to the sensor slave computer.

Vehicle movement Comprehensive Control ECU30 is a principal computer, is equivalent to above-mentioned vehicle movement composite control apparatus 10.Vehicle movement Comprehensive Control ECU30, input is gone up operational ton output, that undertaken by the driver or the transport condition of vehicle, the sensor instrumentation value that vehicle Comprehensive Control ECU30 has to control system network N 1A, the motion of management vehicle 50 synthetically outputs to control target such as driving-force control apparatus, gradual braking device, steering amount control device, suspension control apparatus, safety feature control device among the control system network N 1A.

Vehicle movement Comprehensive Control ECU30 also has gateway (gate way) function between system ensemble network N 3 and the control system network N 1A.

As the executive component slave computer, SBWVGR driver ECU81, BBW driver ECU83A～83D, EAS driver ECU84A～84D, air bag ECU85 are arranged.

SBWVGR (Steer-By-WireVariable Gear Ratio) driver ECU81, be equivalent to the rudder angle control device, by the rudder angle of control electro-motor M1, by known steering apparatus variable gear ratio (VGR) mechanism 54 of control electro-motor M5 control by front-wheel helmsman 71 control front- wheel 72R, 72L.

SBW driver ECU82 also is equivalent to the rudder angle control device, by the rudder angle of control electro-motor M2 by trailing wheel helmsman 74 control trailing wheel 75R, 75L.

BBW (Brake By-Wire) driver ECU83A, 83B, 83C, 83D are equivalent to gradual braking device respectively.

BBW driver ECU83A by the oil pressure that control electro-motor M3A comes control pump P, controls the damping force that occurs on the off-front wheel 72R by front wheel brake mechanism 73.

BBW driver ECU83B by the oil pressure that control electro-motor M3B comes control pump P, controls the damping force that occurs on the near front wheel.

BBW driver ECU83C, the oil pressure by control electro-motor M3C comes control pump P occurs in the damping force on the off hind wheel 75R by front wheel brake mechanism 73,76 controls of trailing wheel arrestment mechanism.

BBW driver ECU13D by the oil pressure that control electro-motor M3D comes control pump P, controls the damping force that occurs on the left rear wheel 75L by trailing wheel arrestment mechanism 76.

EAS (Electric Active Suspension) driver ECU84A, 84B, 84C, 84D are equivalent to suspension control apparatus respectively, are controlled at the suspension fork mechanism 77,78 that has on the vehicle 50.

EAS driver ECU84A is controlled at the suspension length, spring constant, attenuation constant of the front wheel suspension mechanism 77 that has on the off-front wheel 72R etc. by control electro-motor M4A.

EAS driver ECU84B is controlled at the suspension length, spring constant, attenuation constant of the front wheel suspension mechanism 77 that has on the near front wheel 72L etc. by control electro-motor M4B.

EAS driver ECU84C is controlled at the suspension length, spring constant, attenuation constant of the rear wheel suspension mechanism 78 that has on the off hind wheel 75R etc. by control electro-motor M4C.

EAS driver ECU84D is controlled at the suspension length, spring constant, attenuation constant of the front wheel suspension mechanism 78 that has on the left rear wheel 75R etc. by control electro-motor M4D.

Like this, by vehicle movement Comprehensive Control ECU30, by control EAS driver ECU84A～84D, can when slowing down, improve the spring constant of front wheel suspension mechanism 77, prevent that vehicle 50 is forwards to inclination, the bearing spring constant that improves the outside when rotated is to prevent horizontal commentaries on classics, and it is long to prolong rear wheel suspension to shorten front wheel suspension length when going up a slope, and can reduce the inclination of car body.

Air bag ECU85 is equivalent to the safety feature control device, and the occupant protection system of air bag etc. is controlled.

DBW (Drive-By-Wire) system synthesis control ECU20 is equivalent to driving-force control apparatus.DBW system synthesis control ECU20, control synthetically relates to internal combustion engine control ECU21, the variator control ECU22 that is connected by the sub-network N2 of DBW system, the devices such as drive controlling of vehicles 50 such as electro-motor control ECU23, accumulator control ECU24.

By getting such formation, only final driving force is indicated to DBW system synthesis control ECU20 and get final product from vehicle movement Comprehensive Control ECU30, can not rely on the formation of the device that relates to actual drive controlling and the indicating target value can constitute control device simply.

Internal combustion engine control ECU21 is the ECU that is used to control not shown internal combustion engine, and ECU20 receives desired values such as internal combustion engine shaft torque or internal combustion engine rotation number from the control of DBW system synthesis, for realizing the desired value controlling combustion engine.

Variator control ECU22 is the ECU that is used to control not shown variator, and ECU20 receives desired values such as gear from the control of DBW system synthesis, controls variator for realizing desired value.

Electro-motor control ECU23 is used to control the ECU that electro-motor takes place to use not shown driving force, and ECU20 receives desired values such as output torque or rotation number from the control of DBW system synthesis, for realizing the desired value controlling combustion engine.In addition, the source takes place and moves in the driving force of the negative direction of also bringing as being regenerated by electro-motor.

Accumulator control ECU24 is the ECU that is used to control not shown accumulator, the charged state of control accumulator etc.

Infosystem gateway 35 is to be used to connect the information systems internetting (well known to a person skilled in the art MOST etc.) of radio communication device, GPS, automobile global positioning systems etc. such as not shown mobile phone and the gateway of integrated network N3.

With information systems internetting and control system network N 1A being connected by gateway function, control system network N 1A logically can be separated from information systems internetting, can constitute the formation that satisfies easily the distinctive requirement of real-time dispatch control system network N 1A fairly simplely.

Body system gateway 36 is to be used to connect the body system network of not shown door lock, power window etc. and the gateway of integrated network N3.With body system network and control system network N 1A being connected by gateway function, control system network N 1A can be separated from body system cellular logic ground, can constitute the formation that satisfies easily the distinctive requirement of real-time dispatch control system network N 1A fairly simplely.

Below, use Fig. 4 to describe to the processing that vehicle movement Comprehensive Control ECU30 carries out.Data stream when Fig. 4 represents vehicle movement Comprehensive Control ECU30 regular event.

Vehicle movement Comprehensive Control ECU30, have vehicle-state and infer portion 101, dbjective state operational part 102, car body operating vector operational torque operational part 103, operational ton operational part 104, vehicle parameter memory portion 105, and input redirect sensor 41, brake pedal position sensor 42, accelerator pedal position sensor 43, millimetre-wave radar/camera 44, in each sensor signal of the sensor S of the not shown wheel speed sensors of Fig. 3, car body acceleration sensor, angular acceleration transducer etc.

Vehicle-state is inferred portion 101, uses sensor signal to infer the present state of vehicle.

Dbjective state operational part 102 calculates and to infer portion 101 by vehicle-state and infer, use the dbjective state of the vehicle that the transport condition of vehicle and sensor signal should realize by control, be the target state that vehicle should be obtained.

Car body operating vector operational torque operational part 103, portion 101 infers based on being inferred by vehicle-state, the difference of the present status of vehicle and the dbjective state calculated by dbjective state operational part 102, calculates the force vector by being controlled at the direction of going forward side by side that car body takes place and the moment vector of sense of rotation.

Operational ton operational part 104, based on force vector and the moment vector calculated by car body operating vector operational torque operational part 103, calculate the object run amount that should realize with executive component by BBW driver ECU83A～83D, the control of DBW system synthesis ECU20, SBWVGR driver ECU81, SBW driver ECU82, controls such as EAS driver ECU84A～84D, air bag ECU85.

In vehicle parameter memory portion 105, store vehicle parameters such as the kinetic constant (for example quality, rotatory inertia, centre of gravity place etc.) of car body, the specifications parameter of control actuating component (for example hard over angle of the maximum braking force of the time constant of each executive component, detent, steering gear etc.), these vehicle parameters come reference with the calculation process of being inferred portion 101, dbjective state operational part 102, car body operating vector operational torque operational part 103, operational ton operational part 104 by vehicle-state.

In addition, in Fig. 4, from the output of operation portion 104, done record, but this not a line of only representing a value, but represent the line of one group controlled quentity controlled variable with single line to each driver ECU.For example, for BBW driver ECU83A～83D, also can indicate independently damping force by each wheel.

Vehicle movement Comprehensive Control ECU30 constitutes by inferred portion 101, dbjective state operational part 102, car body operating vector operational torque operational part 103, operation portion 104 by vehicle-state, has the effect of the motion that can synthetically manage the control vehicle.

In addition, separate by vehicle-state being inferred portion 101, has following effect, for example, in having same flat vehicle, even only make power train when internal combustion engine is altered to mixed type etc., in the formation of the control actuating component of change vehicle, can utilize the part of the mechanical characteristic of computing vehicle again, improve the development efficiency of control device.

In addition, by dbjective state operational part 102 is separated, has following effect, even in reflection driver's individual character, according in the limit of vehicle that periphery travels or road condition change desired value, get final product but only change dbjective state operational part 102, can improve the development efficiency of control device.

In addition, constitute by car body operating vector operational torque operational part 103 and operation portion 104 are made as independently, the formation that can carry out the control device that has with vehicle independently, to the calculating of the operational ton of car body.

For example, even change structure to wheel hub electric motor type automobile from hybrid automobile, but as long as in same power, the moment vector that takes place of car body operating vector operational torque operational part 103 computings, as long as alter operation amount operational part 104.Therefore, can improve the development efficiency of controller of vehicle.

Below, the dbjective state of the vehicle that calculates to the present status of inferring the vehicle that portion 101 calculates by vehicle-state with by dbjective state operational part 102, describe with reference to Fig. 5.

As the present status and the dbjective state of vehicle, the quantity of state 1X of the rigid motion when being illustrated in car body with vehicle 50 and partly being assumed to rigid body.As quantity of state 1X, for example be meant 3 displacement (x, y, z), rotation angle (θ x, θ y, θ z), speed (dx/dt, dy/dt, dz/dt), the angular velocity of tieing up among (X-Y-Z) local coordinate system 1G (d θ x/dt, d θ y/dt, d θ z/dt) of the body gravity that is fixed on vehicle 50.

Because each composition of quantity of state 1X is interconnected into mutually in rigid dynamics, so have effect by determining that quantity of state 1X can carry out accurate more control, can carry out the high control of occupant's comfortableness and stability.

Infer treatment scheme to infer the vehicle-state that portion 101 carries out by vehicle-state, describe with reference to Fig. 6.

At first, in step S1011, infer the motion state among the local coordinate system 1G that is fixed on the vehicle.

Then, in step S1012, infer the motion state in the fixed coordinate system that is fixed on the specific place of Japanese bridge etc. for example.

Then, in step S1013, infer the situation of the periphery of vehicle '.

Then, in step S1014, instrumentation value, BBW driver ECU83A～83D, DBW system synthesis based on sensor S are controlled the Self-Test Diagnostics result of the control of ECU20, SBWVGR driver ECU81, SBW driver ECU82, EAS driver ECU84A～84D, air bag ECU85 etc. with executive component, infer the malfunction of upgrading vehicle.

Dbjective state calculation process flow process to by dbjective state operational part 102 describes with reference to Fig. 7.

At first, in step S1021,, infer the vehicle-state of driver intention based on the operational ton of rotation direction sensor 41, brake pedal position sensor 42, accelerator pedal position sensor 43 and present vehicle-state.

Then, in step S1022, based on the state of the fault of the performance of the situation of the periphery of vehicle, controller of vehicle, machine, rules and regulations etc., the limit of computing vehicle.For example when a clamping device part breaks down, in scope restriction top speed that can safety braking with the ability of the clamping device of regular event.

And, in step S1023,, press the dbjective state amount of driver intention decision vehicle 50 in the scope of the limit that is no more than vehicle-state.

Fig. 8 represents operating physical force, the moment vector by 103 computings of car body operating vector operational torque operational part.

As shown in Figure 8, operating physical force vector F (Fx, Fy, Fz) and operational torque vector τ (τ x, τ y, τ z) are in the enterprising row operation of local coordinate system of being fixed on the car body.Therefore, has the effect that can transform to easily at the operational ton that is fixed on the control device on the vehicle.

Operational ton calculation process flow process to operation portion 104 describes with reference to Fig. 9.

Operation portion 104, input is by car body operating physical force vector F, the moment vector τ of 103 computings of car body operating vector operational torque operational part, and the control device of union reality is a desired value with what kind of controlled quentity controlled variable.

At first, in step S1041, car body operating physical force vector F, moment vector τ are distributed to the tire force that respectively occurs on the tire that is installed on the vehicle 50.Thereafter, computing is to the controlled quentity controlled variable desired value tire vector, in the control device of reality.

By damping force, driving force, revolving force (by the tire transversal force of steering generation) are used as the desired value in the vehicle control, can synthetically control the motion of vehicle integral body.

In Figure 10, be illustrated in the tire vector of step S1041 computing.

FFR is the tire vector that occurs in front-wheel by control.FFL is the tire vector that occurs in the near front wheel by control.FRR is the tire vector that occurs in off hind wheel by control.FRL is the tire vector that occurs in left rear wheel by control.The tire vector assigns to determine as the one-tenth among the local coordinate system 1G that is fixed on the car body 50 respectively.

By the tire vector is assigned to determine as the one-tenth of local coordinate shape, the effect to the conversion of the operational ton that is fixed on tire driving shaft on the car body 50 and steering gear is arranged easily.

In step S1042, carry out the allocation process of operational ton.In fact the allocation process of operational ton carries out corresponding to the formation of the executive component of controlling vehicle.

Figure 11 (a) and (b) are represented the details that operation quantity distribution is handled.

Operation quantity distribution when Figure 11 (a) expression vehicle 50 has the oil-engine driven power drive line of internal combustion engine drive, mixed type is handled (step S1042a).This operation quantity distribution is handled, input tire vector, and the output conduct is in the steering amount of the desired value of SBWVGR driver ECU81, SBW driver ECU82, as the detent retarding torque of the desired value in BBW driver ECU83A～83D, as the power drive torque of controlling the desired value among the ECU20 in DBW system synthesis.

Operation quantity distribution during power drive line that Figure 11 (b) expression vehicle 50 has known wheel hub electric motor type is handled (step S1042b).Operation quantity distribution is handled, and output is as the steering amount of the desired value in SBWVGR driver ECU81, SBW driver ECU82, as in the detent retarding torque of the not shown desired value that is produced regeneration and brake block control ECU by the wheel hub electro-motor, as the electrical motor driven torque of the desired value in not shown wheel hub electro-motor control ECU.

By in fact carrying out the allocation process of operational ton corresponding to the formation of the executive component of controlling vehicle, even changing executive component constitutes, also can come correspondence, have the effect of the development efficiency that improves controller of vehicle by the actuating unit of swap operation amount allocation process.

Formation to DBW system synthesis control ECU20 describes with reference to Figure 12.

Off-front wheel driving torque receiving portion 201 is received in the driving torque that off-front wheel 72R should take place.The near front wheel driving torque receiving portion 202 is received in the driving torque that the near front wheel 72L should take place.Off hind wheel driving torque receiving portion 203 is received in the driving torque that off hind wheel 75R should take place.Left rear wheel driving torque receiving portion 204 is received in the driving torque that left rear wheel 75L should take place.

Power drive line operational ton calculating part 205 calculates the value as the desired value in the ECU of the actual executive component of control, the operational ton of indication internal combustion engine control ECU21, variator control ECU22, electro-motor control ECU23, accumulator control ECU24.

In the controller of vehicle on known torque basis, the torque that should take place with the driving shaft at drive unit is that desired value is controlled.Therefore, just have as controlling the DBW system synthesis control ECU20 that uses by the wheel hub electric motor type of the driving force of each wheel and do not have the problem of interchangeability.

Here, for example, in the drive system of drive unit, also the driving force of each wheel is accepted as control target, and be redistributed on the executive component that drives usefulness in the inside of DBW system synthesis control ECU20 with the such concentrated area generation driving force of internal combustion engine and hybrid system.Its result can make commonization of command value accepting method (interface) of the DBW system synthesis control ECU that DBW system synthesis control ECU that hybrid system uses and wheel hub electric motor type system use.

