JP6748460B2 - Control device - Google Patents

Description

The present invention relates to a control device.

For example, in a control device for an electromechanical brake system for an automobile, four processors that control the motors provided on each of the four wheels of the automobile in a one-to-one relationship and the steering angle of the steering wheel are detected. And a central processor that obtains information from the brake pedal sensor that detects displacement of the sensor and the brake pedal.

The central processor and each processor have two controllers, a main controller and a management controller, and each adopts the same structure. Then, the central processor and the main controller of each processor respectively process the information obtained from the various sensors and provide an output for controlling the motor. On the other hand, the management controller executes the same process as the main controller or a part of the process of the main controller and outputs it.

Then, the output of the one main controller is monitored by the other main controller and the management controller, and the output of the one management controller is monitored by the main controller and the other management controller. That is, the main controller and the management controller mutually monitor and verify the outputs to determine whether or not these controllers are malfunctioning (for example, see Patent Document 1).

JP 2007-22050 A

In such a control device, in order to directly control the control target in the failure diagnosis, not only the central processor is required in addition to the same number of processors as the control target, but also each controller requires a plurality of controllers. , The whole system becomes very expensive.

Therefore, the present invention was devised to improve the above-mentioned problems, and an object of the present invention is to provide an inexpensive control device even if failure diagnosis is possible.

In order to achieve the above-mentioned object, in the control device in the means for solving the problems of the present invention, the first control unit and the second control unit are respectively provided with a main controller and a sub-controller having a low arithmetic processing capacity as a pair. Then, of the main controllers and the sub-controllers, the controller that outputs a calculation result different from the majority calculation result among the calculation results of the control commands is diagnosed as abnormal. Therefore, the control target can be controlled even if some of the controllers are out of order, and thus the control of the control target can be continued to exhibit the fault tolerance function. In addition, since a correct control command can be adopted for control by majority decision, it is possible to perform robust control without being easily affected by noise or the like. Furthermore, since it is possible to adopt the correct control command by majority vote for control, it is not necessary to understand all abnormal patterns and judge whether they correspond to the abnormal patterns to recognize the abnormalities. Even if occurs, control can be performed with a correct control command. Further, the first control unit and the second control unit can directly control the control target, respectively, and the central processor is not required. In addition, since the sub-controller has a low arithmetic processing capability with respect to the main controller, an inexpensive microcomputer can be used for the sub-controller. Also, the control device performs simulated calculation processing in which each main controller and each sub-controller has a smaller calculation load than the control command, compares the results of the simulated calculation processing, and determines whether the calculation processing capacity of itself is poor. Since it is diagnosed, it is possible to diagnose whether or not there is a malfunction in the arithmetic processing capability of each controller.

In the control device according to claim 2, wherein the control command each sub controller performs arithmetic processing for determining a control command with a lower operation speed than the operational speed of each main controller, the main controller and the sub controller on the basis of the same information Since the abnormality diagnosis is performed by comparing the calculation results obtained by performing the above calculation, the abnormality diagnosis can be reasonably performed even if an inexpensive microcomputer is used as the sub-controller, and the fault tolerance can be realized.

Furthermore, the control device according to claim 3, each sub-controller calculates the portion of the calculation processing said respective main controller at a lower computation rate than the computation rate of the main controller obtains the control command, each and each main controller It is shorter than the time required for the sub-controller to calculate all the control commands because the sub-controller compares the calculation results obtained by executing a part of the calculation processing based on the same information and performs an abnormality diagnosis. Since the calculation result can be obtained in time, the frequency of abnormality diagnosis per unit time can be increased and the abnormality diagnosis can be performed densely. Further, in the control apparatus 請 Motomeko 4, each of the main controller and the secondary controller, when abnormality is recognized by the result compared to the mock processing, recognized as normal by comparison of the results of the next and subsequent simulated processing Until this is done, it does not participate in the calculation of the control command, so it is possible to prevent the controller having a poor calculation processing capacity from participating in control.

Further, in the control device according to claim 5 , it is used to obtain information detected by an arbitrary sensor of the plurality of sensors or first controlled object information regarding a controlled object obtained from this information, and first controlled object information. Since the abnormality diagnosis is performed by comparing the first control target information obtained from the information detected by any sensor other than the sensor with the second control target information of the same type, the abnormality of the entire system of the control device can be diagnosed.

In the control device of claim 6 , one or more of the sub signal lines connecting the first control unit and the second control unit in parallel with the main signal line connecting the first control unit and the second control unit are provided. Between the sub control unit and the first control unit and the sub control unit in the middle of the sub signal line, between the sub control units and between the second control unit and the sub control unit when there are a plurality of sub control units. Since it is equipped with a relay provided in the above, even if a disconnection occurs in the sub-signal line, communication is performed by bypassing the disconnection part of the sub-signal line to maintain the communicable state, and the communication speed decreases. Don't invite.

Further, in the control device according to claim 7 , since the first control unit and the second control unit are connected to a sensor that collects information necessary for control via an in-vehicle network, the first control unit or the second control unit. Even if one of the units is disconnected from the vehicle-mounted network, the first control unit and the second control unit can communicate with each other and control of the controlled object can be continued without interruption.

Further, in the control device according to the eighth aspect , the first control unit and the second control unit are provided with the spare battery, so that the control of the controlled object can be continued even if the power supply from the power source (not shown) of the vehicle is interrupted. ..

The control device according to claim 9 includes a recording unit that records the error code output from each controller, and a wireless communication device that can transmit the error code accumulated in the recording unit to the outside. Can be transmitted to the outside, and the cause of the abnormality can be analyzed by analyzing the error code, which is convenient.

