JP6378119B2 - Control controller, steer-by-wire system and machine - Google Patents

Description

  The present invention relates to a control controller suitable for providing redundancy to a control system in a steer-by-wire system or the like in which a steering device and a steering are not mechanically coupled.

  In control systems such as automobiles, traveling earth-moving machines, automatic traveling robots, and unmanned airplanes, electrical / electronic control has progressed and functional safety support has become essential. In particular, even in a steering where there is a high risk of being unable to steer due to a failure, electric / electronic control called steering-by-wire (hereinafter referred to as “steer-by-wire”) is being studied. Among them, Japanese Patent Application Laid-Open No. 2013-012345 (Patent Document 1) describes a steer-by-wire type steering device in which control redundancy is obtained by multiplexing control devices. This steer-by-wire steering device drives the main motor by switching the fail-safe mode that can turn the main motor by disconnecting the main motor and transmitting the rotation of the sub motor, the first control device that controls the reaction force actuator and the sub motor, and the main motor. And a second control device. Furthermore, the first control device has an abnormal-time switching command unit, and when the mutual failure diagnosis unit diagnoses that the second control device is in failure, the switching mechanism is set to fail-safe mode (see summary).

JP 2013-28312 A

  In Patent Document 1, if the first control device fails after the failure that the switching mechanism cannot be switched, it cannot be switched to the second control device. That is, Patent Document 1 does not assume a case where a dangerous failure that cannot be continued when the switching mechanism and the first control device fail is assumed. For this reason, the steer-by-wire steering device disclosed in Patent Document 1 has the effect of being redundant with respect to the failure of the control device connected to the switching mechanism.

  In order to meet the functional safety of the control system, the changeover switch in the changeover mechanism needs to have a redundant configuration. Furthermore, in order to facilitate the control of the switching mechanism, it is preferable to make the control device in the control system redundant rather than redundant in the control system.

  An object of the present invention is to reduce the risk that a control system becomes a dangerous failure due to a failure that cannot be switched inside the switching mechanism, and to improve the safety-side failure rate.

In order to solve the above problems, a controller of the present invention includes a main channel and a backup channel that generate a control signal for controlling an actuator, a channel failure detection unit that detects a failure of the main channel and the backup channel, a switching mechanism that outputs switch and a second control signal by the first control signal and the backup channel main channel is output to the output interface to the actuator, the controller having a,
The switching mechanism includes a main switch and one or more backup switches that switch a connection state between the main channel and the backup channel and the output interface, a switching control unit that switches a connection state between the main switch and the backup switch, have a, a switch failure detecting section detecting a failure of the main switch and the backup switch,
The backup switch has a connection state in which a third signal line is connected to a first signal line to which the first control signal is transmitted and a fourth signal line is connected to a second signal line to which the second control signal is transmitted. And a connection state in which the fourth signal line is connected to the first signal line to which the first control signal is transmitted and the third signal line is connected to the second signal line to which the second control signal is transmitted. Is configured to switch between,
The main switch is configured to switch between a connection state in which the third signal line is connected to the output interface and a connection state in which the fourth signal line is connected to the output interface;
In the switching mechanism, the switching control unit receives a failure notification from the channel failure detection unit and the switch failure detection unit, and switches the connection state of the main switch and the backup switch, so that the output interface Either the first control signal or the second control signal is output .

  According to the present invention, a failure in the switching mechanism is detected, and when the main switch fails, the connection to the main channel or the backup channel is switched by the backup switch. Can continue to operate. For this reason, it can reduce that it becomes a dangerous side failure, and can improve the safe side failure rate.

  Problems, configurations, and effects other than those described above will be clarified by the following description of embodiments.

1 is a block diagram showing an embodiment when the present invention is applied to a steer-by-wire system 104 of a vehicle body system 100. FIG. 2 is a block diagram illustrating one embodiment of a controller 114 within the steer-by-wire system 104. FIG. FIG. 3 is a block diagram illustrating an embodiment of a main channel 201, a backup channel 202, and a channel failure detection unit 203. FIG. 2 is a block diagram showing an embodiment of a lockstep microcomputer in which two CPUs (CPU_A, CPU_B) 311A and 311B are provided in an MCU (microcomputer) 301. FIG. 6 is a circuit diagram showing an embodiment of a main switch 213. It is a circuit diagram which shows one Example which comprised the main switch 213 with the SPST switch. FIG. 6 is a circuit diagram showing an embodiment of a backup switch 214. It is a circuit diagram which shows one Example which comprised the backup switch 214 with the DPDT switch. It is a figure which shows one Example of the connection of the main switch 213 and the backup switch 214, and is a circuit diagram which connected both switches 213 and 214 in series. 4 is a flowchart of a main channel 201 and a backup channel 202 in the control controller 114. 4 is a flowchart of a switching control unit 212 of the control controller 114. FIG. 6 is a circuit diagram showing another embodiment of the main switch 213.

  Embodiments according to the present invention will be described below with reference to the drawings.

  FIG. 1 is a block diagram showing an embodiment in which the present invention is applied to the steer-by-wire system 104 of the vehicle body system 100.

  The steer-by-wire system 104 is an apparatus used to change the moving direction of the moving body 100A of the moving body system 100. The mobile system 100 includes vehicles such as passenger cars and industrial machines. Industrial machines include earthwork machines and construction machines represented by dump trucks and hydraulic excavators. The industrial machine is not limited to a vehicle traveling on land, but may be an airplane or a ship. Hereinafter, a description will be given of a mobile system (body system) 100 traveling on land.

  The vehicle body system 100 includes a steering handle 101, a mechanical device 102, a foot 103, and a steer-by-wire system 104. The steering handle 101, the mechanical device 102, the foot 103, and the steer-by-wire system 104 are provided on a moving body (vehicle body) 100A. The mechanical device 102 and the steer-by-wire system 104 constitute a steering device.

  The steering handle 101 is, for example, a steering operation tool such as a steering wheel, a steering lever, a steering bar, or a joystick, and transmits tilt, speed, acceleration, and the like to the sensor. The steering handle 101 is not necessarily operated by a human, and may be operated remotely or directly from a controller equipped with artificial intelligence.

  The mechanical device 102 is a device related to steering that transmits power to the mechanical device, and is, for example, a gear or a shaft.