(embodiment 2)

To describing with reference to Figure 13 towards the comprehensive controller of vehicle of vehicle of future generation, the self-discipline decentralised control platform of using controller of vehicle of the present invention.

The purpose of self-discipline decentralised control platform is to realize the high reliability in the vehicle control, real-time processing, extendability with low cost.

As " self-discipline disperse ", be of highly reliable dispersant system model in the control field.Being called as the calculating main body corresponding to the node of the cell in the biology, is to be called the place of the total data of data field, the system of evacuation point combination by placement.

In addition, the detailed content of relevant " self-discipline disperses ", please refer to Sen Xinsi, palace this two, " self-discipline disperses the motion of notion " of well former wide, the electric paper magazine C V01.104No.12pp.303-310 of association (1984), and K.Mori:Autonomous Decentralized Systems:Concept, Data field Architecture and Future Trends:IEEE InterationalSymposium on Autonous Decentralized Systems (ISADS) pp.28-34 (1993-Mar).

In Autonomous Decentralized System, with the program that each node is made as and other independent and can move with restraining oneself, and realize that a part of obstacle does not influence the formation of entire system, can realize the dispersant system of reliability and favorable expandability.But, be difficult to be applied to real system according to the notion of biological model, can not reach to establish and have general application process.Therefore, need inquire into architecture to each application system.

Self-discipline decentralised control platform is made of following part: 1) be used for the data field DF10 of total data, 2) action of self-discipline, 3) management of self-discipline, 4) node (sensor node A20, executive component node A30, controller node A10) of the backup that can restrain oneself.In addition, each node has from watch-dog (from function for monitoring) A13, A23, A33.

Controller node A10 is according to time conditions A12 (for example 10 " ms " cycles), start up process program A11.Controller node A10 obtains sensing data DA20 from data field DF10, and the control target of computing executive component node A30 makes it carry out radio as controller data DA10 to data field DF10 and transmits.

Data field DF10 is the total storage space that is arranged on potentially on the Control Network, in normal condition, has the sensing data DA20 of sensor node A20 output and controller data (control target) DA10 of controller node 10 outputs.

The action of so-called self-discipline is not receive the processing requirements that provides from other node, the function of spontaneously handling according to the state of time conditions, node.

The management function of so-called self-discipline, be to other node hidden from the action of node and the supervision of state, by the function of self carrying out.

The backup of so-called self-discipline is to adorn simple and easy control by interior, and the data that the processing from node is needed have unusual in, by the data that simple and easy control comes computing oneself needs, realize the function of needed MIN processing.

Below, according to data field DF10, expression is applicable to the extendability of controller of vehicle to raising, action by self-discipline is applicable to the time drive actions of real-time decentralised control, realizes being used for the anti-fault of status surveillance and system that reliability is guaranteed by the management function of self-discipline and the standby functions of self-discipline.

Use Figure 14 (a) and (b), the data field in the narration self-discipline decentralised control platform.

The target of data field is to improve the extendability of controller of vehicle.By the importing of data field, make on the basis of internodal nuclear interface standardizing, can also realize carrying out easily the replacing of parts, the purpose of appending.

On self-discipline decentralised control platform, internodal exchanges data is by carrying out as the data field DF20 that is defined within the imaginary shared memory on the network.That is, do not realize what kind of machine of connection on network, data itself are discerned as object.

Therefore, being defined within the data on the DF20 of data field, is can the high data of the standardized level of abstraction in sensor executive component level.For example in the sensor instrumentation, not the Filtering Processing carried out by the data of the such fundamental of magnitude of voltage but by multiple instrumentation or the physical values of floating-pointization, be defined within on the data field.In executive component control, also be that standardized data definition that the target braking force of braking is such is on the data field.

In the example of Figure 14 (a), the amount of entering into of coming instrumentation brake pedal SA200 by brake pedal position sensor node A200, and be transformed on the basis of physical quantity, deliver on the DF20 of data field as brake pedal status amount (the braking amount of entering into) DA200 RTTY.

Controller node A100, with reference to brake pedal status amount DA200, the target braking force (only illustrating off-front wheel target braking force DA100, the near front wheel target braking force DA101) and wireless the electricallying communicate on the DF20 of data field of each wheel of computing.

Front wheel brake executive component node A300, on the basis of reference off-front wheel target braking force DA100, the near front wheel target braking force DA101, for realizing target braking force, control the near front wheel detent executive component AA300, left rear wheel detent executive component AA301.

The example of Figure 14 (b) is the control structure for Figure 14 (a), on the basis of appending the vehicle headway control function, and the formation of change brake monitor.

Append the radar SA210 of vehicle headway of instrumentation and preceding driving and the radar node A210 of control radar, the vehicle headway DA210 RTTY of instrumentation is delivered among the DF20 of data field.

Controller node A100, with reference to brake pedal status amount DA200 and vehicle headway DA210, target braking force of computing wheel (only illustrating off-front wheel target braking force DA100, the near front wheel target braking force DA101) and wireless electricallying communicate on the DF20 of data field.

The detent executive component node A310 of off-front wheel is with reference to off-front wheel target braking force DA100 and control the detent executive component AA310 of off-front wheel.

The detent executive component node A320 of the near front wheel is with reference to the near front wheel target braking force DA101 and control the detent executive component AA320 of the near front wheel.

More than, shown in Figure 14 (a) and (b), other sensor executive component is not influenced, only on the DF20 of data field, to append the data of " vehicle headway ", just can carry out appending of radar node A210 as vehicle headway instrumentation node.

In addition,, detent executive component node respectively takes turns self, to other node and data field DF20 exert not though also being altered to from the front-wheel control type.That is, by use data field DF20 can the evacuation point in conjunction with each node, can easily realize the dispersant system that dilatancy is good.

Use Figure 15 (and Figure 13) in the decentralised control platform features, the self-discipline action narrates.

The purpose of the action of self-discipline is to disperse to handle in real time for correspondence, can realize making the prediction in processing time to move according to the time of carrying out easily.

The action of so-called self-discipline in self-discipline decentralised control platform is that the state by time conditions or node makes node spontaneously begin the action of handling.That is, as the operation condition of node, the not only reception of short message, and start processing by time conditions (constantly and cycle) with from the state variation (insertion) of node.

In real-time system, catch the state of the system of controlling object, being reflected to control within a certain period of time is must be indispensable.When controlling Design, must be able to design the processing execution time in End-to-End for this reason.And then, on the other hand, also require not to be subjected to the unusual influence of other node and continue function from the processing of node.In order to realize so highly reliable dispersion real-time system, the action of node need be made as self-discipline.

Sensor node A20 by time conditions A22 (for example 10[ms] cycle), starts handling procedure A21.

Sensor node A20, the instrumentation value of read sensor SA20 is being carried out pre-treatments such as Filtering Processing, floating-pointization and after being transformed into physical quantity, sensing data DA20 RTTY is being delivered to data field DF10.

Executive component node A30 also starts handling procedure A31 according to other time conditions 32 (20[ms] cycle).

Executive component node A30 obtains sensing data DA20 from data field DF10, after the controlled target of node A30, carries out the control of executive component AA30 in order to realize desired value in computing.

In addition,, for example insert, also can be state variation from node as the internal combustion engine rotation as time conditions A22, the A32 of entry condition.Like this, by spontaneously start handling, oneself obtaining data necessary simultaneously and carry out computing, can carry out the action of the self-discipline of node.

By the action of self-discipline, the action that makes node is that the time is driving or driving by what bring from the state variation of node.That is, do not need the accidental driving of other node, make the design of the worst execution time become very easy.In addition, can not continue to handle owing to be not subjected to other the unusual influence of node, so can realize highly reliable system.

Below, in the feature of self-discipline decentralised control platform, the management of self-discipline narrates.The purpose of the management of self-discipline is to guarantee the required high reliability of vehicle control.Specifically, be to realize that action from node monitors or processing (failure operation/fault is reactionless) when unusual with each the node unit that constitutes dispersant system.In addition, in order to reach high reliability and cost degradation simultaneously, handle when unusual, distribute operational failure operation (possibility of operating during fault) and fault reactionless (non-property out of control during fault) according to Object node.

In constituting, the ECU by each subsystem carries out sensor instrumentation, the computing of vehicle controlled quentity controlled variable, executive component control in the past.Therefore,, then need the failure operation of more ECU, then cause expensiveization if reach the high reliabilityization of system.In addition, when using the mutual function for monitoring bring mutually by ECU, with regard to have between ECU in conjunction with compact, relate to the problem of the deterioration of extendability and development efficiency.

The summary of in Figure 16, having represented the supervision of self-discipline.

In this formation, own function for monitoring A430 is set, the action A410 that monitors in normal condition in node A400.And, when generation is unusual, carry out function stop and handle A411 (fault is reactionless).

In addition, the node for the backup difficulty of brake pedal, steering wheel etc. has failure operation, carries out function and continues.In addition, by when restraining oneself the fault of function for monitoring self, also carrying out the function stop of node, can prevent the out of control of node.

By the supervision of this self-discipline, but the evacuation point keeps the combination of node, simultaneously, can construct the system of high reliability with the set of the reactionless node of fault cheaply.And then, by with the combination of the backup of the self-discipline of narrating below, can be implemented in the failure operation of system level.

Below, in the feature of self-discipline decentralised control platform, the backup of self-discipline narrates.The purpose of the backup of self-discipline is to guarantee the required high reliability of vehicle control.Specifically, be the easy control function that is used to compensate the fault that constitutes the node that disperses controller of vehicle.

The backup of so-called self-discipline is usually in the logical constitution of getting the Control Node that the principal and subordinate constitutes, when the node of finishing the function of tonic chord breaks down, by the data between auxiliary node total realizes need the function of control of minimum.

Figure 17 represents the stream of action of executive component node.

Usually, use the instrumentation value of sensor node A20 to make controller node A10 s operation control desired value, based on this control target, executive component node A30 carries out the control (step S311 affirms → step S312 → step S313) of executive component AA30.

On the other hand, executive component node A30, in simple and easy version (simple and easy control function) A34 (with reference to Figure 13) of the control function of host node (controller node A10) is housed, with control target also reference sensor instrumentation value simultaneously, and come the simple and easy control target of computing based on sensor instrumentation value.Just in case, when the host node generation is unusual, carry out function stop by above-mentioned own function for monitoring, so for example, according to the item of not upgrading the data on the DF10 of data field, executive component node A30 judges the fault of host node in step S311.Judge the fault of host node at executive component node A30 after, execution in step S311 negates → step S314 → step S313, and the simple and easy control function A34 by interior dress, in order to realize backing up necessary processing from the function of node by oneself.

By the function for monitoring of this self-discipline backup functionality and above-mentioned self-discipline,, can realize the failure operation system of high reliability with the set of the reactionless node of fault cheaply.

Then, with the brake control function be the action example of example explanation self-discipline distributed control architecture.Particularly, show by this motion and can construct the failure operation system with the combination of reliable node.

The configuration example of expression XBW controller of vehicle in Figure 18 (a) and (b).In Figure 18 (a) and (b), mainly be conceived to vehicle Comprehensive Control ECU, brake pedal position sensor, detent executive component (BBW (Brake-By-Wire) driver ECU) and data field.The data field for example is arranged on by the vehicle of FlexRay installation and controls with on the network in addition.

At first, use Figure 18 (a), the action of the brake control function in the self-discipline decentralised control platform when common is described.

Brake control function in the self-discipline decentralised control platform is made of brake pedal Node B 20, vehicle movement Comprehensive Control node (vehicle movement Comprehensive Control ECU) B10, detent executive component Node B 30.

Brake pedal Node B 20, self-discipline starts periodically, uses the state of A/D transducer B203 instrumentation brake pedal position sensor SB20.

Brake pedal Node B 20 is carried out filtering and correcting process etc. for the value of instrumentation by filtering correcting process part B 202, and then is carried out standardization of data by the B204 of data normalization portion.Use communications driver B201 on self-discipline separate data district DF30 public data " brake pedal status " thereafter.

Vehicle movement Comprehensive Control Node B 10 starts periodically.Vehicle movement Comprehensive Control Node B 10 starts the back, uses communications driver B101 with reference to brake pedal status and other data (yaw speed, bearing circle rudder angle etc.) on the self-discipline separate data district DF30, infer the motion state of vehicle by vehicle movement observer B102, infer driver's operation intention by the driver intention assurance B103 of portion.And,, generate parts B104, the executive component control target of computing damping force, driving shaft torque, steering angle etc. by the executive component desired value based on inferring the result.Use communications driver B101 on self-discipline separate data district DF30 open control target thereafter.

With the left rear wheel be the action of example explanation detent executive component Node B 30 here.Identical with other node, detent executive component Node B 30 also starts periodically.After detent executive component Node B 30 starts, use communications driver B301 with reference to the control target on the self-discipline separate data district NF30, be target braking force.And based target damping force is carried out the control of detent executive component AB30.Use the state of A/D transducer B303 observation braking,, come the computing amount of braking control, use pre-driver B304 control brake device executive component AB30 based on the damping force of detent generation and the difference of target by caliper control part B302.

In addition, the also not necessarily same one-period in cycle of the cycle of data field reference and executive component control, also can get the executive component control cycle more at high speed.Thus, constant as one man carries out suitable control in the time of can be with the control of controlling object executive component.

Then, use Figure 18 (b), the action of the brake control function the when fault of vehicle movement Comprehensive Control Node B 10 is described.

Brake pedal Node B 20 is identical with usually the time, and self-discipline ground starts to be handled.Be not subjected to the fault effects of vehicle movement Comprehensive Control Node B 10.Vehicle movement Comprehensive Control Node B 10 when detecting the fault of self by the self-discipline management function, is carried out the reactionless processing of fault.That is,, be the state of the processing that stops all when the outside is seen.Therefore, do not upgrade executive component desired value on the self-discipline separate data district DF30.

With the left rear wheel be the action of example explanation detent executive component Node B 30 here.Detent executive component Node B 30 starts periodically.After detent executive component Node B 30 starts, with reference to the control target on the self-discipline separate data district DF30, be target braking force.But,, detect the fault of vehicle kinematic synthesis Control Node B10 owing to do not upgrade the data of target braking force.Thus, start the self-discipline decentralised control function 305 of brake pedal Node B 20.Self-discipline decentralised control function 305 is come the simple and easy desired value of computing with reference to the brake pedal status on the self-discipline separate data district DF30.

Caliper control part B302, the control target of replacement vehicle movement Comprehensive Control Node B 10 computings is carried out the control of detent executive component AB30 based on the simple and easy desired value of self-discipline decentralised control function 305 computings.

Here, this simple and easy desired value is only to use brake pedal status and the value calculated, is not the value of movement of the control vehicle of control vehicle movement Comprehensive Control Node B 10 computings.

More than, the action of the brake control function that uses self-discipline decentralised control platform is narrated.According to disperseing the data field of the feature of platform, the action of self-discipline, the management of self-discipline, the backup of self-discipline, even for example can represent when the controller node of computing desired value breaks down, also can move as controller of vehicle as self-discipline.

According to this effect, by the combination of the reactionless node of fault, can realize the controller of vehicle of failure operation, can think effective to the cost degradation of highly reliable system.

The basic comprising of controller of vehicle of the present invention is described with reference to Figure 19.

Controller of vehicle is made of the sensor 500 of the requirement that detects the driver, the sensor 550 that detects vehicle-state, executive component 400, operational ton generation node 100 and executive component drive node 300.

Wherein, the sensor 500, the operational ton that detect driver's requirement generate node 100 and executive component drive node 300, have fault detection capability 210A, 210B, 210C respectively.The fault detection capability 210C of executive component drive node 300 not only has self-diagnosing function, also has the function of the fault that detects executive component 400.

Operational ton generates node 100, comes arithmetic operation amount command value based on driver's require signal 200 and Vehicular status signal 201.

Executive component drive node 300 receives these operational ton command value 120, control actuating component 400, carry out thus vehicle driving, steering,, braking etc.