  The foot part 103 is, for example, a tire. The foot portion 103 may be a crawler in addition to the tire. When an industrial machine travels on the water or in the sky, it may be like a tail. That is, the foot 103 is a device that changes the moving direction of the moving body 100A including the vehicle body body under the resistance of the traveling road surface, air, or water. In the vehicle body system 100, the foot 103 also serves as a traveling unit for traveling.

  The steer-by-wire system 104 includes a sensor 111, an actuator 112, a display 113, and a control controller 114.

  The sensor 111 acquires steering angle information and the like from the steering handle 101, and transmits the steering angle information and the like to the control controller 114 by an analog signal, a PWM (Pulse Width Modulation) signal, CAN communication, and the like.

  The actuator 112 operates according to stream information transmitted from the controller 114 by an electrical signal such as a PWM signal or CAN communication, and is, for example, an electromagnetic valve or a motor.

  The display unit 113 is a means for transmitting information to a person such as a driver or an operator, artificial intelligence, or the like according to an instruction from the controller 114. For example, a display panel such as an LED or a liquid crystal or a device that generates an alarm sound may be used.

  The controller 114 has an input interface for acquiring information by an analog signal or PWM signal from the sensor 111 or CAN communication. Although not shown, information related to traveling such as engine speed information from an engine controller or the like may be input to the input interface.

  The controller 114 has an output interface for controlling the actuator 112 as an output interface, and controls the actuator 112 by outputting an electrical signal such as a PWM signal or CAN communication, for example. Further, the control controller 114 has an output interface to the display unit 113.

  FIG. 2 is a block diagram illustrating one embodiment of the controller 114 in the steer-by-wire system 104.

  The control controller 114 includes a main channel 201, a backup channel 202, a channel failure detection unit 203, and a switching mechanism 204. Although FIG. 2 shows only one backup channel 202, a plurality of backup channels 202 may be provided.

  The main channel 201 and the backup channel 202 include an input interface for acquiring an analog signal, a PWM signal, information transmitted through CAN communication, and the like from the sensor 111 outside the control controller 114 through the signal lines S1 and S2, and each channel. And an output interface that performs the same calculation processing (calculation) in the application unit 324 (see FIG. 3) provided in the PC and outputs the calculation processing result to the signal lines S4 and S5 by PWM output or CAN communication. Have. The main channel 201 and the backup channel 202 generate a control signal that controls the actuator 112. Control signals such as PWM output and CAN communication output from the main channel 201 and the backup channel 202 are input to the backup switch 214 of the switching mechanism 204 through the signal lines S4 and S5.

  Here, the same calculation process is a program based on the same required specification and may not be exactly the same code. For example, it may be a program coded by a different programmer.

  Further, it is sufficient that a part of the application program is the same process, and it is not necessary to make all the same process.

  The channel failure detection unit 203 is means for detecting failures in the main channel 201 and the backup channel 202. For example, each of the main channel 201 and the backup channel 202 is provided with a function for self-diagnosis of a failure. When each of the main channel 201 and the backup channel 202 self-diagnose a failure, a failure notification is sent to the channel failure detection unit 203 through the signal lines S6 and S7.

  The failure notification performed through the signal lines S6 and S7 is preferably performed using a periodic pulse such as a heartbeat. When normal, periodic pulses are notified from the channels 201 and 202 to the channel failure detection unit 203 through the signal lines S6 and S7. Each channel 201, 202 stops transmitting periodic pulses when it self-diagnose a failure. When the channel failure detection unit 203 detects that the periodic pulse transmission is stopped, the channel failure detection unit 203 determines that one or both of the main channel 201 and the backup channel 202 where the pulse transmission is stopped is a failure. Since it is notified that each channel 201, 202 is normal by a periodic pulse, the channel failure detection unit 203 can detect each channel 201, 202 regardless of whether the failure notification signal is at a high level or a low level. 202 failure can be detected.

  The channel failure detection unit 203 may have a failure self-diagnosis function. In this embodiment, as with the main channel 201 and the backup channel 202, the channel failure detection unit 203 is also provided with a failure self-diagnosis function.

  In order to realize a failure self-diagnosis function, the main channel 201, the backup channel 202, and the channel failure detection unit 203 may be configured by a lockstep microcomputer. The lock step microcomputer will be described later.

  The channel failure detection unit 203 notifies the switching control unit 212 of the channel in which the failure is detected among the main channel 201 and the backup channel 202 through the signal line S12. When the channel failure detection unit 203 fails, there may be a case where failure notification to the switching control unit 212 becomes impossible. Therefore, the signal lines S20 and S21 are connected from the channel failure detection unit 203 to the switching control unit 212, and periodic pulses sent from the main channel 201 and the backup channel 202 through the signal lines S6 and S7 to the switching control unit 212. You may make it transmit. The signal line S <b> 20 transmits a periodic pulse signal from the main channel 201 to the switching control unit 212. The signal line S21 transmits a periodic pulse signal from the backup channel 202 to the switching control unit 212. The switching control unit 21 can detect a failure of the main channel 201 and the backup channel 202 based on periodic pulses.

  In FIG. 2, signal lines S6, S7, S20, and S21 for transmitting periodic pulse signals (heartbeat signals) are indicated by broken lines. Any one of the signal line S12 and the signal lines S20 and S21 for notifying the switching control unit 212 of the failure may be provided. In consideration of the failure of the channel failure detection unit 203, it is desirable to provide the signal line S12 and the signal lines S20 and S21 together. If the failure of the main channel 201 and the backup channel 202 is simply notified to the switching control unit 212, the signal lines S6 and S7 from the main channel 201 and the backup channel 202 may be directly connected to the switching control unit 212. .

  Means for detecting a failure in the main channel 201 and the backup channel 202 may be the following means. For example, as with the main channel 201 and the backup channel 202, the channel failure detection unit 203 acquires, for example, an analog signal, a PWM signal, or information transmitted through CAN communication from the sensor 111 through the signal line S3, The application unit 324 (see FIG. 3) provided in FIG. 3 performs the same calculation processing (calculation) as the main channel 201 and the backup channel 202, and outputs the calculation processing result to the signal line S8 by PWM output, CAN communication, or the like. Further, the PWM output and CAN communication output from the main channel 201, the backup channel 202, and the channel failure detection unit 203 are fed back to the channel failure detection unit 203 through the signal lines S9, S10, and S11.