Fault detection capability 210A, 210B, 210C when detecting the fault of intranodal or executive component 400, notify 230 to the fault detect that the outside output notice oneself of node is used for malfunction.When the node with fault detection capability all is malfunction, remove this fault detect of output and notify beyond 230, stop output to the outside, that is, it is reactionless to constitute fault.

Figure 20 is the functional diagram that operational ton generates node 100.Operational ton generates node 100, in a plurality of steering logics of vehicle control usefulness are housed, receive fault detect at node and notify at 230 o'clock from other, according to the degree of fault place and fault, switch control logic (control A, control B, control C).

Figure 21 is the functional diagram of executive component drive node 300.Executive component drive node 300, in be equipped with based on operational ton and generate a plurality of steering logics (control X, control Y, control Z) that operational ton command value 120 that node 100 generates comes the action desired value of computing executive component 400 to use.Controller 320 drives executive component 400 to reach this desired value.

Executive component drive node 300 is notifying at 230 o'clock from other node reception fault detect, according to the degree of fault place and fault, switch control logic.Executive component drive node 300, in the time can receiving operational ton command value 120, carry out control X or control Y based on this command value, but because of operational ton generates the fault of node 100 or communication pathway in the time can not receiving operational ton command value 120, what be taken into the driver requires signal 200, for by own arithmetic operation amount command value, switch to control Z.

(embodiment 3)

Embodiment 3 to controller of vehicle of the present invention describes with reference to Figure 22.Figure 22 extract out relevant controller of vehicle, particularly braking control and turn to the part of control to represent.

This controller of vehicle, sensor as the requirement that detects the driver, have the anglec of rotation of measuring steering wheel 51 steering angle transducer 41, measure the brake pedal position sensor 42 of the amount of entering into of brake pedal 52, generate node as operational ton, have from the signal interpretation driver's of the sensor of the requirement that detects the driver intention and with signal, synthetically control the vehicle movement Comprehensive Control ECU30 of vehicle movement from the sensor that detects not shown vehicle-state, for example acceleration sensor Yaw rate sensor, wheel speed sensors.

This controller of vehicle, and then, as the executive component drive node, have: BBW driver ECU83A～83D of the braking electro-motor M3A～M3D of the SBW driver ECU82 of the rotary electric motors M2 of the steering force that the electro-motor M1 of the steering force of control generation front-wheel and the SBWVGR driver ECU81 of the electro-motor M5 that acts on variable gear ratio (VGR) mechanism that is installed on the steering stem shaft, control produce trailing wheel, the damping force that four-wheel is produced in control.

As the sensor of the brake pedal operational ton of instrumentation driver, also can use the oil pressure sensor of the oil pressure pressure that mensuration takes place by entering into brake pedal 52 here.

It is reactionless that above-mentioned node all constitutes fault.Communication network is made of bus N1A and spare wire N1B, with respect on bus N1A, connecting above-mentioned whole node, on spare wire N1B, be connected with the node of the required minimum that travels of the safety of closing vehicle, that is the whole nodes beyond the SBW driver ECU82 of vehicle movement Comprehensive Control ECU30, trailing wheel.Though not shown, to being connected to whole nodes of spare wire N1B, supply power at least doubly.

The BBW driver ECU83A～83D of the SBWVGR driver ECU81 of front-wheel and four-wheel, in simple and easy steering logic portion 811,831 is housed.Here, so-called simple and easy control means for example to make electric motor torque command value and sensor signal value merely handle the less control of duty ratio pro rata.

Just often, the BBW driver ECU83A～83D of the SBWVGR driver ECU81 of front-wheel, the SBW driver ECU82 of trailing wheel and four-wheel, receive rudder angle instruction, the damping force instruction that provides from vehicle movement Comprehensive Control ECU30 via communication network, control electro-motor based on this command value.

In the present embodiment, steering wheel 51 mechanically combines with front-wheel helmsman 71, and brake pedal 52 even oil hydraulic system also is connected with front wheel brake 73, when Electronic Control stops, using these backup mechanisms, and the driver directly can steering, abrupt deceleration vehicle.

Below, be that example is described in detail with controller of vehicle shown in Figure 22, even when being that fault has taken place in the somewhere of this controller of vehicle, the function of also not losing braking and turning to is travelled with making vehicle stabilization.

In addition, here, below example describe for prerequisite, suppose that plural fault does not take place the while, when breaking down, the driver is warned its main conditions, by repair a breakdown position in the time of relatively lacking, can prevent the 2nd fault in advance.

(1) situation of fault has taken place in vehicle movement Comprehensive Control ECU30

At this moment, vehicle movement Comprehensive Control ECU30 is to bus N1A output fault detect notice.Making communication network is time division multiple access (TDMA), if carry out the output to network in pre-determining the time slot of each node, then also can carry out the fault detect notice not export.

This example is divided into data transmitting period and interval between diagnosis with communication cycle as shown in Figure 23, and in interval between diagnosis, whole nodes can be exported certain data in order and realize.In the example of Figure 23 since at the time slot of the node F of interval between diagnosis not to the output of network, so other node breaks down at node F as can be known.

The SBWVGR driver ECU81 of front-wheel, the SBW driver ECU82 of trailing wheel when receiving the fault detect notice that provides from vehicle movement Comprehensive Control ECU30, are taken into the value of steering angle transducer 41 from network, carry out simple and easy control.

In addition, the BBW driver ECU83A～83D of four-wheel is taken into the value of brake pedal position sensor 42, carries out simple and easy control by simple and easy steering logic portion 813.

(2) in communication network, the situation that in main line N1A, breaks down

At this moment, use spare wire N1B, the SBWVGR driver ECU81 of front-wheel and the BBW driver ECU83A～83D of four-wheel and vehicle movement Comprehensive Control ECU30 carry out simple and easy control equally when breaking down.

(3) situation of fault has taken place in the braking electro-motor M3A of one of them of BBW driver ECU83A, the 83B of front-wheel or front-wheel, one of them of M3B

At this moment, by stopping the power supply to the front wheel brake electro-motor of fault side, this wheel is the state that can not brake, and vehicle movement Comprehensive Control ECU30 stably stops vehicle ground with remaining three wheels and controls.Perhaps, the driver uses backup mechanism, also can directly stop vehicle.

Here in the fault of electro-motor, though not shown, comprise fault to the electro-motor rotational position sensor of electro-motor control needs and current sensor etc.BBW driver ECU83C, the 83D of trailing wheel one of them, perhaps one of them situation that breaks down of braking electro-motor M3C, M3D of trailing wheel is too.

(4) the SBWVGR driver ECU81 of front-wheel or front-wheel turns to electro-motor M1 one of them situation that breaks down of (comprise electro-motor is controlled needed sensor)

At this moment, fail in the power supply of the electro-motor M5 of front-wheel steer electro-motor M1 and VGR mechanism 54, the driver uses backup mechanism, directly steering vehicle.

(5) situation of fault has taken place in steering angle transducer 41 or brake pedal position sensor 42

In this case, stop to acting on electro-motor M5 that turns to electro-motor M1, M2 and VGR mechanism or the power supply of braking electro-motor M3A～M3D, the driver uses backup direct steering of mechanism or abrupt deceleration vehicle.

In addition, in the present embodiment, can not take place to back up the situation of mechanism with single failure steering and braking, use simultaneously.

As previously discussed, formation according to present embodiment, owing to can in entire system, carry out backup to mistake, so not making the tediously long degree of each node brings up to more than the needs, in the controller of vehicle that backup mechanism is arranged, be the formation of the reactionless operation of fault only, just can realize the very controller of vehicle of high reliability by making all nodes.

The reactionless node of fault is even compare with the failure operation that also continues regular event that breaks down, because the hardware formation is simple, so according to the present invention, can provide high reliability controller of vehicle cheaply with known routine the comparison.

And then, to spare wire N1B,, can reduce the node number that makes tediously longization of communication interface necessary, so can reduce cost by only connecting the node of the needed minimum that travels of the safety that relates to vehicle.

Function configuration example to unresponsive steering angle transducer 41 of fault or brake pedal position sensor 42 describes with reference to Figure 24.

Steering angle transducer 41/ brake pedal position sensor 42 is made of following part: two sensor element 60A, 60B, with the simulation output transform of each sensor element 60A, 60B become A/ D transducer 61A, 61B, fault detection capability 210, filter function 63, the communication controler 64 of digital value, the communications driver 65A that uses to main line N1A output signal and the communications driver 65B that uses to spare wire N1B output signal.

Whether identical fault detection capability 210 have judgement consistent checking function 62 in the error range that pre-determines two A/D transformed values that formed by A/ D transducer 61A, 61B, inconsistent the time, make communications driver 65A and inactiveization of 65B, for fault reactionless.

Fault detection capability 210 in order to carry out the A/D conversion of two sensor element 60A, 60B simultaneously, is exported trigger pip to A/ D transducer 61A, 61B.

According to this configuration example, has filter function 63 by sensor, even in Filtering Processing with short periodic sampling sensor signal, enforcement over-sampling etc., owing to do not need to adapt to this sampling period to the communication network output data, so can reduce the traffic of network.

Hardware configuration example to unresponsive steering angle transducer 41 of fault or brake pedal position sensor 42 describes with reference to Figure 25.

Steering angle transducer 41/ brake pedal position sensor 42 is made of following part: main sensor element 60A, the sensor element 60B of reference, fail safe LSI600, two communications driver 65A, 65B.

Fail safe LSI600 is made of following part: A/D transducer 61A, the 61B of tediously longization, CPU66A, 66B, communication controler 64A, 64B, comparer 62A, 62B and ROM, a RAM67.

In fail safe LSI600, after the signal that provides from each sensor element 60A, 60B is carried out the A/D conversion, the A/D transformed value is exchanged and unification between CPU66A, 66B mutually.CPU66A, 66B use the A/D transformed value behind this unification respectively and carry out filtering operation.

The consistent of operation result checked, and is input to comparer 62A, 62B by the output with communication controler 64A, 64B and carries out.

In the present embodiment, because two communication buss are arranged, so communication controler 64 is two passages, with comparer 62A, the 62B relatively output of each passage mutually.

In the present embodiment, by making fail safe function singualtion (1chip), can constitute the unresponsive sensor node of fault with low cost.

(embodiment 4)

Embodiment 4 to controller of vehicle of the present invention describes with reference to Figure 26.In addition, in Figure 26, to giving the symbol identical and omit its explanation with the symbol of in Figure 22, giving with the part that Figure 22 corresponds to.

Be among the embodiment shown in Figure 22 3 network directly to be connected sensor, but in embodiment 4 be, to the HMIECU25 input sensor signal, HMIECU25 carried out sensor values relatively reach Filtering Processing after, to network output transducer data.

At this moment, steering angle 41A and brake pedal position sensor 42A only are made of two sensor elements.

In addition, in single failure, use the situation of backup mechanism simultaneously, need make HMIECU25 constitute failure operation for steering and braking do not take place.

(embodiment 5)

Embodiment 5 to controller of vehicle of the present invention describes with reference to Figure 27.In addition, in Figure 27, to giving the symbol identical and omit its explanation with the symbol of in Figure 22, giving with the part that Figure 22 corresponds to.

Embodiment 5, and being has articulation point to constitute and the network formation, and is identical with embodiment 3, but between steering column (steering wheel 51) and steering force generating mechanism and brake pedal 52 and damping force generating mechanism, is the controller of vehicle that does not have the combination of machinery.Thereby, can not expect to use steering, the braking of the vehicle of the backup mechanism of the machinery of narration in embodiment 3.

In the controller of vehicle of present embodiment, make the SBW driver ECU81A of steering angle transducer 41B, brake pedal position sensor 42B and front- wheel 72R, 72L, even the failure operation node that also continues regular event for breaking down here.

And, further, make that front- wheel 72R, 72L's turn to electro-motor two-foldization (M1A, M1B).

Though the SBW driver ECU81A of front-wheel is not shown, constitute by two reactionless nodes of fault, the reactionless node of each fault controls independently that two-fold changed turns to electro-motor M1A, M1B.SBW driver ECU81A comprises simple and easy steering logic portion 811.

Though as the torque that turns to electro-motor M1A, M1B to generate, if but use with mechanically in conjunction with rotate and the system of steering force generating mechanism in the torque of the rotary electric motors used compare less (here, in order to generate the torque that equates with the system of mechanically combination is more than 1/2) electro-motor, then can reduce the increase that makes the cost that the electro-motor two-foldization brings.

The SBW driver ECU81A of front-wheel, and then, the electro-motor M6 of control action in the mechanism that generates the counter-force that provides from the road surface on steering column simulation ground.

Steering angle transducer 41B and brake pedal position sensor 42B are for making the formation of the unresponsive sensor of the fault two-foldization shown in Figure 25.To the unresponsive sensor of the fault shown in Figure 25, make the sensor element triple modular redundant, by having most decision-making functions of three sensor signals, the unresponsive sensor of fault that also can further single use high reliabilityization.

At the side's of the SBW of front-wheel driver ECU81A the reactionless node of fault or when turning to the side (comprise control electro-motor needed sensor) of electro-motor M1A, M1B to break down, this node stop is to the power supply that turns to electro-motor of the side that breaks down, and the output fault detect is notified.

Vehicle movement Comprehensive Control ECU30 stably carries out switching controls in steering vehicle ground by the remaining electro-motor that turns to after receiving this fault detect notice.

When being to break down in this place in addition, not losing braking and turn to function, for the method for travelling, be as described in Example 3 with making vehicle stabilization.

According to embodiment 5, owing in entire system, can carry out backup to mistake, so in the controller of vehicle of the backup mechanism that does not turn to and brake, also only need the failure operation node of minimum, just can low-cost realize the very controller of vehicle of high reliability with importing.

(embodiment 6)

Embodiment 6 to controller of vehicle of the present invention describes with reference to Figure 28.In addition, in Figure 28, give the symbol identical and omit its explanation with the symbol that in Figure 22, gives corresponding to the part of Fig. 3, Figure 22.

Embodiment 6 is in the controller of vehicle of embodiment 3, appends nodes such as drive system and security system, represents the embodiment of integral body picture of the control system of travelling of relevant vehicle.Present embodiment has the backup mechanism that turns to and brake, and also can not be same formation even do not possess its controller of vehicle.

In main line N1A, remove about beyond the node that turns to control and braking control of embodiment 3 narration, also be connected with: the air bag ECU85 that synthetically controls the expansion of DBW system synthesis control ECU20, EAS driver ECU84A～84D, the accelerator pedal position sensor 43 of measuring the amount of entering into of accelerator pedal 53 that the suspension electro-motor M4A～M4D of damping force is adjusted in control of the drive system of vehicle, the millimetre-wave radar/camera 44 of state in the external world that detects vehicle and control air bag.

Simple and easy steering logic portion 811,831 is housed in the BBW driver ECU83A～83D of the SBWVGR driver ECU81 of front-wheel and four-wheel.

In DBW system synthesis control ECU20, connect internal combustion engine control ECU21, variator control ECU22, electro-motor control ECU23, accumulator control ECU24 by network N 2.

Vehicle movement Comprehensive Control ECU30 is connected with following part by network N 3: as to the infosystem gateway 35 of the inlet of the network of the machine of infosystems such as control vehicle global positioning system, door lock, reveal mirror, as the body system gateway 36 of the inlet of the network of the machine of body systems such as the various instrument of control; And carry out the access of these nodes and data.

Though not shown, air bag ECU85 also is the structure that is connected with the network of the security system of the various sensor executive components that comprehensively control needs to airbag deployment at an other end.

In the present embodiment, vehicle movement Comprehensive Control ECU30, from steering angle transducer 41, brake pedal position sensor 42, accelerator pedal position sensor 43 is explained the intention that drives, with from detecting the sensor of not shown vehicle-state, acceleration transducer for example, yaw rate sensor, the signal that the wheel speed sensors provides together, computing realizes the rudder angle that best vehicle movement is used, damping force, driving force etc., send the rudder angle instruction to the SBW driver ECU82 of the SBWVGR of front-wheel driver ECU81 and trailing wheel, send the damping force instruction to the BBW of four-wheel driver ECU83A～83D, ECU20 sends the driving force instruction to the control of DBW system synthesis.

DBW system synthesis control ECU20 receives the driving force instruction, consider energy efficiency etc., the driving force that the source should take place takes place in each driving force such as computing internal combustion engine, electro-motor, and the driving force instruction of computing is sent among internal combustion engine control ECU21, the electro-motor control ECU23 etc. by network N 2.

Vehicle movement Comprehensive Control ECU30, the information of the sensor of the requirement by detecting the driver not only, and the information of the millimetre-wave radar/camera 44 of the state in the external world by use detecting vehicle, carry out control to the tracking of preceding driving is travelled, fare keeps travelling, driving is hidden in danger etc.

About reliability, it is reactionless that the node that is connected with the main line N1A of communication network all constitutes fault.In addition, in spare wire N1B,,, can reduce the quantity of the node that need make tediously longization of communication interface, reduce cost by only connecting node about the required minimum that travels of the safety of vehicle as illustrated in embodiment 3.

Accelerator pedal position sensor 43 also can powered vehicle when one of them of main line N1A, DBW system synthesis control ECU20, network N 2 breaks down, also directly is connected with internal combustion engine control ECU21.

For in the present embodiment mistake is carried out the method for backup, the effect of bringing thus, as described in the embodiment 3.

(embodiment 7)

Embodiment 7 to controller of vehicle of the present invention describes with reference to Figure 29, Figure 30.

Operational ton generates node 610 generating run amounts 612, and operational ton 612 is delivered in the executive component drive node 630.

Correction generates node 620 and generates correction 622, and correction 622 is delivered in the executive component drive node 630.

Executive component drive node 630 as shown in figure 30, have controller 632, switch 634, generate node 620 normal the time in correction, apply from correction and generate correction 622 that node 620 provides, come control actuating component 640 as control target 635 to generate operational ton 612 that node 610 provides from operational ton.To this, correction generate node 620 unusual in, make to generate the operational ton 612 that node 610 provides from operational ton and come control actuating component 640 as control target 635.

In this embodiment, generate node 620 normal the time, pass through correction in correction, can carry out thinner control, in addition, when correction generation node 620 breaks down, make the hypokinetic while also can proceed control without correction.

Generating node 620 for normal owing to need know whether correction, is desirable so correction generation node 620 has fault detection capability 621.Based on the fault detect result 623 that fault detection capability 621 carries out, the switch 634 of executive component drive node 630 carries out change action.

For the information processing that needs height for correction generates, operational ton generates and can finish with fairly simple information processing.Therefore, correction generates node 620, and the result, components number increase, the operating frequency (clock frequency of processor) that require to compare the high processing performance with operational ton generation node 610 uprise, and require the few action of affluence amount electricity, heat.Thereby correction generates node 620 and compares with operational ton generation node 610, and failure rate (summation of the failure rate of parts (fit number)) uprises.

That is, correction generation node 620 is to generate the high node of node 610 processing poweies than operational ton.For example, correction generates node 620 by generate high computing machine (node) formation of node 610 operating frequencies than operational ton.

Thereby, generating node 610 for the operational ton of the required minimum of continuation of control, can expect to generate the low failure rate of node 620 than correction.That is, operational ton generation node 610 is to generate the low node of node 620 failure rates than correction.

Further, even also need operational ton to generate node 610 when node 620 breaks down, be desirable so operational ton generation node 610 has anti-fault function 611 for normal owing to generating in correction.

Generate the fault detection capability 621 that node 620 has as correction, existing all considerations, but as shown in figure 31, generate node 620 two-foldizations by making correction, also can compare its output.

At this moment have following method: in advance correction generate node 620 sides relatively the correction changed of two-fold generate the correction 622a and the 622b of node 620 outputs, transmit correction 622a and the folk prescription of 622b and fault detect result's methods to executive component drive node 630; Shown in figure 32, correction 622a and 622b that the correction generation node 620 of multipleization is exported are sent to executive component drive node 630 respectively, in executive component drive node 630, come comparison correction 622a and 622b to obtain fault detect result 623 method by comparing function 631.

In addition, considered that also various operational tons generate the anti-fault function 611 that node 610 has, but as shown in figure 31, also can judge and realize by the majority logic that makes operational ton generation node 610 triple modular redundants get its output.

At this moment have following method: operational ton 612a, the 612b, the 612c that the operational ton of tediously longization are generated node 610 generations take majority logic to judge in operational ton generation node 610 sides in advance, to the method for executive component drive node 630 transmission; Shown in figure 32, operational ton is generated operational ton 612a, 612b, the 612c that node 610 generates be sent to executive component drive node 630 respectively, the method that the most decision-making functions 633 that had by executive component drive node 630 take majority logic to judge.

In addition, be as shown in figure 33, on executive component drive node 630, the ramp generator 637 of the gain of the variable device 636 of gain-variable device 636 and ride gain is set, fault detect result 623 is input in the ramp generator 637, will to generate value that correction 622 usefulness gain-variable devices 636 that node 610 provides be multiplied by variable gain by operational ton, be applied on the operational ton 612 that provides from operational ton generation node 610, to control sensor device 640 as control target 635 also passable.At this moment, when correction generated node 620 unusual, control target 635 did not change sharp but changes at leisure.

The action schedule of present embodiment is shown among Figure 34.Generate node 620 for just often in correction, slope output 637 as the output of ramp generator 637 be the value of a high position, generate the correction 622 that node 620 provides from correction, be multiplied by gain by gain-variable device 636 predefined high positions, operational ton 612 additions with providing from operational ton generation node 610 come control actuating component 640 as control target 635.

To this, in correction when to generate node 620 be unusual, by the moment that becomes " unusually " from " normally ", 637 value gently variations in time from the value of a high position to low level are exported on the slope from fault detect result 623.

Its result, by gain-variable device 636 be multiplied by from correction generate the variable gain of the correction 622 that node 620 provides, also the yield value from the yield value of a high position to low level gently changes in time.Its result generates the correction 622 that node 620 provides from the correction that is coupled with when the calculating of control target 635, slowly reduces in time.

In embodiment shown in Figure 34, be 0 with the gain of low level, also can generate the size of gain of weight decision low level of the fault of node 620 according to correction.In addition, in this embodiment, slope output 637 is done to change linearly to the value of low level from the value of a high position, but also can be not limited to linearity and change in the mode arbitrarily that comprises curve.In addition, the mode of variation is desirable for successively decreasing monotonously.

According to the embodiment of above narration, because control target 635 is not rapidly but gently changes when correction generates node 620 unusual, so can not feel to have sense of discomfort to the operator.In addition, owing to do not follow the height difference of the control target 635 of switching, so can avoid resulting from controlled deterioration with respect to difference of height exclusive-OR function person's delay of response yet yet.

In addition, as shown in figure 35, generate operational ton 612 that node 610 provides and generate the correction 622 that node 620 provides from operational ton, also can constitute for the network that be sent to executive component drive node 630 through single communication road (communication bus) 650 from correction.

According to this embodiment, can not finish owing to individually do not have the communication road at nodetonode, so be associated with saving distribution, part on the basis of the cost that reduces system, can also reach lightweight at this point.

The information that transmits through the communication road 650 in the present embodiment, as shown in figure 36, node time by each transmission is divided into a plurality of time slots, operational ton 612 generates in node 610 distributed time slot 614 in the amount of being operated and transmits, and correction 622 generates in node 620 distributed time slot 624 in the amount of being corrected and transmits.

Here, the correction 622a and the 622b that the correction of narrating are previously generated node 620 outputs are sent to respectively in the method for executive component drive node 630, the tediously long correction of having changed generates node 620 and distributes other time slot respectively, transmission correction 622a and 622b in each time slot.

In addition, be sent to respectively in the method for executive component drive node 630 at operational ton 612a, the 612b, the 612c that operational ton are generated node 610 generations, on the operational ton generation node 610 of tediously longization, distribute each time slot respectively, transfer operation amount 612a, 612b, 612c in each time slot.

Figure 37 is illustrated in the concrete example of using present embodiment in the Steer-by-Wire system.

Connect Rotational Cylindrical (rolling disc) 615 in operational ton generation node 610, generation is according to the operational ton 612 of the helm angle of the work angle of Rotational Cylindrical 615, and this operational ton 612 is sent on the executive component drive node 630 by communication road 650.

Generate on the node 620 in correction, connect acceleration sensor Yaw rate sensor 625, signal that generation provides from acceleration sensor Yaw rate sensor 625 and the correction 622 that provides from the information of operational ton 612, this correction 622 is sent to executive component drive node 630 by communication road 650.

On executive component drive node 630, generate node 620 for just often in correction, will add that the value of correction 622 controls steering apparatus 641 as control target to operational ton 612.

According to above-described present embodiment, when the driver crosses component of rotation steering column 615, when not having correction 622, front-wheel loses locking and the stability decreases of vehicle, detect the sideslip and the rotation of vehicle by acceleration sensor yaw rate sensor 625, owing to reach from transferring to generate correction 622, so can improve vehicle handling and stability for suppressing sideslip by correction generation node 620.

Figure 38 is illustrated in the concrete example of using present embodiment in the Brake-by-Wire system.

Generate connection brake pedal 616 in the node 610 at operational ton, generation is according to the operational ton 612 of the braking legpower of the operation of brake pedal 616, and it is sent to executive component drive node 630-1～630-4 by communication road 650.

Generate connection acceleration sensor yaw rate sensor 625 in the node 620 in correction, generate the correction 622-1～622-4 of each pedal from the signal that provided by acceleration sensor yaw rate sensor 625 or from the information of operational ton 612, it is sent to executive component drive node 30 by communication road 650.

In executive component drive node 630-i (i=1～4), in correction when to generate node 620 be normal, will add that the value of correction 622-i (i=1～4) controls the detent 642-i (i=1～4) of each wheel as control target to operational ton 612.

According to above-described present embodiment, when the driver too enters into brake pedal 616, if there is not correction 622-i (i=1～4), then each wheel loses locking and the stability decreases of vehicle, but detect the sideslip and the rotation of vehicle by acceleration sensor yaw rate sensor 625, then owing to reach from transferring to generate correction 622-i (i=1～4), so can improve vehicle handling and stability for suppressing sideslip by correction generation node 620.

Figure 39 is illustrated in the concrete example of using present embodiment in the system of comprehensive Steer-by-Wire and Brake-by-Wire.

Generate connection steering column 615 and brake pedal 616 in the node 610 at operational ton, generation is according to the operational ton 612-0 of the helm angle of the work angle of steering column 615 with according to the operational ton 612-2 of the braking legpower of the operation of brake pedal 616, and it is sent to executive component drive node 630-0～630-4 by communication road 650.

In executive component drive node 630-0, generate node 620 normal the time in correction, will add that the value of correction 622-0 controls steering apparatus 641 as control target to operational ton 612-0.

In executive component drive node 630-i (i=1～4), in correction when to generate node 620 be normal, will add that the value of correction 622-i (i=1～4) controls the detent 642-i (i=1～4) of each wheel as desired value to operational ton 612-i.

According to above-described present embodiment, cross component of rotation steering column 615, too enter in the brake pedal 616 the driver, when not having correction 622-i (i=1～4), front-wheel loses locking and the stability decreases of vehicle, but detect the sideslip and the rotation of vehicle by acceleration sensor yaw rate sensor 625, then owing to reach from transferring to generate correction 622-i (i=1～4), so can improve vehicle handling and stability for suppressing sideslip by correction generation node 620.

(embodiment 8)

Embodiment 8 to controller of vehicle of the present invention describes with reference to Figure 40.

The controller of vehicle of present embodiment has following formation: the sensor 500 to the operational ton of the accelerator pedal of the driver's of vehicle movement requirement, brake pedal, bearing circle etc. is represented in detection; The sensor 550 of the information that the car that detects the car speed, acceleration, yaw speed of the state of expression vehicle movement and then obtain by electric wave or image is outer etc.; A plurality of executive components 400 of the power source of corresponding realization driving, braking, steering, each that brake, turn to; The operational ton that generates the object run amount of these executive component 400 usefulness of control generates node 100; Generate a plurality of executive component drive node 300 of the object run amount control actuating component 400 of node 100 generations based on operational ton.

Operational ton generates node 100, do not show in detail in the drawings, it has: the central processing unit of executive routine (CPU), nonvolatile memory storage (ROM) and nonvolatile memory storage (RAM) with stored routine and data, with the input-output device (I/O) that is connected sensor 500, sensor 550, executive component drive node 300 usefulness, these also can be by both party to the structure that constitutes of the general microcomputer that connects of bus.

Operational ton generates node 100, further has analog/digital conversion device (ADC), also sensor 500, sensor 550 can be connected on the ADC, have serial communication apparatus (SCI), also sensor 500, sensor 550, executive component drive node 300 can be connected on the SCI.And then these devices also can be the devices of realizing to a plurality of SIC (semiconductor integrated circuit) by 1.

Operational ton generates node 100, the object run amount of coming each executive component 400 of computing based on the Vehicular status signal 201 of the driver requested signal 200 of sensor 500 output and sensor 500 outputs, and it is sent in the executive component drive node 300 by network as operational ton command value 120.Operational ton command value 120 if power source then is a target drive force, if braking is the target braking force of each four-wheel then, then is the target rudder angle if turn to according to each executive component 400 decision executive components 400.

Executive component drive node 300 does not show in the drawings in detail, it has: the central processing unit of executive routine (CPU), nonvolatile memory storage (ROM) and nonvolatile memory storage (RAM) with stored routine and data, with be connected the input-output device (I/O) that sensor 500 and operational ton generate node 100 usefulness, these also can be by both party to bus connect and then have driving circuit that drives executive component and a formation that is connected to the general microcomputer of I/O.

Executive component drive node 300 further has analog/digital conversion device (ADC), also sensor 500 can be connected on the ADC, has serial communication apparatus (SCI), also sensor 500 to operational ton can be generated node 100 and be connected on the SCI.And then these devices also can be the devices of realizing to a plurality of SIC (semiconductor integrated circuit) by 1.

Executive component drive node 300 is not shown, but have one of them of the driving force that detects executive component 400, damping force, rudder angle or in order to infer these sensor of necessary information, the driving force of executive component 400, damping force, rudder angle and the operational ton command value 120 that generates node 100 receptions from operational ton are as one man carried out the drive controlling to executive component 400.

In addition, executive component drive node 300 will be sent to operational ton and generate in the node 100 by driving force, damping force, the rudder angle of the executive component of sensor.Thus, operational ton generates node 100 consult and carry out driving force, damping force, the rudder angle of element 400, object run amount that can each executive component 400 of computing.

Fault detection capability 210A, 210B, 210C that sensor 500, operational ton generation node 100, executive component drive node 300 have the fault that detects oneself respectively.

Fault detect by the sensor of fault detection capability 210A, the scope that can depart from regulation by the value that determine sensor 500 is detected realizes, in addition, also can realize by using a plurality of sensors that these testing result comparisons, check and correction or majority logic are judged.

The operational ton of fault detection capability 210B generates the fault detect of node 100, the short time error-detecting of the time-out of the CPU that forms by watchdog timer, the ROM, the RAM that form by tediously long symbol and twocouese bus, can realize by relatively checking of I/O, in addition, also can compare these outputs and check or majority logic is judged and realized by using a plurality of operational tons to generate nodes 100.

The fault detect of the executive component drive node 300 of fault detection capability 210C, the short time error-detecting of the time-out of the CPU that forms by watchdog timer, the ROM, the RAM that form by tediously long symbol and twocouese bus, can realize by relatively checking of I/O, in addition, also can get these outputs and relatively check or majority logic is judged and realized by using a plurality of operational tons to generate nodes.

And then fault detection capability 210C also has the function that detects the fault of executive component 400 from the difference of the variable quantity of the driving force of executive component 400, damping force, rudder angle or operational ton command value 120.

Fault detection capability 210A, 210B, 210C in the fault that detects own or executive component 400, generate node 100 and other executive component drive node 300 to operational ton, and the fault detect that output notice oneself is used for malfunction notifies 230.