  If each of the main channel 201, the backup channel 202, and the channel failure detection unit 203 is normal, the values of the outputs fed back to the channel failure detection unit 203 through the signal lines S9, S10, and S11 are the same value. The channel failure detection unit 203 compares PWM output and CAN communication in real time, and performs comparison by majority vote. The channel failure detection unit 203 determines that one of the main channel 201, the backup channel 202, or the channel failure detection unit 203 that outputs a value different from the other two is a failure. That is, the channel failure detection unit 203 detects a failure in each channel 201, 202, 203 using a majority architecture (for example, 2 out of 3). The channel failure detection unit 203 notifies the switching control unit 212 of the channel 201, 202, or 203 determined as a failure through the signal line S12.

  Even when the channel failure detection unit 203 fails, the main channel 201 and the backup channel 202 can generate control signals. Therefore, the operation of the controller 114 can be continued. Therefore, when a failure of the channel failure detection unit 203 is confirmed by the majority voting architecture, a flag indicating the transition to the fail-safe mode is set as well as the transition to the fail-safe mode. Then, a warning is given to the display 113 and an urgent repair is requested.

  The switching mechanism 204 is a mechanism for switching between a control signal output from the main channel 201 and a control signal output from the backup channel 202 and outputting it to the output interface 215. The control signal output to the output interface 215 is sent to the actuator 112.

  The failure notification from the main channel 201 and the backup channel 202 to the channel failure detection unit 203 can be performed by one of the signal lines S6 and S7 or the signal lines S9 and S10. Therefore, it is not necessary to provide both the signal lines S6 and S7 and the signal lines S9 and S10. However, reliability may be improved by providing both the signal lines S6 and S7 and the signal lines S9 and S10.

  FIG. 3A is a block diagram illustrating an embodiment of the main channel 201, the backup channel 202, and the channel failure detection unit 203.

  The main channel 201, the backup channel 202, and the channel failure detection unit 203 include an MCU 301, an oscillation circuit 302, a power supply unit 303, a monitoring unit 304, and an external memory 305.

  The MCU 301 is a Micro Control Unit, which is a so-called microcomputer. For example, the CPU 311, the PWM 312, the SPI 313, the I / O 314, the Timer 315, the Network 316, the RAM 317, the ADC 318, and the ROM 319 are included.

  The main channel 201, the backup channel 202, and the channel failure detection unit 203 include an ADC interface 331, a network interface 332, a monitoring unit output interface 333, and a PWM output interface 334 as external interfaces.

  Note that the main channel 201, the backup channel 202, and the channel failure detection unit 203 do not necessarily have to be realized by using the MCU 301, and may be realized by ASIC (Application Specific Integrated Circuit) or FPGA (Field Programmable Gate Array). .

  The CPU 311 is, for example, a central operator having a calculation capability, loads a program from the ROM 319, develops it in the RAM 317, and performs numerical calculation, information processing, device control, and the like. The number of cores of the CPU 311 does not have to be one, and may be one (lock step microcomputer) having a function called a lock step that is configured by a plurality of (for example, two) CPU cores.

  FIG. 3B is a block diagram showing an embodiment of a lockstep microcomputer in which two CPUs (CPU_A, CPU_B) 311A and 311B are provided in an MCU (microcomputer) 301. The lockstep microcomputer only needs to have a plurality of CPU cores, but in the present embodiment, a case where two CPU cores are provided will be described. In the lock step, the first CPU core (CPU_A) 311A and the second CPU core (CPU_B) 311B execute the same processing (calculation), and the processing results of the two CPU cores 311A and 311B are compared by the comparator 326. This is a function for detecting a failure (abnormality) of the CPU core. That is, the lockstep microcomputer has an abnormality detection function for detecting an abnormality in the CPU cores 311A and 311B. With this function, a self-diagnosis of the failure can be performed.

  The lockstep microcomputer may be configured in all of the main channel 201, the backup channel 202, and the channel failure detection unit 203. Alternatively, at least the main channel 201 and the backup channel 202 may be provided to detect a failure of the main channel 201 and the backup channel 202. A lock step microcomputer may be provided in either the main channel 201 or the backup channel 202, and the lock step microcomputer may be used for failure detection. The failure detection without the lockstep microcomputer may be performed by other means. In both the main channel 201 and the backup channel 202, failure detection may be performed by means other than the lockstep microcomputer.

  The PWM 312 is, for example, a unit that outputs a Pulse Width Modulation (pulse width modulation) signal. The PWM signal is a signal for controlling the actuator 112.

  An SPI (Serial Peripheral Interface) 313 is, for example, means for synchronous serial communication. As long as communication with the external memory 305 is possible, the communication is not limited to synchronous serial communication, and may be asynchronous serial communication or parallel communication.

  The I / O 314 is, for example, a general-purpose input / output, and notifies a failure.

  The Timer 315 is a timer that operates by receiving a clock from the oscillation circuit 302, for example, and performs counting, input capture, PWM waveform generation, and the like.

  The network 316 is, for example, a CAN (Controller Area Network) or Ethernet (registered trademark), and transfers data between interconnected devices.

  The RAM 317 is, for example, a volatile memory, and although not shown, it may have a countermeasure against memory failure such as EDC (error detection and correction).

  The ADC 318 converts, for example, an analog signal into a digital signal such as 10 bits, 12 bits, and 16 bits, and passes it to a program in the ROM 319.

  The ROM 319 is, for example, a non-volatile memory that stores a program. A memory failure countermeasure such as CRC (Cyclic Redundancy Checking) may be provided.

  Programs stored in the ROM 319 include a dispatch unit 321, an input unit 322, an output unit 323, an application unit 324, a diagnosis unit 325, and the like.

  The dispatch unit 321 is a program that manages a program that allocates the calculation capability of the CPU 311 to program units called processes or tasks, for example.

  The input unit 322 is a program that acquires information from an interface such as the SPI 313, the I / O 314, the Network 316, and the ADC 318, for example.

  The output unit 323 is a program that passes information to interfaces such as PWM 312, SPI 313, I / O 314, and Network 316.

  The application unit 324 is a program that controls the operation of the control controller 114, for example. An application program for the main channel 201, an application program for the backup channel 202, or an application program for the channel failure detection unit 203 is stored.

  For example, the diagnosis unit 325 is configured to detect failures such as RAM 317, ROM 319, I / O 314, external memory 305, ADC (analog input) 318, and PWM output 312 in the channel. It is a program to detect by defensive programming. That is, the main channel 201, the backup channel 202, and the channel failure detection unit 203 have a hardware failure diagnosis function that detects failures in the ROM 319, RAM 317, analog input (ADC 318), and output (PWM output 312) in the MCU 301. There are two types of diagnosis, for example, startup diagnosis and runtime diagnosis.

  The oscillation circuit 302 is an oscillation circuit such as a TCXO or OCXO such as a crystal resonator or a crystal oscillator, a cesium oscillator, a rubidium oscillator, or a MEMS oscillator. The oscillation circuit 302 is not necessarily one system. Two or more oscillation circuits may be configured by appropriately combining TCXO and OCXO such as a crystal resonator and a crystal oscillator, a cesium oscillator, a rubidium oscillator, or a MEMS oscillator. Thereby, the reliability or redundancy of the oscillation circuit 302 is improved.

  Further, a highly accurate time may be acquired from a satellite positioning system such as GPS (Global Positioning System) to correct Timer 315, or may be used as a reference signal.

  Although not shown, the power supply unit 303 is, for example, a DCDC converter that acquires a 24V DC input power supply from an external power supply and converts it to 5V or 3.3V. It may be realized by an LDO (Low Drop Out) or a regulator.

  The power supply unit is not necessarily one system. In addition to the power sources described above, although not shown, two or more power sources are provided by appropriately combining a power source converted from power generated by an auxiliary machine provided in the engine, a lead storage battery, a lithium ion battery, or a fuel cell. May be. For example, the main power source may be composed of a lithium ion battery, and the backup power source may be a lead storage battery, so that the power source may have diversity. Thereby, the reliability or redundancy of the power supply unit 303 is improved.

  The monitoring unit 304 is means for monitoring power supply abnormalities such as undervoltage, overvoltage, and overcurrent, and monitoring MCU 301 failures using a time window or the like. When the monitoring unit 304 detects a failure, the monitoring unit 304 notifies the channel failure detection unit 203 of the failure via the monitoring unit output interface 333. This failure notification is output to the signal lines S6 and S7 (see FIG. 2) via the monitoring unit output interface 333. The monitoring unit 304 may have a watchdog timer for monitoring. If a failure is detected and it is determined to be safe, the MCU 301 may be reset.

  The external memory 305 is, for example, a nonvolatile memory such as a readable / writable EEPROM, a volatile memory DRAM, or an SDRAM. If there is not enough ROM or RAM inside the MCU, an external memory may be used. The external memory 305 stores calibration parameters and initial values of the sensor 111.

  Each of the channels 201 and 202 and the channel failure detection unit 203 may have a function of detecting an internal failure by self-diagnosis and notifying the MCU 301 of the failure.

  The ADC interface 331 is an interface that acquires information from the sensor 111 and passes an analog signal to the ADC 318 of the MCU 301, for example.

  The network interface 332 is, for example, an interface of CAN or Ethernet (registered trademark), and acquires information from the sensor 111 or outputs a signal for controlling the actuator 112.

  Although not shown, information related to running such as engine speed information from an engine controller or the like may be input to the MCU 301. The MCU 301 may output a failure notification.

  If the network interface 332 can input / output, for example, RS-232C, UART (Universal Asynchronous Receiver Transmitter), open collector (Open Collector), TTL (Transistor-Transistor Logi, U / I, U / U) (Serial Bus) or the like.

  The monitoring unit output interface 333 is, for example, means for notifying the outside of the failure detection in the channel. In the case of the main channel 201 and the backup channel 202, the failure notification output via the monitoring unit output interface 333 is output to the signal lines S6 and S7 (see FIG. 2) and notified to the channel failure detection unit 203. The

  The PWM output interface 334 is an interface that outputs a signal for controlling the actuator 112 by Pulse Width Modulation (pulse width modulation). A signal output from the PWM output interface 334 of the main channel 201 and the backup channel 202 is transmitted to the backup switch 214 of the switching mechanism 204 through the signal lines S4 and S5. The signals output from the PWM output interface 334 of the main channel 201 and the backup channel 202 are transmitted to the channel failure detection unit 203 through the signal lines S9 and S10, and the failure of each channel 201 and 202 in the channel failure detection unit 203 is detected. It may be used for diagnosis.

  Next, the switching mechanism 204 will be described with reference to FIG.

  When the main channel 201 fails, the switching mechanism 204 disconnects the output interface 215 that outputs a signal from the controller 114 to the actuator 112 and the output interface 334 of the main channel 201 (see FIG. 3). Further, the switching mechanism 204 connects the output interface 334 of the backup channel 202 to the output interface 215 of the control controller 114. Thus, the switching mechanism 204 switches the connection between the output interface 334 of the main channel 201 and the output interface 334 of the backup channel 202 with respect to the output interface 215 of the control controller 114.

  The switching mechanism 204 includes a switch failure detection unit 211, a switching control unit 212, a main switch 213, and a backup switch 214.

  The main switch 213 and the backup switch 214 are connected in series by signal lines S13 and S14. In FIG. 2, one backup switch 214 is connected to the main switch 213, but a plurality of backup switches 214 may be connected. However, even when a plurality of backup switches 214 are connected to the main switch 213, the plurality of backup switches 214 are connected in series to the main switch 213.

  The switch failure detection unit 211 is means for detecting a failure of the main switch 213 and the backup switch 214 inside the switching mechanism 204. For this purpose, the output (for example, PWM signal) of the backup switch 214 is input to the switch failure detection unit 211 through the signal lines S15 and S16. Further, the output (for example, PWM signal) of the main switch 213 is input to the switch failure detection unit 211 through the signal line S17. The switch failure detection unit 211 monitors signals output from the main switch 213 and the backup switch 214, and when it is determined that there is a failure, notifies the switch control unit 212 of the failure through the signal line S18. Fault detection includes startup diagnosis and runtime diagnosis.

  The switching control unit 212 receives a failure notification from the channel failure detection unit 203 and the switch failure detection unit 211 and switches the connection state of the main switch 213 and the backup switch 214. For this purpose, a signal line S19 is wired from the switching control unit 212 to the main switch 213, and a signal line S20 is wired from the switching control unit 212 to the backup switch 214. The main switch 213 and the backup switch 214 receive a control signal from the switching control unit 212 through the signal lines S19 and S20 and switch the switches.