Sensor 500, operational ton generate node 100, executive component drive node 300, only be respectively when nonserviceabling with the output fault detect and notify 230 and other output is stopped is desirable, and then, notify in 230 can not normally exporting fault detect, this fault detect notifies 230, and also to stop be desirable.

In addition, each executive component drive node 300 has based on oneself, other each executive component drive node 300, operational ton each fault detect result of generating node 100 waits the control program selection function (control method selecting arrangement) 200 of selecting control program (executive component control method) usefulness.

Control program selection function 200; usually select the control program of control actuating component 400 based on the operational ton command value 120 that provides from operational ton generation node 100; but when operational ton generation node 100 breaks down; select the control program of control actuating component 400 based on the driver requested signal 200 that provides from sensor 500; when own or other the executive component drive node 300 at specific place break down, select to stop safely the control program of the control of executive component 400.

Thus, even when operational ton generates node 100 and executive component drive node 300 and breaks down, can proceed vehicle control by the executive component drive node 300 that is in normal condition.

The controller of vehicle of this embodiment as shown in Figure 41, also can generate node 100 with operational ton by the network 600 of CAN etc. and can be connected communicatedly with executive component drive node 300 and sensor 500.Operational ton generates node 100 and executive component drive node 300 and sensor 500, respectively operational ton command value 120, fault detect is notified 230, driver requested signal 200 and other short message, is delivered in the desirable node via network 600.And then a plurality of nodes also can receive the short message that each sensor sends.

In addition, as shown in figure 42, the controller of vehicle of this embodiment also can also be connected to the formation of network 600 for sensor 550 as a node.Thus, sensor 550 can send to Vehicular status signal 201 in the desirable node through network 600.And then, a plurality of nodes also can receiving sensor 550 short messages that send.

In addition, in Figure 41, controller of vehicle shown in Figure 42,, can improve the reliability of network by having a plurality of networks 600 and having tediously long property.

Figure 43 is the functional block diagram that operational ton generates node 100.Operational ton generates node 100, a plurality of control programs of vehicle being controlled usefulness are encased among ROM and the RAM, when detecting the fault of oneself by fault detection capability 210B, or receiving fault detect and notifying in 230 from sensor 500, sensor 550, executive component drive node 400, according to the place of fault and the degree of fault, switching control program.

Figure 44 is the functional block diagram of executive component drive node 300.Executive component drive node 300 will be used for coming a plurality of control programs of the action desired value of computing executive component 400 to be encased in ROM and RAM based on the operational ton command value 120 that generates node 100 receptions from operational ton.Executive component drive node 300, have: the operational ton command value 120 that generates node 100 outputs based on operational ton is come the program X of control actuating component 400, come the control program Y of control actuating component 400 with driver requested signal 200 based on sensor 500 outputs, with control program Z 200 irrelevant with operational ton command value 120 and driver requested signal, that executive component maintained the state of regulation, by control program selection function 220, according to the fault of oneself or the fault state of other node, can switching control program.

Below, be example with Figure 40～Figure 44, continue the basic processing that vehicle movement uses when being to break down in this controller of vehicle and describe.

Basic processing when operational ton generation node 100 is broken down describes.Operational ton generates node 100, and when detecting the fault of oneself by fault detection capability, the transmission of shut-down operation amount command value 120 simultaneously, sends fault detect and notifies 230.Notify in 230 can not normally sending fault detect, operational ton generates node 100 also to be stopped fault detect and notifies 230 transmission.

Thus, be connected to each executive component drive node 300 of network 600, notify 230 by reception from the fault detect that operational ton generation node 100 provides, can fault take place detecting operation amount generation node 100, in addition, by in the predetermined time, not receiving operational ton command value 120, can detect and generate node 100 at operational ton and taken place that certain is unusual.

In addition, if make network 600 be timesharing multiple access (TDMA), constitute each node and giving the transmission that fixed time slot is carried out short message, then generate node 100 and confirm the reception that has or not, generate node 100 at operational ton and taken place that certain is unusual and can detect at the time slot of transmit operation amount command value 120 by operational ton.

Each executive component drive node 300, generate fault detect that node 100 provides from operational ton and notify 230 or when detecting the transmission that does not receive operational ton command value 120 when detecting, control program is switched to (Y) from (X), carry out the vehicle movement control of driving force, damping force, rudder angle etc. with the driver requested signal 200 that is taken into sensor 500 from network 600.

Thus, even breaking down, operational ton generation node 100 also proceeds vehicle movement control.

Basic processing when then, executive component drive node 300 and executive component 400 being broken down describes.In addition, in the fault of executive component 400, comprise the fault of controlling needed rotational position sensor and current sensor etc. for not shown executive component.

When executive component drive node 300 on each of the detent that is arranged on four-wheel or executive component 400 break down, executive component drive node 300, when detecting the fault of oneself by fault detection capability, notify in 230 in the transmission fault detect, control program is switched to (Z) from (X), to liberate the braking control of this wheel.

Operational ton generates node 100, notifies at 230 o'clock receiving fault detect, takes turns to three-wheel by remaining two and comes control brake power.Perhaps, the driver uses the backup mechanism of the machinery of oil sector etc. to come direct abrupt deceleration vehicle.

Thus, even the executive component drive node 300 or the executive component 400 that are arranged on each of detent of four-wheel break down, also can proceed vehicle movement control.

When executive component drive node 300 on being arranged at steering gear or executive component 400 break down, when executive component drive node 300 detects the fault of oneself by fault detection capability 210C, notify in 230 sending fault detect, control program is switched to (Z) from (X) rudder angle control is stopped.

And the driver uses the backup mechanism of the machinery of steering column etc. directly to control the vehicle steering.In the backup mechanism that does not have machinery, a plurality of executive component drive node 300 and executive components 400 that turn to usefulness are set, by at least one executive component drive node 300 and executive component 400 control rudder angles.

Thus, break down and also can proceed vehicle movement control even be arranged at the executive component drive node 300 of steering gear or executive component 400.

When being set to executive component drive node 300 that driving force uses or executive component 400 and breaking down, when executive component drive node 300 detects the fault of oneself by fault detection capability, notify in 230 sending fault detect, control program is switched to (Z) from (X) drive controlling is stopped.

Thus, break down vehicle safety is stopped even being set to executive component drive node 300 that driving force uses or executive component 400.

When the sensor 500 that brake pedal is used breaks down, liberate the braking of the detent of full wheel, the driver uses the direct abrupt deceleration vehicle of backup mechanism of the machinery of oil sector etc.In the backup mechanism that does not have machinery, the sensor 500 that a plurality of brake pedals are used is set, can detect driver's requirement with at least one sensor 500.

Thus, even the sensor 500 that brake pedal is used breaks down, also can proceed vehicle movement control.

When the sensor 500 that bearing circle is used breaks down, steering gear control is stopped, the driver uses the direct steering vehicle of backup mechanism of the machinery of steering column etc.In the backup mechanism that does not have machinery, the sensor 500 that a plurality of brake pedals are used is set, can detect driver's requirement with at least one sensor 500.

Thus, even breaking down, the sensor 500 that bearing circle is used also can proceed vehicle movement control.

When the sensor 500 that accelerator pedal is used breaks down, driving force control is stopped, vehicle safety ground is stopped.The sensor 500 that a plurality of brake pedals are used perhaps is set, can detects driver's requirement with at least one sensor 500.

Thus, can proceed vehicle movement control.

When sensor 500 broke down, operational ton generated node 100 and continues vehicle movement based on the car status information 201 that normally obtains with from the driver requested signal 200 that sensor 500 is obtained.

As described above, according to present embodiment, because operational ton generates node 100 and executive component drive node 300 backs up mutually, so there is no need additional tediously long back-up device.

Yet when operational ton generation node 100 broke down, element drives node 300 was carried out control respectively independently.

Therefore, need executive component drive node 300 fault of detecting operation amount generation node 100 comparably, in addition, even when the basic last minute executive component drive node 300 of vehicle movement Comprehensive Control ECU30 breaks down, also can control vehicle safely by remaining executive component drive node 300.Particularly detent about damping force produce difference in, be the state of one-sided effect, vehicle is rotation in braking.

Use Figure 45～Figure 57 to be elaborated to the action example that generates node 100 and executive component drive node 300 for the operational ton of avoiding such precarious position.Here, be that example illustrates each action with the detent.

Operational ton generates node 100, carries out the processing of braking control repeatedly with certain control cycle (A).This control cycle is decided by the claimed accuracy of vehicle braking control.In addition, each executive component drive node 300 with control cycle (A) comparison of operational ton generation node 100, is carried out the braking force control of executive component 400 as described later repeatedly with shorter control cycle (B).This is the cause owing to precision that the Current Feedback Control of executive component 400 is had relatively high expectations.

Thereby, generate node 100 during control cycle (A) is carried out a series of processing at operational ton, each executive component drive node 300, based on up-to-date operational ton command value 120, carry out braking force control repeatedly, interrupt braking force control in the communication process etc. that generates node 100 with operational ton with control cycle (B).

Figure 45 is the time diagram of the action of expression executive component drive node 300.Transverse axis is represented the process of time from left to right.Each executive component drive node 300 is carried out following processing repeatedly with control cycle (B).

At first, executive component drive node 300 confirms whether to generate from operational ton that node 100 has received operational ton command value 120 and fault detect is notified 230, received driver requested signal 200 (command value, fault detect notice confirmation of receipt B1) from sensor 500.These are owing to the interval with control cycle (A) sends, so use the timer of the time of instrumentation control cycle (A) can confirm the reception of operational ton command value 120, driver requested signal 200.Perhaps, sending reception by the network that these is used timesharing multiple access (TDMA) type with predetermined time slot also can confirm to receive.

Then, executive component drive node 300 will be at the damping force and the diagnostic result that is provided by fault detection capability 210C of the executive component 400 of the last detection of last time control cycle, send to operational ton and generate node 100 or other executive component drive node 300 (reply short message and send B2).At this moment, when not receiving operational ton command value 120, do not notify in 230 in that the operational ton command value is received, receives fault detect, notify the fault detect notice to receive together yet by (command value, fault detect notice confirmation of receipt B1).These are as one reply short message and send together.

Then, executive component drive node 300, based on the reception that has or not operational ton command value 120, have or not fault detect to notify 230 reception, have or not executive component 400 and the fault of oneself and have that other executive component drive node 300 of having no way of provides reply short message and content choice control program (control program is selected B3) thereof.Control program, has the control program (X) of carrying out braking force control based on operational ton command value 120, with the control program (Y) of carrying out braking force control based on driver requested signal 200, also with operational ton command value 120 and driver requested signal 200 enough irrelevant control programs (Z) of liberating braking, and from wherein selecting one.

To the option program (B3) of this control program, describe with reference to the flow process of Figure 46.

At first, to the executive component drive node 300 of oneself or the unusual generation of executive component 400, judge (step S1610) by following condition.

Condition 1: result, the detection failure of the diagnosis of own and executive component.

Condition 2: receive fault detects and notifying at 230 o'clock generating node 100 from operational ton, other plural executive component drive node 300 is replied and is not received fault detect and notify 230.

Condition 3: do not receive fault detects and do not notifying at 230 o'clock generating node 100 from operational ton, other plural executive component drive node 300 is replied and is received fault detect and notify 230.

Condition 4: when generating node 100 reception operational ton command value 120 from operational ton, other plural executive component drive node 300 is replied and is not received operational ton command value 120.

Condition 5: when generating node 100 from operational ton and do not receive operational ton command value 120, other plural executive component drive node 300 is replied and is received operational ton command value 120.

From above condition 1 to condition 5, when at least one is set up, be judged as own unusually, select control program (Z) liberation braking (step S1680).

Then, the unusual generation of operational ton generation node 100 is judged (step S1620) by following condition.

Condition 6: generate node 100 from operational ton and receive fault detects and notify 230, and other plural operational ton generates node 100 and also replys and received fault detect and notify 230.

Condition 7: generate node 100 from operational ton and do not receive operational ton command value 120, and other plural operational ton generation node 100 is also replied and do not received operational ton command value 120.

When the condition of condition 6,7 was all invalid, operational ton generates node 100 judged that normally selection control program (X) (step S1660) is carried out braking force control based on operational ton command value 120.

In addition, at least one establishment, operational ton generates node 100 to be judged unusually, and other the executive component drive node 300 or the unusual generation of executive component 400 are judged (step S1630) by following condition among condition 6,7.

Condition 8: other executive component drive node 300 notice faults.

Condition 9: other an executive component drive node 300 does not send replys short message.

Condition 10: receive fault detect and notify at 230 o'clock generating node 100 from operational ton, only other executive component drive node 300 is replied and is not received fault detect and notify 230.

Condition 11: do not receive fault detect and notify at 230 o'clock generating node 100 from operational ton, only other executive component drive node 300 is replied and has been received fault detect and notify 230.

Condition 12: when generating node 100 from operational ton and receive operational ton command value 120, only other executive component drive node 300 is replied and is not received operational ton command value 120.

Condition 13: when generating node 100 from operational ton and do not receive operational ton command value 120, only other executive component drive node 300 is replied and has been received operational ton command value 120.

When 13 condition was all invalid from above-mentioned condition 8 to condition, other executive component drive node 300 and executive component 400 were judged as normally, selected control program (Y) (step S1670), carried out braking force control based on driver requested signal 200.

In addition, among condition 8 to 13, in at least one establishment, other executive component drive node 300 or executive component 400 are judged to be unusually, for the one-sided effect of avoiding braking, with reference to control program option table described later (step S1640), select control program (Y) or (Z) one of them (step S1650).

As described above, executive component drive node 300, based on from condition 1 to condition 13, the executive component drive node 300 or unusual, the operational ton of executive component 400 of judging oneself generates that node is 100 unusual, other executive component drive node 300 or executive component 400 unusual, and select control program.

In addition, above-mentioned condition is because according to the form of the form of Vehicular system and each inscape and difference, so also can use the condition according to them.

In addition, notify 230 etc. not reception for generate operational ton command value 120 that node 100 provides and fault detect from operational ton, be not directly be judged as unusual, can be unusual for being judged as when not receiving more than the secondary.At this moment, can not receive number of times yet, get majority logic judgement etc., make not receive the number of times unanimity in 300 exchanges of each executive component drive node.

Figure 47 (a) and (b) are represented the control program option table.

Table (a) is in the braking of four-wheel, in other executive component drive node 300 or when executive component 400 be unusual, is taken turns and the table of the detent abrupt deceleration vehicle ground selection control program of back two one of them of taking turns by the first two.

In addition, table (b) is in the braking of four-wheel, in other executive component drive node 300 or when executive component 400 be unusual, by the table that is in the detent abrupt deceleration vehicle ground selection control program of taking turns in previous round on the diagonal line and back one.

In addition, in these tables, its prerequisite is, take turns by the first two or back two take turns or be in the detent of previous round on the diagonal line and back one one of them of taking turns can not abrupt deceleration vehicle in, the braking that liberation is formed by full executive component 400, and the driver is by the oil sector abrupt deceleration vehicle.

Certainly, even under these circumstances, also can carry out car brakeing by remaining normal executive component 400.

In addition, in the backup that does not have oil sector, even take turns by the first two or back two take turns or be in the detent of previous round on the diagonal line and back one one of them of taking turns can not abrupt deceleration vehicle in, also need to carry out car brakeings by remaining normal executive component 400.By these the time controlling combustion engine rotation number reduce the speed of vehicle, it is desirable suppressing the influence that the one-sided effect of braking brings.

After control program is selected to finish, turn back in the explanation of using Figure 45, carry out the computing of damping force and carry out braking control (B4), thereafter, carry out being taken into and fault information collection (B5) of actual damping force.

Figure 48 is the time diagram that the operational ton in beginning period of expression braking generates the action of node 100 and executive component drive node 300.Transverse axis is represented the process of time from left to right.

At first, operational ton generates node 100 after the entering into of the brake pedal that detects the driver, and the executive component drive node 300 of four-wheel is sent braking begin notice (1810).

Each executive component drive node 300 received the braking begin the notice after, operational failure measuring ability 210C carries out the fault diagnosis of oneself and the fault diagnosis (1820) of executive component 400, and diagnostic result is sent to operational ton generation node 100 (1830) by replying short message.In addition, each executive component drive node 300 receives other diagnostic result mutually.