  The switching control unit 212 may be realized by an IC or ASIC with two or more logic units. Further, if the power source of the switching control unit 212 is one system, there is a possibility that both the main switch 213 and the backup switch 214 may break down due to the loss of the power source. good. In order to provide two or more power sources in the switching control unit 212, a power source that uses power generated by an auxiliary machine provided in the engine, a lead storage battery, a lithium ion battery, or a fuel cell can be used. For example, the main power source may be composed of a lithium ion battery, and the backup power source may be a lead storage battery, so that the power source may have diversity.

  FIG. 4A is a circuit diagram showing an embodiment of the main switch 213.

  The main switch 213 is configured by a three-way switch or a SPDT (Single Pole, Double Throw) switch.

  The main switch 213 may be constituted by a c-contact relay having a contact configuration similar to that of a three-way switch or SPDT. The c contact relay has a structure having both a contact and b contact at the same time. The a-contact portion inside the c-contact relay is normally open and no electricity flows, and the contacts are connected by an electric signal and electricity flows. On the other hand, the b-contact portion inside the c-contact relay is normally closed and electricity flows, and the contact is released by the electric signal and electricity does not flow.

  The main switch 213 changes the state of the switch according to a control signal from the switching control unit 212. The mechanism of the switch may be a machine or a semiconductor. In the case of a semiconductor, it may be an FET or a diode. Moreover, MEMS may be sufficient. Alternatively, the main switch 213 may be a hybrid switch that combines various characteristics of a machine or a semiconductor.

  However, since the main switch 213 outputs a PWM signal, CAN communication, or the like, a switch that does not greatly deform the pulse wave even when passing through the switch is preferable.

  In general, mechanical switches have a higher failure rate than semiconductor switches. Therefore, it may be preferable that the semiconductor switch has good transparency so that the pulse wave does not change greatly even when passing through the switch. In addition, since a semiconductor switch is generally resistant to vibration, it may be particularly preferable in the field of automobiles, earthworking machines, construction machines, etc., which are considered to be greatly affected by vibration.

  The main switch 213 has two states except for a failure time and a switching time. These two states are, for example, the state (a1) and the state (a2) shown in FIG. 4A. That is, the main switch 213 is a switch whose connection state is switched between the first connection state 213a1 and the second connection state 213a2 by a switch switching operation. The first connection state 213a1 is a state in which the contact 0 and the contact 1 are connected. The second connection state 213a2 is a state in which the contact 0 and the contact 2 are connected. In the state 213a1, the terminals T1 and T0 of the main switch 213 are connected, and the signal input to the terminal T1 is output to the terminal T0. In the state 213a2, the terminals T2 and T0 of the main switch 213 are connected, and the signal input to the terminal T2 is output to the terminal T0.

  FIG. 4B is a circuit diagram showing an embodiment in which the main switch 213 is constituted by an SPST switch.

  When it is difficult to physically realize the configuration (a1) or (a2) with a semiconductor switch or the like, as shown in FIG. 4B, two SPST (Single Pole, Single Throw) switches are used and the main switch 213 is used. The first connection state 213a1 and the second connection state 213a2 may be realized like the first connection state 213b1 in (b1) and the second connection state 213b2 in (b2).

  In the first connection state 213b1, the contact 1 and the contact 2 are in a closed state, and the contact 3 and the contact 4 are in an open state. In the first connection state 213b1, the terminals T1 and T0 of the main switch 213 are connected, and the signal input to the terminal T1 is output to the terminal T0. In the second connection state 213b2, the contact 1 and the contact 2 are in an open state, and the contact 3 and the contact 4 are in a closed state. In the second connection state 213b2, the terminals T2 and T0 of the main switch 213 are connected, and the signal input to the terminal T2 is output to the terminal T0.

  FIG. 5A is a circuit diagram showing one embodiment of the backup switch 214.

  The backup switch 214 is composed of a four-way switch. The backup switch 214 may be configured by a relay having a contact configuration similar to that of the four-way switch. The backup switch 214 changes the switch state according to a control signal from the switching control unit 212.

  Similar to the main switch 213, the mechanism of the switch may be a machine or a semiconductor. In the case of a semiconductor, it may be an FET, a diode, or a MEMS. The backup switch 214 may be a hybrid switch that combines various characteristics of machines and semiconductors. However, since a PWM signal, CAN communication, or the like is output, a switch that does not greatly deform the pulse wave even when passing through the switch is preferable.

  The backup switch has two states except at the time of failure and switching. These two states are, for example, the state (a1) and the state (a2) shown in FIG. 5A. That is, the backup switch 214 is a switch whose connection state is switched between the first connection state 214a1 and the second connection state 214a2 by a switch switching operation. The first connection state 214a1 is a state in which the contact 5 and the contact 6 are connected, and the contact 7 and the contact 8 are connected. The second connection state 214a2 is a state in which the contact 5 and the contact 8 are connected, and the contact 7 and the contact 6 are connected.

  In the first connection state 214a1, the terminals T3 and T4 of the main switch 214 are connected, and the signal input to the terminal T3 is output to the terminal T4. In the first connection state 214a1, the terminals T5 and T6 are connected, and the signal input to the terminal T5 is output to the terminal T6. In the second connection state 214a2, the terminals T3 and T6 of the main switch 214 are connected, and the signal input to the terminal T3 is output to the terminal T6. In the second connection state 214a2, the terminals T5 and T4 are connected, and the signal input to the terminal T5 is output to the terminal T4.

  FIG. 5B is a circuit diagram showing an embodiment in which the backup switch 214 is configured by a DPDT switch.

  If it is difficult to physically realize the configuration (a1) or (a2) using a semiconductor switch or the like, a DPDT (Double Pole, Double Throw) switch is used as shown in FIG. The first connection state 214a1 and the second connection state 214a2 may be realized as the first connection state 214b1 in (b1) and the second connection state 214b2 in (b2).