Operational ton generates the diagnostic result that node 100 receives each executive component drive node 300, selects brake the wheel (1840) of control according to the having or not of malfunctioning node and the position of malfunctioning node.In addition, when executive component drive node 300 did not send diagnostic result, this node was regarded the node that breaks down as.Perhaps, also can send braking once more begins to notify the diagnostic result that once provides to examination for several times from executive component drive node 300 to send.

Operational ton generates node 100, and computing is for the object run amount (1850) of the wheel that should control, and to the executive component drive node 300 transmit operation amount command value 120 (1860) as object.

Each executive component drive node 300 after receiving operational ton command value 120, is upgraded the desired value of braking force control and is carried out the braking force control (1870) of executive component 400.

In addition, each executive component drive node 300, certain cycle with the detection of the damping force of executive component 400 and the regular diagnostic result that detects by fault detection capability 210C, send to operational ton and generate node 100 (1880) by replying short message.At this moment, each executive component drive node 300 also receives other diagnostic result mutually.

Figure 49 is the time diagram that the operational ton in the expression braking control generates the action of node 100 and executive component drive node 300.Transverse axis is represented the process of time from left to right.

Operational ton generates node 100 and carries out following processing by each control cycle (A).

At first, operational ton generates node 100 and receives from what each executive component drive node 300 provided and reply short message (1910), with reference to the fault diagnosis result that is included in each executive component drive node 300 of replying in the short message, confirm unusual the having or not and exception of each executive component drive node 300 and executive component 400, selection should be braked each executive component drive node 300 (1920) of control.

Then, operational ton generates the object run amount (1930) of node 100 computings for the wheel that should brake control, to the executive component drive node 300 transmit operation amount command value 120 (1940) as object.

In addition, in Figure 49, by operational ton generation node 100 detection drivers' entering into of brake pedal the executive component drive node 300 of four-wheel is sent braking and begin notice, begin braking control, if but with driver's brake pedal enter into have or not difference as driver's required amount, then with driver's brake pedal enter into have or not irrelevantly, always can carry out a series of processing repeatedly at control cycle (A) as shown in figure 49 and make operational ton generate node 100.

Figure 50 is the process flow diagram that the wheel of selection execution braking control is used.

At first, the operational ton unusual generation that generates 100 pairs of nodes oneself is judged (step S2010) by following condition.

Condition 1: the fault detection capability 210B by oneself detects result, the fault of diagnosing.

Condition 2: do not receive from what the executive component drive node 300 more than three provided and reply short message.

In above condition 1, condition 2, when at least one is set up, operational ton generates node 100 and is judged as unusually, when 300 transmission fault detects notify 230 to the executive component drive node (step S2040), and the transmission (step S2050) of shut-down operation amount command value 120.

In addition, in condition 1, when condition 2 is all invalid, operational ton generates node 100 and is judged as normally, to the unusual generation of executive component drive node 300 or executive component 400, with following condition criterion (step S2020).

Condition 3: receive the fault detect notice from executive component drive node 300.

Condition 4: do not have to receive from what the executive component drive node 300 below two provided and reply short message.

When above-mentioned condition 3 and condition 4 were all invalid, all executive component drive node 300 and executive component 400 were judged as normally, the whole braking force control (step S2070) of execution four-wheel.

To this, in condition 3 and condition, in its any one establishment, executive component drive node 300 or executive component 400 are judged as unusually, in order to avoid the one-sided effect of detent, with reference to brake wheel option table described later (2030), carry out the braking force control (step S2060) that provides by the wheel of selecting.

As described above, operational ton generate node 100 based on condition 1 to condition 4 judge own unusual, executive component drive node 300 or executive component 400 unusually, if own is normal, braking control is carried out on the one-sided effect ground of then use normal executive component drive node 300, avoiding detent, own if unusual, stop oneself braking control, move to the braking control of the self-discipline of carrying out by executive component drive node 300.

In addition, above-mentioned condition is because according to the form of the form of Vehicular system and each inscape and difference, so also can use condition according to them.In addition, from the not reception of replying short message that executive component drive node 300 provides, not directly to be judged as unusually, also can be unusual for being judged as when not receiving more than the secondary.

Figure 51 (a) and (b) are represented the brake wheel option table.

Table (a) is, in the braking of four-wheel, when executive component drive node 300 or executive component 400 be unusual, taken turns or the table of the detent abrupt deceleration vehicle ground selection control brake wheel of back two one of them of taking turns by the first two.

Table (b) is, in the braking of four-wheel, in other executive component drive node 300 or when executive component 400 be unusual, by the table that is in the detent abrupt deceleration vehicle ground selection brake wheel of taking turns in previous round on the diagonal line and back one.

In addition, though not expression in these tables, but its prerequisite is, take turns by the first two or back two take turns or be in the detent of previous round on the diagonal line and back one one of them of taking turns can not abrupt deceleration vehicle in, operational ton generates the braking arithmetic operation amount instruction 120 of the full executive component 400 of node 100 liberation, and the driver is by the pressurized oil braking vehicle.

Certainly, even in such situation, also can carry out car brakeing ground arithmetic operation amount instruction 120 by remaining normal executive component 400.

In addition, when not having the backup mechanism of oil pressure, even take turns by the first two or back two take turns or be in the detent of previous round on the diagonal line and back one one of them of taking turns can not abrupt deceleration vehicle in, also need to carry out car brakeings by remaining normal executive component 400.By these the time controlling combustion engine rotation number reduce the speed of vehicle, the influence that the one-sided effect that can suppress to brake is brought is desirable.

Figure 52 is the beginning period that is illustrated in braking, and the operational ton when the executive component drive node 300 of left rear wheel or executive component 400 break down generates the time diagram of the action of node 100 and executive component drive node 300.Transverse axis is represented the process of time from left to right.

In addition, in this time diagram, operational ton generates node 100 and is based on the node that the brake wheel option table (a) shown in Figure 51 selects to carry out the wheel of braking force control.

At first, operational ton generates node 100 after the entering into of the brake pedal that detects the driver, and the executive component drive node 300 of four-wheel is sent braking begin notice (2210).

Each executive component drive node 300 receive the braking begin the notice after, operational failure measuring ability 210C carries out the fault diagnosis of oneself and the fault diagnosis (2220) of executive component 400, and diagnostic result is sent to operational ton generation node 100 (2230) by replying short message.At this moment, the executive component drive node 300 of left rear wheel passes to operational ton generation node 100 with detection failure by replying short message.In addition, each executive component drive node 300 receives other diagnostic result mutually.

Operational ton generates node 100, receives the diagnostic result of each executive component drive node 300, and fault has taken place the executive component drive node 300 that detects left rear wheel, is taken turns by the first two and carries out braking control and select wheel (2240).

Operational ton generates node 100, computing is for the first two object run amount (2250) of taking turns, in the executive component drive node 300 transmit operation amount command value 120 of taking turns, send the operational ton command value 120 (2260) of liberation damping force for the back two executive component drive node of taking turns 300 to the first two.

The executive component drive node 300 that the first two is taken turns after receiving operational ton command value 120, is upgraded the desired value of braking force control and is carried out the braking force control of executive component 400.In addition, the executive component drive node 300 of off hind wheel after receiving operational ton command value 120, is upgraded the desired value of braking force control and is carried out the braking force control of executive component 400, but because operational ton command value 120 is values of liberation damping force, so in fact damping force do not take place.

The executive component drive node 300 of left rear wheel in addition, owing to detect result, the selection control program (Z) of own fault, so damping force (2270) does not take place.

Figure 53 is the time diagram that the operational ton when being illustrated in the executive component drive node 300 of left rear wheel in the braking control or executive component 400 and breaking down generates the action of node 100 and executive component drive node 300.Transverse axis is represented the process of time from left to right.

In addition, in this time diagram, operational ton generates node 100 and is based on the node that the brake wheel option table (a) shown in Figure 51 is selected the wheel of execution braking force control.

At first, operational ton generates node 100, reception is replied short message from what each executive component drive node 300 provided, from being included in the fault diagnosis result of each executive component drive node 300 of replying the short message, fault (2310) has taken place in the executive component drive node 300 that detects left rear wheel, is taken turns by the first two and selects wheel (2320) with carrying out braking control.

Then, operational ton generates node 100, computing is for the object run amount (2330) of the wheel that should brake control, in the executive component drive node 300 transmit operation amount command value 120 of taking turns, send the operational ton command value 120 (2240) of liberation damping force for the back two executive component drive node of taking turns 300 to the first two.

The executive component drive node 300 that the first two is taken turns after receiving operational ton command value 120, is upgraded the desired value of braking force control and is carried out the braking force control of executive component 400.In addition, the executive component drive node 300 of off hind wheel after receiving operational ton command value 120, is upgraded the desired value of braking force control and is carried out the braking force control of executive component 400, but because operational ton command value 120 is values of liberation damping force, so in fact damping force do not take place.

In addition, the executive component drive node 300 of left rear wheel detects the result of the fault of oneself, owing to select control program (Z) that damping force (2270) does not take place.

More than, as use Figure 52 and Figure 53 explanation, even when executive component drive node 300 or executive component 400 break down arbitrarily, operational ton generates node 100 uses, and the first two is taken turns or back two executive component drive node 300 abrupt deceleration vehicles of taking turns normally, so generating run amount command value 120 for this reason is the one-sided effect that can avoid braking.

Figure 54 is the time diagram that the operational ton when being illustrated in the executive component drive node 300 of the left rear wheel that breaks down for the moment in the braking control or executive component 400 and recovering generates the action of node 100 and executive component drive node 300.Transverse axis is represented the process of time from left to right.

In addition, in this time diagram, operational ton generates node 100 and is based on the node that the brake wheel option table (a) shown in Figure 51 selects to carry out the wheel of braking force control.

Operational ton generates node 100, because the executive component drive node 300 of left rear wheel breaks down, select wheel so take turns execution braking control by the first two, in the executive component drive node 300 transmit operation amount command value 120 that the first two is taken turns, send the operational ton command value 120 (2410) of liberation damping force for the back two executive component drive node of taking turns 300.

Each executive component drive node 300, operational failure measuring ability 210C carries out the fault diagnosis of oneself and the fault diagnosis of executive component 400, and diagnostic result is sent to operational ton generation node 100 (2420) by replying short message.At this moment, the executive component drive node 300 of left rear wheel, when fault recovery, control program is switched to (X) from (Z), operational ton command value 120 based on liberation damping force, when damping force is maintained the liberation state, fault has been recovered to generate node 100 by replying the short message notification operational ton.In addition, each executive component drive node 300 receives other diagnostic result mutually.

Operational ton generates the diagnostic result that node 100 receives each executive component drive node 300, detects the fault of the executive component drive node 300 of left rear wheel and recovers, is carried out braking control, is selected wheel (2430) by four-wheel.

Operational ton generates node 100, and computing is for the object run amount (2440) of four-wheel, to the executive component drive node 300 transmit operation amount command value 120 (2450) of four-wheel.

The executive component drive node 300 that the first two is taken turns after receiving operational ton command value 120, is upgraded the desired value of braking force control and is carried out the braking force control of executive component 400.In addition, the executive component drive node 300 of off hind wheel is upgraded the desired value of braking force control and is carried out the braking force control of executive component 400 also after receiving new operational ton command value 120.And then, after the executive component drive node 300 of left rear wheel also receives new operational ton command value 120, upgrade the desired value of braking force control and carry out the braking force control of executive component 400.

More than, as use Figure 54 illustrates, even when the executive component drive node 300 that breaks down for the moment or executive component 400 have recovered, because operational ton generates node 100 according to the normal/abnormal of executive component drive node 300 or executive component 400 and generating run amount command value 120, so the one-sided effect of not braking just can return to normal state of a control.

Figure 55 is the time diagram that is illustrated in the action of the executive component drive node 300 when operational ton generation node 100 breaks down in the braking control.Transverse axis is represented the process of time from left to right.

In addition, in this time diagram, executive component drive node 300 is based on the node that control program option table (a) shown in Figure 47 is selected control program.

Operational ton generates node 100, and when detecting fault by fault detection capability 210B, the transmission of shut-down operation amount command value 120 sends fault detect and notifies 230 (2510).

Each executive component drive node 300 notifies at 230 o'clock receiving fault detect, sends and replys short message, confirms that mutually fault detect notifies 230 reception, and it be (2520) unusually that the decision operation amount generates node 100.

Each executive component drive node 300 when to generate node 100 be unusual, switches to control program (Y) with control program (X) in the decision operation amount, carries out braking force control based on driver requested signal 200.

More than, as use Figure 55 illustrates, even when operational ton generation node 100 breaks down, each executive component drive node 300 confirms that mutually operational ton generates the fault generation of node 100, come abrupt deceleration vehicle with whole switching control program, the driver requested signal 200 of use, so can keep vehicle braked control.

Figure 56 is the time diagram that the operational ton when being illustrated in operational ton generation node 100 recoveries of breaking down for the moment in the braking control generates the action of node 100 and executive component drive node 300.Transverse axis is represented the process of time from left to right.

In addition, in this time diagram, executive component drive node 300 is based on the node that control program option table (a) shown in Figure 47 is selected control program.

Executive component drive node 300 breaks down because operational ton generates node 100, thus use control program (Y), and carry out braking force control based on driver requested signal 200.

Operational ton generates node 100, when fault recovery, reception is replied note (2610) from what each executive component drive node 300 provided, confirm that with reference to the fault diagnosis result that is included in each executive component drive node 300 of replying in the note each executive component drive node 300 and executive component 400 have no abnormal and exception, and select brake each executive component drive node 300 (2620) of control.

Then, operational ton generates node 100, and computing is for the object run amount (2630) of the wheel that should brake control, to the executive component drive node 300 transmit operation amount command value 120 (2640) as object.In addition, operational ton generates node 100, also can send the fault recovery notice together for oneself recovers notice executive component drive node 300 with fault.

Each executive component drive node 300 after receiving operational ton command value 120, sends the reception that response message is confirmed operational ton command value 120 mutually, and it is normal (2650) that the decision operation amount generates node 100.At this moment, can judge whether that also it serves as normal that operational ton generates node 100 with the reception of fault recovery notice.

Each executive component drive node 300 generates node 100 for just often in the decision operation amount, control program (Y) is switched to control program (X), and carry out braking force control based on operational ton command value 120.

More than, as use Figure 56 illustrates, even when the operational ton generation node 100 that breaks down has for the moment recovered, because each executive component drive node 300 is normal/abnormally come switching control program according to what operational ton generated node 100, so the one-sided effect of not braking can return to normal state of a control.

Figure 57 is expression, the time diagram of the action of the executive component drive node 300 when the executive component drive node 300 of operational ton generation node 100 and left rear wheel or executive component 400 break down in braking control.Transverse axis is represented the process of time from left to right.

In addition, in this time diagram, executive component drive node 300 is based on the node that control program option table (a) shown in Figure 47 is selected control program.

Operational ton generates node 100, and when detecting fault by fault detection capability 210B, the transmission of shut-down operation amount command value 120 sends fault detect and notifies 230 (2510).In addition, the executive component drive node 300 of left rear wheel when detecting fault by fault detection capability 210B, switches to control program (Z) with control program (X).

Each executive component drive node 300 notifies at 230 o'clock receiving fault detect, sends to reply short message and confirm that mutually fault detect notifies 230 reception.The executive component drive node 300 of the left rear wheel that at this moment, breaks down is used and is replied short message and will detect other executive component drive node 300 (2720) of signalling trouble.

Thus, the executive component drive node 300 that other executive component drive node 300, decision operation amount generate node 100 and left rear wheel is unusual, and selects control program based on control program option table (a).

The executive component drive node 300 of left and right sides front-wheel switches to control program (Y) with control program (X), carries out braking force control based on driver requested signal 200.In addition, the executive component drive node 300 of off hind wheel switches to control program (X) control program (Z) and liberates damping force.

More than, as use Figure 57 illustrates, even when operational ton generates node 100 and executive component drive node 300 and breaks down, each executive component drive node 300 confirms that mutually operational ton generates the fault generation of node 100 and executive component drive node 300, because according to the local switching control program of each executive component drive node 300 of breaking down, suitably carry out the braking force control of using driver requested signal 200 or the liberation of damping force, so in the one-sided effect of avoiding braking, can keep vehicle braked control.

In the above description, be that example has illustrated that operational ton generates the action of node 100 and executive component drive node 300 with the braking, but the present invention can be applicable to too and turn to.

When the executive component drive node 300 of rudder angle control usefulness or executive component 400 broke down, the executive component drive node 300 of rudder angle control usefulness sent to operational ton with the fault detect notice and generates node 100 and other executive component drive node 300.

And, operational ton generates node 100 when receiving from fault detect notice that the executive component drive node 300 of rudder angle control usefulness provides, if the executive component drive node 300 and executive component 400 multipleization of rudder angle control usefulness, then, can continue steering control to the executive component drive node 300 transmit operation amount command value 120 of normal rudder angle control usefulness.The perhaps mode that rotatablely moves that produces vehicle with the right wheel and the damping force difference of left wheel by braking also can continue steering control to the executive component drive node 300 transmit operation amount command value 120 of rudder angle control usefulness.

In addition, in the fault that operational ton generation node 100 takes place, operational ton generates node 100 the fault detect notice is sent to each executive component drive node 300.And the executive component drive node 300 of rudder angle control usefulness is taken into the driver requested signal 200 of sensor 500 and can proceeds steering control.

In addition, when the executive component drive node 300 of rudder angle control usefulness or executive component 400 break down, because receiving the fault detect notice that provides from the executive component drive node 300 of rudder angle control usefulness or not receive, the executive component drive node 300 of braking control usefulness replys short message, then detect the fault of the executive component drive node 300 of rudder angle control usefulness, driver requested signal 200 based on sensor 500, produce rotatablely moving of vehicle by the right wheel of braking and the damping force difference of left wheel, by replying each operational ton of short message cross-reference, also can continue steering control simultaneously.

In the above description, controller of vehicle with operational ton generation node 100 and executive component drive node 300 is narrated, but the present invention is as shown in Figure 58, do not use operational ton to generate node 100, to effective with the controller of vehicle of each executive component drive node 300 control vehicle yet.

Executive component drive node 300 in the controller of vehicle of present embodiment, one of them of selection control program (Y) or control program (Z) come control actuating component 400, but the selection of this control program, in the above embodiments of controller of vehicle, the situation that breaks down with operational ton generation node 100 is identical.

Thus, by executive component drive node 300 limits of self contained function coordinate mutually, control actuating component 400 simultaneously, even when not having operational ton to generate node 100, also can realize safe controller of vehicle.

(embodiment 9)

Below, use Figure 59～Figure 61, the embodiment 9 of controller of vehicle of the present invention is described.

Figure 58 represents the basic comprising of the controller of vehicle among the embodiment 9.Controller of vehicle generates node 100 and executive component drive node 300 constitutes by sensor 500, executive component 400, the operational ton of the requirement that detects the driver.

Wherein, the sensor 500, the operational ton that detect driver's requirement generate node 100 and executive component drive node 300, have fault detection capability 210A, 210B, 210C respectively.The fault detection capability 210C of executive component drive node 300 is not only own diagnostic function, also has the function of the fault that detects executive component 400.

Operational ton generates node 100, comes arithmetic operation amount command value 120 based on driver's require signal 200 and Vehicular status signal 201.Receive this operational ton command value 120, executive component drive node 300 control actuating component 400, carry out vehicle driving, steering,, braking etc.

Fault detection capability 210A, 210B, 210C notify 230 to the outside output notice oneself of node for the fault detect of malfunction when having detected the fault of intranodal or executive component 400.When the node with fault detection capability all is the fault state, remove this fault detect of output and notify beyond 230, stop output to the outside.It is reactionless promptly to constitute fault.

In addition, each node has Data Receiving table 9100.Omit explanation here, but equally also have data transmission table.Be encased in the data of transmission table, output to other node with the cycle that in system, is predetermined.In addition, the opposite data that receive from other node temporarily are stored into the Data Receiving table, read according to the control cycle of node to be utilized.

The connection of each node is removed beyond the connection of the signal wire shown in Figure 59, also can get bus formation or the network formation of cutting apart the common communication road of use with the time.In this embodiment, can receive from the data of a node output by a plurality of nodes.Each fault detection capability 210A, 210B, 210C infer the state of other node according to the content of this Data Receiving table, in addition, also have this is inferred the function that the result reports a plurality of nodes.

Figure 60 is the figure of the concrete example of record Data Receiving table 9100.Has the short message number information group 9101 that difference sends source, further difference transmission item.This also can be actual message block, also can be pre-assigned specific address in short message, also can not have the message block of real attitude.

In other message block of Data Receiving table 9100, have the validity of this short message of expression effective information group 9102, write down this short message and send time information group 9103, short message data message group 9104, fault vote information group 9105 constantly.

From the short message of each node output, comprising these information, distinguishing with the message block that is predetermined at receiving node and be stored in the table.

In addition, owing to just do not need to store for unwanted short message at this node, as the short message number (No.2) in Figure 60, can make the effective information group from beginning is invalid (0).In addition, the time do not need in control, but merely only also can be for effectively for signal monitoring.Certainly, when having the fault detect that provides from each node to notify 230, be reflected to the data message group, can whether effectively judge.

Use Figure 61 that the method for diagnosing faults of other nodes is described.Here, the expression operational ton generates the situation that node breaks down, but relevant its node in addition too.

At first, take out the short message number information group (step S2110) that the respective operations amount generates node.When this message block is the situation of embodiment of address, by achieving the goal to this address visit.

Then, comparable data receives the effective information group 9102 of table 9100, if effectively and updated time message block 9103, then uses to generate the data 9104 that node provides from operational ton and control.Here, whether to upgrade, for example, whether with interior judge (step S2120) to the difference of the time information (now) that has from node and the time information group (time) 9103 of each short message if being predetermined certain value (limit).

When turning back to Figure 60 and illustrating, be included in the moment in the short message of node 5, fall behind, be difference more than 50 than other node.Be judged as not action based on this.Be judged to be by these methods when not being effective, the expression operational ton generates node and does not have action normally, and the information of using the node beyond it to send is controlled (step S2140).To this, be judged to be effective the time, use to generate the information that node sends from operational ton and control (step S2130).

In order with result of determination to notify other node carry out fault ballot output (step S2150) thereafter.This stores as fault vote information group.The fault vote information group 9105 of Data Receiving table 9100 is with the performance of 2 carry digits, the corresponding in order short message number from a left side.In the example of Figure 60, remove the effective node of node 5, all be judged to be node 5 fault (vote=1) has taken place.

Though only node 5 self provides the normally output of (vote=0), the algorithm that is determined, for example, it is invalid to be regarded as by majority logic predicate node 5, makes effective information group ineffective treatment (step S2160, step S2170).

When the node that does not have action brings back to life, for example, the releasing by undesirable shape, automatically reset to wait and realize, other situation is also by the resurrection of choosing in a vote based on the observations of other node.

Thus, the full node that applies control simultaneously can recipient node 5, by the generation of can the method for controlling retreat different situation of the part of each system.

In addition, the ballot algorithm of the situation of resurrection also can be selected the algorithm diverse ways assert with fault, and for example, full node unanimity also can be assert resurrection.In addition, carry out the fault ballot, for total state in system, even the executive component node is also exported processing.

More than, this embodiment is defined in above-mentioned example, can implement with various forms.For example, generate the instruction control unit of steering order, not necessarily need to concentrate on one, also can constitute by a plurality of instruction control units.

Shown in Figure 62, it also can be following formation, the information that is taken into steering wheel angle sensor 3000-2 outputs to sensor controller 3000-1 on the network with steering wheel angle information D 3000, the D3001 of the brake pedal amount of entering into is outputed to the sensor controller 3001-1 of network with the information that is taken into brake pedal position sensor 3001-2, with the executive component controller 3002-1 that makes rudder angle control electro-motor 3002-2 action, with the executive component controller 3003-1 that makes the action of electrodynamic braking pincers, with general controller A (3010-1), with general controller B (3010-2), connect by in-vehicle network N3000.

By taking such formation, by the configuration of physically leaving the instruction control unit 3010-2 that calculates target braking force D3010-2 and calculating the instruction control unit 3010-1 of target rudder angle D3010-1, integrated control functions can reduce the establishment that loses fully.

Controller of vehicle of the present invention can obtain following effect.

(1) even when can not using the vehicle movement composite control apparatus, also can drive Communicating by letter of the manipulation device of the person of sailing and controller of vehicle has according to driving intention and can carry out vehicle The effect of control.

(2) in controller of vehicle, no matter when being which node breaks down, normal The signalling trouble that sends based on the node that breaks down of node, by switching controls, can be complete in system Body can be guarded against mistake, thus to the tediously long degree of each node do not bring up to required more than, then can Realize the very controller of vehicle of high reliability with low cost.

(3) by the operational ton of being carried out by the driver is advanced by the correction that the node that generates generates Row is revised, and as a result of can be suitable steering operation, brake operating, can reach the steady of vehicle Fixedization.

(4) when correction generation node breaks down, function is shunk back without the correction energy Enough actions of carrying out by driver's operation.

(5) for needing information processing highly for correction generates, the generation of operational ton is with energy Enough fairly simple information processings can be finished. Therefore, correction generates node, requires and operational ton Generate node 10 relatively, components number increases, and operating frequency increases the requirement electricity, the rich amount of heat is few Action. Its result, correction generate node 20 and uprise with operational ton generation node comparison fault rate. Thereby, avoid generating the impact that the fault of node is brought by the higher correction of fault rate, of the present invention Effect is especially big.

(6) even when operational ton generation node breaks down, because executive component drives joint Point detects unusual, the control of switching control program continuation vehicle that operational ton generates node, so do not need Operational ton generates the multiplex of node, can realize safety and controller of vehicle cheaply.

(7) owing between executive component driving node, mutually detect unusually and switch to suitable control So the processing procedure order is such as dangerous vehicle movements such as the one-sided effects that can avoid braking, even behaviour Also can keep safe vehicle control under the state that work amount generation node breaks down.

Claims (55)

1. controller of vehicle is characterized in that:

Connect sensor controller, instruction control unit and executive component controller by network, wherein:

The sensor controller is taken into quantity of state, the driver's of expression vehicle the sensor signal of operational ton;

Above-mentioned instruction control unit, the sensor signal according to the sensor controller is taken into generates control target;

Above-mentioned executive component controller receives control target and makes for motor vehicle executive component action of control from above-mentioned instruction control unit;

Above-mentioned executive component controller, has the controlled target generating apparatus, this controlled target generating apparatus, when the control target generation that above-mentioned instruction control unit generates is unusual, sensor values according to the sensor controller on the network of this executive component controller reception generates control target; And above-mentioned executive component controller comes control actuating component by the control target that is generated by above-mentioned controlled target value generation device.

2. according to the described controller of vehicle of claim 1, it is characterized in that: the sensor controller is a deceleration indication unit, quicken indicating device and rudder angle indicating device; Above-mentioned executive component controller is gradual braking device, driving-force control apparatus and rudder angle control device; Above-mentioned instruction control unit is the vehicle movement composite control apparatus of the motion state of control vehicle;

When above-mentioned instruction control unit generation is unusual, above-mentioned gradual braking device comes control brake power according to the operational ton of above-mentioned deceleration indication unit, above-mentioned driving-force control apparatus, operational ton according to above-mentioned acceleration indicating device comes controlling and driving power, above-mentioned rudder angle control device is controlled rudder angle according to the operational ton of above-mentioned rudder angle indicating device.

3. according to claim 1 or 2 described controller of vehicle, it is characterized in that: above-mentioned instruction control unit, constitute by a car motion composite control apparatus, this vehicle movement composite control apparatus has:

Infer state of motion of vehicle the vehicle-state estimating device and

The dbjective state arithmetic unit of the target state that the computing vehicle should obtain and

The motion state of presumptive vehicle and target state to the operating physical force moment that in vehicle, takes place carry out computing operating physical force Calculating Torque during Rotary device and

According to aforesaid operations power moment, carry out operational ton arithmetic unit for the computing of the control target of above-mentioned gradual braking device, above-mentioned driving-force control apparatus and above-mentioned rudder angle control device.

4. according to the described controller of vehicle of claim 3, it is characterized in that: the motion state of vehicle and target state are the quantity of states in the rigid motion of vehicle.

5. according to claim 3 or 4 described controller of vehicle, it is characterized in that: above-mentioned vehicle-state estimating device, infer that management is fixed on motion state in the local coordinate system on the vehicle, is fixed on motion state in the coordinate system in specific place, vehicle ' around environment and the malfunction of the control device that has of vehicle.

6. according to any described controller of vehicle in the claim 3 to 5, it is characterized in that: above-mentioned dbjective state arithmetic unit, according to above-mentioned degree of subtracting indicating device, the operational ton of above-mentioned acceleration indicating device and above-mentioned rudder angle indicating device and above-mentioned state of motion of vehicle, calculate driver's manipulation intention, mechanical constant according to vehicle, the malfunction of the control device that the specification of the control device that vehicle has and vehicle have, calculate the extreme sport state that vehicle can obtain, according to above-mentioned state of motion of vehicle, above-mentioned driver's manipulation intention and above-mentioned extreme sport state calculate target state.

7. according to any described controller of vehicle of claim 3 to 6, it is characterized in that: aforesaid operations power moment arithmetic unit, calculate the operating physical force moment in the local coordinate system that is fixed on the vehicle.

8. according to any described controller of vehicle of claim 3 to 7, it is characterized in that: aforesaid operations amount arithmetic unit has tire vector calculation element and operation quantity distribution portion; Wherein:

Above-mentioned tire vector calculation element according to aforesaid operations power moment, calculates the tire force vector that takes place on each tire;

Aforesaid operations amount dispenser according to above-mentioned tire force vector, is calculated the control target in above-mentioned gradual braking device, above-mentioned driving-force control apparatus and above-mentioned rudder angle control device.

9. according to the described controller of vehicle of claim 8, it is characterized in that: above-mentioned tire vector calculus device, computing are fixed on the force vector in the local coordinate system on the vehicle.

10. according to claim 8 or 9 described controller of vehicle, it is characterized in that: the formation of the above-mentioned gradual braking device that corresponding vehicle has, above-mentioned driving-force control apparatus and above-mentioned rudder angle control device and aforesaid operations amount dispenser is set.

11. a controller of vehicle is characterized in that:

According to it is characterized in that: be to have any described controller of vehicle in the claim 2 to 10 of driving-force control apparatus, above-mentioned driving-force control apparatus has total at least one driving force of a plurality of driving wheels the formation in source takes place,

Above-mentioned driving-force control apparatus, be received in the driving force that should take place on each driving wheel by each driving wheel from above-mentioned vehicle composite control apparatus, to any 2 controls of carrying out Comprehensive Control and carrying out driving wheel is produced driving force in internal combustion engine, variator and the electro-motor at least.

12. a controller of vehicle is characterized in that:

Have requiring signal and Vehicular status signal to come the operational ton of arithmetic operation amount command value to generate node and come the executive component drive node of control actuating component according to the driver who provides from sensor according to generate operational ton command value that node provides from this operational ton; And carry out driving, steering, the braking of vehicle;

Above-mentioned each node, has fault detection capability, when detecting the fault of intranodal by this fault detection capability, in this node outside, do not relate to notify this node be in malfunction beyond effect, when on node arbitrarily, breaking down, according to the fault detect notice that provides from the node that is in this malfunction, on the normal node beyond this node, carry out switching controls, continue regular event as entire system.

13. according to the described controller of vehicle of claim 12, it is characterized in that: detect the sensor of driver's requirement, be connected on the communication network, when detecting the fault of this sensor, to this node outside, do not relate to and notify this node to be in malfunction effect in addition.