In the first connection state 214b1, the contact 11, the contact 10, the contact 14, and the contact 13 are closed, and the contact 11, the contact 9, the contact 14, and the contact 12 are opened. In the first connection state 214b1, the terminals T3 and T4 of the backup switch 214 are connected, and the signal input to the terminal T3 is output to the terminal T4. In the first connection state 214b1, the terminals T5 and T6 of the backup switch 214 are connected, and the signal input to the terminal T5 is output to the terminal T6.
In the second connection state 214b2, the contact 11, the contact 9, the contact 14, and the contact 12 are closed, and the contact 11, the contact 10, the contact 14, and the contact 13 are opened. In the second connection state 214b2, the terminals T3 and T6 of the backup switch 214 are connected, and the signal input to the terminal T3 is output to the terminal T6. In the second connection state 214b2, the terminals T5 and T4 of the backup switch 214 are connected, and the signal input to the terminal T5 is output to the terminal T4.

  In this embodiment, one backup switch 214 is used, but a plurality of backup switches 214 may be arranged in series.

  FIG. 6 is a diagram showing an embodiment of the connection between the main switch 213 and the backup switch 214, and is a circuit diagram in which both switches 213 and 214 are connected in series.

  In this embodiment, an SPDT switch is used for the main switch 213, a DPDT switch is used for the backup switch 214, and the SPDT switch and the DPDT switch are connected in series. The main switch 213 and the backup switch 214 may be realized by a single semiconductor as long as the SPDT switch and the DPDT switch have the same structure as that connected in series. Further, it may be realized by one ASIC (Application Specific Integrated Circuit) or FPGA (Field Programmable Gate Array).

  FIG. 6A shows a state in which the backup switch 214 receives the PWM signals from the main channel 201 and the backup channel 202, passes them to the main switch 213, and outputs the PWM signal of the main channel 201 from the main switch 213. Yes. The PWM signal from the backup channel 202 is not output to the subsequent stage of the main switch 213. For this reason, the backup switch 214 is in the connection state 214b1 shown in FIG. 5B. The main switch 213 is in the connection state 213a1 shown in FIG. 4A.

  FIG. 6B shows a state in which the backup switch 214 receives the PWM signals from the main channel 201 and the backup channel 202, passes them to the main switch 213, and outputs the PWM signal of the backup channel 202 from the main switch 213. Yes. The PWM signal from the main channel 201 is not output to the subsequent stage of the main switch 213. For this reason, the backup switch 214 is in the connection state 214b1 shown in FIG. 5B. The main switch 213 is in the connection state 213a2 shown in FIG. 4A.

  FIG. 6C shows a state in which the backup switch 214 receives the PWM signals from the main channel 201 and the backup channel 202, passes them to the main switch 213, and outputs the PWM signal of the backup channel 202 from the main switch 213. Yes. The PWM signal from the main channel 201 is not output to the subsequent stage of the main switch 213. Therefore, the backup switch 214 is in the connection state 214b2 shown in FIG. 5B. The main switch 213 is in the connection state 213a1 shown in FIG. 4A. Note that the PWM signal of the main channel 201 can be output from the main switch 213 by switching the main switch 213 to the connection state 213a2 in the state of FIG.

  As described above, in this embodiment, the input to the backup switch 214 is performed from the two systems of the output interface of the main channel 201 and the output interface of the backup channel 202. The backup switch 214 outputs two systems S13 and S14. The main switch 213 selects and outputs one of the two outputs of the backup switch 214.

  Next, an example of the operation and processing of this embodiment will be described. FIG. 7 is a flowchart of the main channel 201 and the backup channel 202 in the controller 114.

  The operations of the main channel 201, the backup channel 202, and the channel failure detection unit 203 based on the flowchart of FIG. 7 are as follows.

  Step 701: The controller 114 is activated and started with PowerON.

  Step 702: Start-up diagnostic processing is performed. In this startup diagnosis process, the monitoring unit 304 monitors, for example, power supply abnormal states such as undervoltage, overvoltage, and overcurrent, and monitors a failure of the MCU 301 with a time window or the like. When the monitoring unit 304 detects a failure, the monitoring unit 304 notifies the channel failure detection unit 203 of the failure via the monitoring unit output interface 333. The monitoring unit 304 may include a watchdog timer to detect a failure.

  Further, the diagnosis unit 325 detects a failure of the RAM 317, the ROM 319, the I / O 314, the external memory 305, and the like in the channel, for example, by a memory diagnosis function called a march, a gal pad, a double RAM, or defensive programming. .

  Step 703: It is determined whether or not there is a failure in the main channel 201, the backup channel 202, or the channel failure detection unit 203. If a failure is detected in step 703, the process proceeds to step 711. If no failure is detected in step 703, the process proceeds to step 704.

  Step 704: Perform initialization processing. In this initialization process, for example, the main channel 201 and the backup channel 202 acquire a calibration parameter from the external memory 305, transition to a normal state, and notify the channel failure detection unit 203 of failure-free information. In addition, the channel failure detection unit 203 transitions to a normal state and notifies the switching control unit 212 of failure-free information.

  Step 705: Based on the dispatch unit 321, for example, the calculation capacity of the CPU 311 is assigned to the application task.

  Step 706: Information is acquired from an input interface such as the sensor 111 based on the input unit 322.

  Step 707: Processing is performed based on the application unit 324. For example, the voltage information of the sensor 111 is acquired from a nonvolatile memory.

  Step 708: Processing is performed based on the diagnosis unit 325. For example, a failure in the RAM 317, ROM 319, I / O 314, and external memory 305 in the channel is detected by a memory diagnostic function called a march, gal pad, etc., double RAM, or defensive programming.

  Step 709: If a channel failure is detected, go to Step 712.

  Step 710: Processing is performed based on the output unit 323.

  Step 711: When a channel failure is detected in Step 703, the fail safe mode or power OFF is set.

  Step 712: When a channel failure is detected in Step 709, the fail safe mode is set.

  Next, the operation of the switching mechanism 204 will be described. FIG. 8 is a flowchart of the switching control unit 212 of the controller 114.

  Step 801: The controller 114 is activated by PowerON and starts diagnosis by the switch failure detection unit 211.

  Step 802: In the startup diagnosis, for example, a pulse wave is output as a test signal from the main channel 201 and the backup channel 202, the output signal of the main switch 213 is taken into the switch failure detection unit 211, and the failure diagnosis of the main switch 213 is performed. .

  Step 803: If there is no failure in the main switch 213, the process proceeds to Step 806. For example, if the main switch 213 has a failure that cannot be switched, the process proceeds to step 804. For example, if the main switch is a failure that does not conduct, the process proceeds to step 805.

  Step 804: Perform fail-safe mode processing. A fail-safe (0) flag is set and a warning notification is sent to the display unit 113.