14. according to claim 12 or 13 described controller of vehicle, it is characterized in that: the sensor, aforesaid operations amount generation node and the above-mentioned executive component drive node that detect above-mentioned driver's requirement are connected on the same communication network.

15. according to the described controller of vehicle of claim 14, it is characterized in that: the aforesaid operations amount generates node, when receiving the fault detect notice that provides from certain node that is in malfunction, carry out switching controls according to the fault place, stably keep the transport condition of vehicle.

16. according to claim 14 or 15 described controller of vehicle, it is characterized in that: above-mentioned executive component drive node, has operational ton command value systematic function, this operational ton command value systematic function, can not receive in the operational ton command value that aforesaid operations amount generation node provides, according to the sensor signal of the requirement that detects the driver, generating run amount command value; And above-mentioned executive component drive node not receiving in the operational ton command value that aforesaid operations amount generation node provides, switches to the control that realizes aforesaid operations amount command value systematic function from common control, stably keeps the transport condition of vehicle.

17., it is characterized in that: with above-mentioned tediously longization of communication network according to any described controller of vehicle in the claim 14 to 16.

18. according to the described controller of vehicle of claim 17, it is characterized in that: above-mentioned communication network, be made of main bus and standby bus, the above-mentioned all sensors, the aforesaid operations amount that are connected with the requirement that detects the driver on above-mentioned main bus generate node and above-mentioned executive component drive node; On above-mentioned standby bus, be connected with the part of the sensor of the requirement that detects the driver and the part of above-mentioned executive component drive node; When above-mentioned main bus had fault, above-mentioned executive component drive node self according to sensor signal generating run amount command value, stably kept the transport condition of vehicle.

19., it is characterized in that according to any described controller of vehicle in the claim 13 to 18: the sensor by: a plurality of sensor elements, will these a plurality of sensor elements output transform become consistent measuring ability, filter function and the communication interface of the A/D transducer of digital value, a plurality of A/D transformed values to constitute.

20. according to any described controller of vehicle in the claim 14 to 19, it is characterized in that: the sensor that detects driver's requirement, the brake pedal position sensor of the amount of entering into that is the steering angle transducer of measuring the anglec of rotation of steering gear, measures brake pedal and measure the accelerator pedal position sensor of the amount of entering into of accelerator pedal

The aforesaid operations amount generates node, be synthetically to control the vehicle movement general controller of vehicle movement and synthetically control the drive system general controller of the drive system of vehicle according to the signal interpretation driver's of the sensor of the requirement that detects above-mentioned driver intention and with the sensor signal that detects vehicle-state

Above-mentioned executive component drive node, be control steering gear executive component driving governor that the steering gear executive component of steering force takes place, the suspension executive component driving governor of the detent executive component controller of detent executive component that control generates damping force and control suspension executive component that damping force is adjusted

These nodes are connected on the same communication network.

21. according to the described controller of vehicle of claim 20, it is characterized in that: the radar or the camera that detect the extraneous state of vehicle are connected on the above-mentioned communication network.

22. according to claim 20 or 21 described controller of vehicle, it is characterized in that: above-mentioned accelerator pedal position sensor, be connected on the above-mentioned communication network, and receive torque instruction value from above-mentioned drive system Comprehensive Control controller, and can be connected on the engine control controller of controlling combustion engine according to this command value.

23. according to claim 20 or 21 described controller of vehicle, it is characterized in that: in not mechanically in conjunction with brake pedal and damping force generating mechanism, above-mentioned at least brake pedal position sensor also continues regular event when single failure.

24. according to claim 20 or 21 described controller of vehicle, it is characterized in that: when mechanically not connecting steering gear and steering force generating mechanism, above-mentioned steering angle transducer and above-mentioned steering gear executive component driving governor, when single failure, also continue regular event, and, make tediously longization of steering gear executive component.

25., it is characterized in that according to the described controller of vehicle of claim 24: the power that each steering gear executive component takes place is little with the force rate that takes place at the employed steering gear executive component of the system that mechanically combines steering gear and steering force generating mechanism.

26. according to the described controller of vehicle of claim 24, it is characterized in that: above-mentioned steering gear executive component driving governor with tediously longization of drive node, makes when detecting the fault of intranodal, to this node outside, do not relate to and notify this node to be in malfunction effect in addition; And, make this drive node drive the steering gear executive component of above-mentioned tediously longization respectively independently.

27. according to claim 23 or 24 described controller of vehicle, it is characterized in that: above-mentioned brake pedal position sensor and above-mentioned steering angle transducer, by a plurality of sensor elements, will these a plurality of sensor elements output transform become consistent checking function, filter function and the communication interface of the A/D transducer of digital value, a plurality of A/D transformed values to constitute and tediously longization.

28. according to claim 23 or 24 described controller of vehicle, it is characterized in that: above-mentioned brake pedal position sensor and steering angle transducer, by at least three sensor elements, will these a plurality of sensor elements output transform become the A/D transducer of digital value, most decision-making functions, filter function and the communication interface of a plurality of A/D transformed values to constitute.

29. a controller of vehicle is characterized in that:

Operational ton with generating run amount generates node, generates the executive component drive node of the correction generation node and the driving executive component of correction,

Above-mentioned executive component drive node, in above-mentioned correction when to generate node be normal, control above-mentioned executive component with the value that this operational ton is applied this correction as desired value, when above-mentioned correction generation node is unusual, control above-mentioned executive component as desired value with this operational ton.

30. a controller of vehicle is characterized in that:

Operational ton with generating run amount generates node, generates the executive component drive node of the correction generation node and the driving executive component of correction,

Above-mentioned executive component drive node, in above-mentioned correction when to generate node be normal, control above-mentioned executive component with the value that this operational ton is applied this correction as desired value, in above-mentioned correction when to generate node be unusual, control above-mentioned executive component as desired value to add the value that this operational ton is multiplied by the coefficient of the correction before the unusual generation.

31., it is characterized in that:, reduce above-mentioned coefficient with the official hour constant along with generating node for unusual institute's elapsed time constantly from revising according to the described controller of vehicle of claim 30.

32. according to any described controller of vehicle in the claim 29 to 31, it is characterized in that: the aforesaid operations amount generates node, and according to the work angle generating run amount of steering column, above-mentioned executive component drive node drives helmsman.

33. according to any described controller of vehicle in the claim 29 to 32, it is characterized in that: the aforesaid operations amount generates node, according to the work angle or the operation legpower generating run amount of brake pedal, above-mentioned executive component drive node drives the detent on wheel.

34. according to any described controller of vehicle in the claim 29 to 33, it is characterized in that: above-mentioned correction generates node, connect acceleration sensor or yaw rate sensor, according to the output generation correction of this acceleration sensor or yaw rate sensor.

35. according to any described controller of vehicle in the claim 29 to 34, it is characterized in that: above-mentioned correction generates node, connect acceleration sensor or yaw rate sensor, generate correction according to the output of this acceleration sensor or yaw rate sensor and the operational ton of aforesaid operations amount generation node generation.

36. according to any described controller of vehicle in the claim 29 to 35, it is characterized in that: above-mentioned correction generates node, is to generate the high node of node processing performance than aforesaid operations amount.

37. according to any described controller of vehicle in the claim 29 to 36, it is characterized in that: above-mentioned correction generates node, is to generate the high node of node action frequency than aforesaid operations amount.

38. according to any described controller of vehicle in the claim 29 to 37, it is characterized in that: above-mentioned correction generates node, is to generate the node that node has the low formation of failure rate than above-mentioned correction.

39. according to any described controller of vehicle in the claim 29 to 38, it is characterized in that: above-mentioned correction generates node and has fault detection capability.

40. a controller of vehicle is characterized in that:

Have: a plurality of executive component drive units that come control actuating component according to driver's requirement or vehicle-state, the communicator that connects above-mentioned a plurality of executive component drive units; And driving, the steering of control vehicle, at least one of braking,

Above-mentioned executive component drive unit has the control method selecting arrangement, and this control method selecting arrangement according to operating state and above-mentioned other the operating state of executive component drive unit of oneself, is selected the control method of above-mentioned executive component.

41. according to the described controller of vehicle of claim 40, it is characterized in that: above-mentioned executive component drive unit, has the failure detector that detects own fault, above-mentioned other executive component drive unit is notified the fault generation by above-mentioned communicator, according to malfunction and above-mentioned other the malfunction of executive component drive unit of oneself, select the control method of above-mentioned executive component.

42. a controller of vehicle is characterized in that:

Have a plurality of executive component drive units and the communicator that is connected above-mentioned a plurality of executive component drive units that requirement or vehicle-state according to the driver come control actuating component; And driving, the steering of control vehicle, at least one of braking,

Above-mentioned executive component drive unit has the control method selecting arrangement, and this control method selecting arrangement according to by the accepting state of above-mentioned communicator from the short message of above-mentioned other executive component drive unit reception, is selected the control method of above-mentioned executive component.

43. according to the described controller of vehicle of claim 42, it is characterized in that: above-mentioned executive component drive unit, the short message that will be used for the notification action state by above-mentioned communicator sends to other executive component drive unit, has received said short message according to whether from above-mentioned other executive component drive unit and has ceased the control method of selecting above-mentioned executive component.

44. a controller of vehicle is characterized in that:

Have: at least 1 the operational ton generating apparatus that comes arithmetic operation amount command value based on driver's requirement and vehicle-state, come a plurality of executive component drive units and the communicator that is connected aforesaid operations amount generating apparatus and above-mentioned executive component drive unit of control actuating component according to the operational ton command value that provides from the operational ton generating apparatus; And driving, the steering of control vehicle, at least one of braking;

Above-mentioned executive component drive unit, has the control method selecting arrangement, this control method selecting arrangement according to operating state and the operating state of above-mentioned other executive component drive unit and the operating state of aforesaid operations amount generating apparatus of oneself, is selected the control method of above-mentioned executive component.

45. according to the described controller of vehicle of claim 44, it is characterized in that: aforesaid operations amount generating apparatus, has failure detector, this failure detector, detect the fault of oneself, and above-mentioned executive component drive unit or aforesaid operations amount generating apparatus notice fault is taken place by above-mentioned communicator

Above-mentioned executive component drive unit has failure detector, and this failure detector detects oneself fault, and by above-mentioned communicator above-mentioned other executive component drive unit or aforesaid operations amount generating apparatus notice fault is taken place,

According to oneself malfunction, above-mentioned other the malfunction of executive component drive unit and the fault generation state of aforesaid operations amount generating apparatus, select the control method of above-mentioned executive component.

46. a controller of vehicle is characterized in that:

Have: at least 1 the operational ton generating apparatus that comes arithmetic operation amount command value according to driver's requirement or vehicle-state, come a plurality of executive component drive units and the communicator that is connected aforesaid operations amount generating apparatus and above-mentioned executive component drive unit of control actuating component according to the operational ton command value that provides from aforesaid operations amount generating apparatus; And driving, the steering of control vehicle, at least one of braking,

Above-mentioned executive component drive unit, has the control method selecting arrangement, this control method selecting arrangement according to from other the executive component drive unit or the accepting state of the short message that provides of aforesaid operations amount generating apparatus, is selected the control method of above-mentioned executive component.

47. according to the described controller of vehicle of claim 46, it is characterized in that: aforesaid operations amount generating apparatus, by above-mentioned communicator the operational ton command value is sent in each above-mentioned executive component drive unit, above-mentioned executive component drive unit, when receiving aforesaid operations amount command value, by above-mentioned communicator, send in aforesaid operations amount generating apparatus or above-mentioned other the executive component drive unit replying short message, above-mentioned executive component drive unit, according to whether receiving the operational ton command value that provides from aforesaid operations amount generating apparatus or replying short message, select the control method of above-mentioned executive component from what above-mentioned other executive component drive unit provided.

48. a controller of vehicle is characterized in that:

Have: the information that detection driver's the requirement or the sensor device of vehicle-state, basis provide from the sensor device is come at least 1 operational ton generating apparatus of arithmetic operation amount command value, operational ton command value or a plurality of executive component drive units that come control actuating component from the information that the sensor provides and the communicator that is connected the sensor device and aforesaid operations amount generating apparatus and above-mentioned executive component drive unit that basis provides from aforesaid operations amount generating apparatus; And driving, the steering of control vehicle, at least one of braking,

The executive component drive unit, has the control method selecting arrangement, this control method selecting arrangement, according to oneself operating state and above-mentioned other the operating state of executive component drive unit and the fault actions state of aforesaid operations amount generating apparatus, select to use the operational ton command value that provides from aforesaid operations amount generating apparatus control method, use the information that provides from sensor control method, to make above-mentioned executive component be any one method the control method of state of regulation.

49. according to the described controller of vehicle of claim 48, it is characterized in that: aforesaid operations amount generating apparatus, has failure detector, this failure detector, detect the fault of oneself, by above-mentioned communicator, above-mentioned executive component drive unit or aforesaid operations amount generating apparatus notice fault are taken place

Above-mentioned executive component drive unit has failure detector, and this failure detector detects oneself fault, and by above-mentioned communicator above-mentioned other executive component drive unit or aforesaid operations amount generating apparatus notice fault is taken place; And according to oneself malfunction, above-mentioned other the malfunction of executive component drive unit and the generation state of the fault of aforesaid operations amount generating apparatus, select to use the operational ton command value that provides from aforesaid operations amount generating apparatus control method, use the information that provides from the sensor control method, to make above-mentioned executive component be any one method the control method of state of regulation.

50. a controller of vehicle is characterized in that:

Have the requirement that detects the driver or vehicle-state sensor device, according to the information that provides from the sensor device come at least 1 operational ton generating apparatus of arithmetic operation amount command value, according to the operational ton command value or a plurality of executive component drive units that come control actuating component from the information that the sensor provides and the communicator that is connected the sensor device and aforesaid operations amount generating apparatus and above-mentioned executive component drive unit that provide from aforesaid operations amount generating apparatus; And driving, the steering of control vehicle, at least one of braking,

Above-mentioned executive component drive unit, has the control method selecting arrangement, this control method selecting arrangement, according to from above-mentioned other the executive component drive unit or the accepting state of the note that provides of aforesaid operations amount generating apparatus, select to use the operational ton command value that provides from aforesaid operations amount generating apparatus control method, use the information that provides from the sensor control method, to make above-mentioned executive component be any one method the control method of state of regulation.

51. according to the described controller of vehicle of claim 50, it is characterized in that: aforesaid operations amount generating apparatus, by above-mentioned communicator the operational ton command value is sent in each above-mentioned executive component drive unit, above-mentioned executive component drive unit, when receiving aforesaid operations amount command value, to reply short message by above-mentioned communicator sends in aforesaid operations amount generating apparatus or above-mentioned other the executive component drive unit, above-mentioned executive component drive unit, according to whether having received the operational ton command value that provides from aforesaid operations amount generating apparatus or having replied short message, select to use the control method of the operational ton command value that provides from aforesaid operations amount generating apparatus from what above-mentioned other executive component drive unit provided, the control method of the information that use provides from the sensor, make above-mentioned executive component be any one method in the control method of the state of regulation.

52. a controller of vehicle is characterized in that:

Carry out driving, steering, the braking of vehicle,

Have decentralized configuration: detect driver's requirement and output signal node, require signal to come the operational ton of arithmetic operation amount command value and output signal to generate node and come the formation of the executive component drive node of control actuating component according to this according to generate operational ton command value that node provides from this operational ton;

Above-mentioned each node is provided with the Data Receiving table that stores each signal output, judges its content and has the fault detection capability of other node.

53. according to the described controller of vehicle of claim 52, it is characterized in that: above-mentioned Data Receiving table, comprise the information in the moment of representing short message, and have when value that constantly retardation ratio pre-establishes is big, be judged as the function that transmission place or its communication road do not have operate as normal or be returned to normal condition.

54. according to claim 52 or 53 described controller of vehicle, it is characterized in that: above-mentioned Data Receiving table comprises fault ballot portion, and has according to the algorithm that pre-establishes to come the specific fault node or return to the function of the node of normal condition.

55., it is characterized in that: the fault verification situation that can have each node of judging by the failure diagnosis information of exporting other node as fault ballot according to the described controller of vehicle of claim 54.

Images