  Step 805: Danger mode processing is performed. For example, the steer-by-wire system is not activated, and a warning notification is sent to the display unit 113 to make END.

  Step 806: If there is no failure in the backup switch 214, the process proceeds to Step 809. If the backup switch 214 has a failure that cannot be switched, for example, the process proceeds to step 807. If the backup switch 214 has a failure that cannot be switched, for example, and the fail-safe (0) flag has passed, the process proceeds to step 808.

  Step 807: Fail-safe mode processing is performed. When a failure of the main channel 201 is detected, a fail-safe (1) flag is set and a warning notification is given to the display unit 113.

  Step 808: Danger mode processing is performed. For example, the steer-by-wire system is not activated, and a warning notification is sent to the display unit 113 to make END.

  Step 809: If failure detection of both the main channel 201 and the backup channel 202 is detected, the process proceeds to step 810.

  Step 810: A warning notification is sent from the channel failure detection unit 203 to the display unit 113, and the main channel 201 and the backup channel 202 are turned off, for example.

  Step 811: A line time diagnosis process is performed.

When the main channel 201 and the backup channel 202 have not failed and the fail-safe flag is not set, the main switch 213 and the backup switch 214 are set to the state shown in FIG.

When the backup channel 202 has failed but the main channel 201 has not failed and the fail-safe flag is not set, the main switch 213 and the backup switch 214 are brought into the state shown in FIG. To do.

While the main channel 201 that has failed, in a state where the backup channel 202 has not failed, and, if the flag of the fail-safe is not set to the state of FIG. 6 (b) the main switch 213 and the backup switch 214 .

When the main channel 201 has failed but the backup channel 202 has not failed and the fail-safe (0) flag is set, the backup switch 214 is connected via the switching control unit 212. by switching to the state of FIG. 6 (c).

When the main channel 201 and the backup channel 202 are not in failure and the fail-safe (0) flag is set, the main switch 213 and the backup switch 214 are set to the state shown in FIG.

  Next, the operation or effect of the present embodiment will be described.

  If there is no failure detection means inside the switching mechanism 204 and there is no redundancy, since there is one c contact, assuming that the failure mode of the c contact portion is, for example, not closed or not opened, Regardless of the failure mode of the c-contact part, the switching of the connection to the main channel or the backup channel is not successful, so the safe failure rate is considered to be 0%.

  In this embodiment, a failure inside the switching mechanism 204 is detected, and the main switch 213 and the backup switch 214 are connected in series to increase the number of parts of the switching mechanism 204, and the failure rate can be increased. There is sex. For example, in the example of FIG. 6, since the main switch 213 can be regarded as one c contact and the backup switch 214 is regarded as two c contacts, the number of c contact portions is three, and the failure rate of the c contact portion is approximately tripled.

  However, in this embodiment, safety is improved because the dangerous failure rate decreases. Assuming that the failure mode ratio of the c contact is, for example, 50% when not closing and 50% when not opening, the failure mode of 50% when the c contact portion of the main switch 213 is not opened is caused by switching of the backup switch 214. Since the connection to the main channel or the backup channel can be maintained, it can be regarded as a safe failure.

  In the example of FIG. 6, the failure mode of one of the two c contacts of the backup switch 214 is the same as that of the other c contact of the backup switch 214 and the main, regardless of whether the failure is not closed or not opened. If the contact c of the switch 213 is not broken, the connection to the main channel or the backup channel can be maintained, so that the safe failure can be regarded as almost 100%.

  Therefore, even if the failure rate of the c-contact portion of the switch is about three times, the safety-side failure rate can be improved to about 83%, and the safety-side failure rate of the switching mechanism 204 is improved. Therefore, it is easy to achieve a high SIL (safety level) from the viewpoint of functional safety.

  Even if it is not possible to assume that the failure mode ratio of the c contact is 50% when it is not closed and 50% when it is not opened in a semiconductor switch, the cause of short circuit is generally dielectric breakdown due to overvoltage, and the cause of open is overcurrent. It is a break of conduction by. If the failure of not opening is assumed to be dielectric breakdown, the breakdown failure of the main switch 213 can be dealt with by switching the backup switch 214, so the safety-side failure rate is considered to be improved as compared with the conventional case.

  In this embodiment, the backup switch 214 is constituted by a four-way switch or a DPDT switch, and a main switch 213 constituted by a three-way switch or an SPDT switch is connected in series at the subsequent stage. In such a configuration, the probability that the output of the main channel 201 and the output of the backup channel 202 are simultaneously connected to the output interface 215 of the control controller 114 due to a failure of the main switch 213 and the backup switch 214 is established. Can be reduced. Thereby, in this embodiment, an accurate control signal (information) can be transmitted to the actuator 112 through the main switch 213 and the backup switch 214. This effect is the same as in the second embodiment.

  The present embodiment is for reducing the failure rate of a failure that cannot be switched in the failure of the main switch 213 in the first embodiment.

  In the present embodiment, the configurations and operations described in FIGS. 1 to 3, 5A, 5B, 7 and 8 are applied. The main switch 213 having a change will be described with reference to FIG.

  FIG. 9 is a circuit diagram showing another embodiment of the main switch 213. Terminals T0 to T2 in FIG. 9 have the same configuration as the terminals T0 to T2 shown in FIGS. 4A and 4B.

  The main switch 213 according to the present embodiment includes a first main switch portion 213c1 and a second main switch portion 213c2. The first main switch unit 213c1 and the second main switch unit 213c2 are each configured by combining two SPST (Single Pole, Single Throw) switches.

  The first main switch portion 213c1 includes a first SPST switch 51 having a contact 15 and a contact 16, and a second SPST switch 52 having a contact 17 and a contact 18. The contact 15 of the first SPST switch 51 and the contact 17 of the second SPST switch 52 are both connected to the terminal T1. The contact 16 of the first SPST switch 51 and the contact 18 of the second SPST switch 52 are both connected to the terminal T0.

  The second main switch section 213c2 includes a third SPST switch 53 having a contact point 19 and a contact point 20, and a fourth SPST switch 54 having a contact point 21 and a contact point 22. The contact 19 of the third SPST switch 53 and the contact 21 of the fourth SPST switch 54 are both connected to the terminal T2. The contact 20 of the third SPST switch 53 and the contact 22 of the fourth SPST switch 54 are both connected to the terminal T0.

  The main switch 213 according to the present embodiment is in two states (c1) and (c2), excluding failure and switching. In (c1), both the first SPST switch 51 and the second SPST switch 52 of the first main switch unit 213c1 are in the conductive state 213c11. In addition, the third SPST switch 53 and the fourth SPST switch 54 of the second main switch unit 213c2 are both in the disconnected state 213c22. The insides of the first main switch part 213c1 and the second main switch part 213c2 are duplicated and made redundant.

  In (c2), both the first SPST switch 51 and the second SPST switch 52 of the first main switch unit 213c1 are in the disconnected state 213c12. Further, the third SPST switch 53 and the fourth SPST switch 54 of the second main switch portion 213c2 are both in the conductive state 213c21.

  For example, in FIG. 9C2, even if a failure occurs in which one of the two switches 53 and 54 of the second main switch portion 213c2 does not close, if the other switch is closed, the dangerous failure rate is reduced. Can be reduced.

  In the above description, the steer-by-wire system has been described, but an information communication system that needs to reduce the dangerous failure rate can also be applied.

  In addition, this invention is not limited to an above-described Example, Various modifications are included. For example, the above-described embodiments have been described in detail for easy understanding of the present invention, and are not necessarily limited to those having all the configurations described. Further, a part of the configuration of one embodiment can be replaced with the configuration of another embodiment, and the configuration of another embodiment can be added to the configuration of one embodiment. Further, it is possible to add, delete, and replace other configurations for a part of the configuration of each embodiment.

  Each of the above-described configurations, functions, processing units, processing means, and the like may be realized by hardware by designing a part or all of them with, for example, an integrated circuit. Each of the above-described configurations, functions, and the like may be realized by software by interpreting and executing a program that realizes each function by the processor. Information such as programs, tables, and files for realizing each function can be stored in a recording device such as a memory, a hard disk, an SSD (Solid State Drive), or a recording medium such as an IC card, an SD card, or a DVD.

  Further, the control lines and information lines in the drawings are those that are considered necessary for the explanation, and not all the control lines and information lines on the product are necessarily shown. Actually, it may be considered that almost all the components are connected to each other.

  DESCRIPTION OF SYMBOLS 100 ... Mobile body system (vehicle body system), 100A ... Mobile body (vehicle body), 101 ... Steering device, 102 ... Mechanical device, foot part 103, Steer-by-wire system 104, 111 ... Sensor, 112 ... Actuator, 113 ... Display 114 ... Control controller 201 ... Main channel 202 ... Backup channel 203 ... Channel failure detection unit 204 ... Switching mechanism 211 ... Switch failure detection unit 212 ... Switch control unit 213 ... Main switch 214 ... Backup Switch, 301 ... MCU, 302 ... Oscillator circuit, 303 ... Power supply unit, 304 ... Monitoring unit, 305 ... External memory, 311 ... CPU, 312 ... PWM, 313 ... SPI, 314 ... I / O, 315 ... Timer, 316 ... Network, 317 ... RAM, 318 ... ADC 319 ... ROM.

Claims (10)

A main channel and a backup channel for generating a control signal for controlling the actuator, a channel failure detection unit for detecting a failure in the main channel and the backup channel, a first control signal output from the main channel, and an output from the backup channel a switching mechanism that outputs to the output interface to the actuator by switching the second control signal, the controller having a,
The switching mechanism includes a main switch and one or more backup switches that switch a connection state between the main channel and the backup channel and the output interface, a switching control unit that switches a connection state between the main switch and the backup switch, have a, a switch failure detecting section detecting a failure of the main switch and the backup switch,
The backup switch has a connection state in which a third signal line is connected to a first signal line to which the first control signal is transmitted and a fourth signal line is connected to a second signal line to which the second control signal is transmitted. And a connection state in which the fourth signal line is connected to the first signal line to which the first control signal is transmitted and the third signal line is connected to the second signal line to which the second control signal is transmitted. Is configured to switch between,
The main switch is configured to switch between a connection state in which the third signal line is connected to the output interface and a connection state in which the fourth signal line is connected to the output interface;
In the switching mechanism, the switching control unit receives a failure notification from the channel failure detection unit and the switch failure detection unit, and switches the connection state of the main switch and the backup switch, so that the output interface A control controller that outputs either the first control signal or the second control signal . In controller according to claim 1,
The control controller, wherein the main switch and the backup switch are connected in series. The control controller according to claim 2,
The main controller is a 3-way switch, SPDT switch, or two SPST switches, and the backup switch is a 4-way switch or two DPDT switches. The control controller according to claim 3,
The main controller and the backup switch are constituted by one ASIC or one FPAG. The control controller according to claim 3,
The control switch, wherein the main switch and the backup switch are configured by either one or both of a mechanical switch and a semiconductor switch. The control controller according to claim 2,
The main channel and the backup channel output a PWM signal as a control signal,
The control controller, wherein the switch failure detection unit detects a failure in the main channel and the backup channel by monitoring PWM signals output from the main switch and the backup switch. The control controller according to claim 2,
The main channel, the backup channel, and the channel failure detection unit calculate a PWM signal including the same content,
The channel failure detection unit compares the PWM signal output from the main channel, the PWM signal output from the backup channel, and the PWM signal calculated by itself, so that the main channel, the backup channel, or A controller for detecting a failure in the channel failure detection unit. The control controller according to claim 2,
The main channel and the backup channel have an abnormality detection function for detecting an abnormality of the CPU core by comparing operation results of a plurality of CPU cores provided in the lockstep microcomputer, with the operation unit being configured by a lockstep microcomputer. And having
A hardware failure diagnosis function for detecting failures in ROM, RAM, analog input, and output inside the lockstep microcomputer,
The control controller, wherein the channel failure detection unit detects an abnormality or failure of the main channel and the backup channel through the abnormality detection function or the failure diagnosis function of the main channel and the backup channel. In a steer-by-wire system comprising an actuator that drives a mechanical device coupled to a foot, and a control controller that controls the actuator,
A steer-by-wire system comprising the control controller according to claim 2 as the control controller. A moving body, a foot that changes a moving direction of the moving body, a mechanical device coupled to the foot, an actuator that drives the mechanical device, and a steer-by-wire system that includes a control controller that controls the actuator In the machine with
A machine comprising the steer-by-wire system according to claim 9 as the steer-by-wire system.

Images