According to a tenth aspect of the present invention, the control device includes two drive circuits that respectively supply electric power to the two coils provided in the control target, and a current sensor that detects the amount of current in each coil. A PWM command can be output to one side to form one control system, and a sub-controller can be connected to the other side of the drive circuit to output a PWM command to form a versatile control system. When the deviation from the target current obtained based on the control command exceeds the abnormal threshold value for a certain period of time, the control system that outputs the PWM command to the coil is diagnosed as having a poor control capability. Therefore, the abnormality of the control system can be diagnosed, and even if there is an abnormality in one of the control systems, the control of the other control system can be continued.

According to the present invention, the cost of the control device is low even if the failure diagnosis is possible.

It is a figure which shows the system configuration of the control apparatus of 1st embodiment. It is a figure showing the system configuration of the control device of a first embodiment used for control of a damper of a saddle riding vehicle. It is a schematic diagram of a damper. It is a block diagram of the 1st control unit and the 2nd control unit in the control apparatus of 1st embodiment. It is a state transition diagram of a main controller. It is a state transition diagram of a sub controller. It is a figure which shows the system structure of the control apparatus of 2nd embodiment used for a motor vehicle. It is a block diagram of the 1st control unit and the 2nd control unit in the control apparatus of 2nd embodiment. It is a block diagram of the sub-control unit in the control device of the second embodiment. It is a figure which shows the connection state of each control unit in the control apparatus of 2nd embodiment. In the control device of the second embodiment, it is a diagram showing a state where one of the communication lines of the sub signal line is broken. In the control device of the second embodiment, it is a diagram in which each control unit is connected by bypassing a portion where one of the communication lines of the sub signal line is broken. It is a state transition diagram of a low-order controller.

<First embodiment>
The present invention will be described below based on the embodiments shown in the drawings. As shown in FIG. 1, the control device 1 is configured to include a first control unit U1 and a second control unit U2 provided separately from the first control unit U1, and in the present embodiment, a saddle riding It is used as a control device that controls the dampers FD and RD of the two-wheeled vehicle, which is both.

As shown in FIG. 1, FIG. 2, and FIG. 3, in this example, the control device 1 includes a front wheel side damper FD interposed between a vehicle body B and a front wheel FW of the two-wheeled vehicle, a vehicle body B, and a rear wheel RW. The pressure of the pressure side chamber R2 in the rear wheel side damper RD that is interposed between the two is controlled. Further, the control device 1 controls the dampers FD and RD, and as information, the pitching angular velocity ω of the vehicle body B, the pressure Pf of the pressure side chamber R2 of the front wheel side damper FD, and the pressure side chamber R2 of the rear wheel side damper RD. A sensor for detecting the pressure Pr is provided. Specifically, the rate sensor 2 for detecting the pitching angular velocity ω, the pressure sensor 3 for detecting the pressure Pf of the pressure side chamber R2 in the front wheel side damper FD, and the pressure Pr of the pressure side chamber R2 in the rear wheel side damper RD are detected. It is equipped with a pressure sensor 4. The rate sensor 2 is connected to the first control unit U1 and the second control unit U2 via an in-vehicle network N as a network using a CAN (controller area network) serial bus system. The pressure sensor 3 is directly connected to the first control unit U1 so that information can be input, and the pressure sensor 4 is directly connected to the second control unit U2 so that information can be input. There is. In this way, the information necessary for controlling the dampers FD and RD is obtained by the first control unit U1 and the second control unit U2. The first control unit U1 and the second control unit U2 are connected by a main signal line 51 so that communication according to the CAN standard (CAN communication) is possible, and can communicate with each other. Note that the rate sensor 2 may also be directly connected to the first control unit U1 and the second control unit U2 similarly to the pressure sensors 3 and 4.

Further, in the present embodiment, a recorder 63 as a recording unit connected to the first control unit U1 via the vehicle-mounted network N and a wireless communicator 54 capable of communicating with the mobile terminal 55 are provided. The wireless communication device 54 can access information from the recording device 63 to the internet communication network 56 through an external mobile terminal. The recorder 63 is also connected to the second control unit U2 via the vehicle-mounted network N. Therefore, the recorder 63 can directly communicate with the first control unit U1 and the second control unit U2. The in-vehicle network N, which is a network, may be a communication network using a communication standard other than CAN communication. The recorder 53 may be directly connected to one or both of the first control unit U1 and the second control unit U2 without performing the in-vehicle network N to perform mutual communication.

Hereinafter, each member will be described in detail. The front wheel side damper FD and the rear wheel side damper RD are, for example, as shown in FIG. 3, a cylinder 10 and a cylinder 10 slidably inserted into the cylinder 10. A piston 11 which is divided into an expansion side chamber R1 filled with liquid and a compression side chamber R2, a piston rod 12 which is also movably inserted in the cylinder 10 and connected to the piston 11, and a piston rod 12 which is internally communicated with the compression side chamber R2. A tank 13 having a reservoir R, an expansion-side damping passage 14 that gives resistance to the flow of liquid from the expansion-side chamber R1 to the compression-side chamber R2, and a tank 13 arranged in parallel with the expansion-side damping passage 14 from the compression-side chamber R2 to the expansion-side chamber R1. The pressure side passage 15 that allows only the flow of the liquid, the pressure side damping passage 16 that provides resistance to the flow of the liquid from the pressure side chamber R2 to the reservoir R, and the liquid that is parallel to the pressure side damping passage 16 and flows from the reservoir R to the pressure side chamber R2. Of the suction passage 17, a bypass passage 18 that is in parallel with the compression side damping passage 16 and the suction passage 17 and connects the pressure side chamber R2 and the reservoir R, and a pressure side chamber R2 provided in the middle of the bypass passage 18. 2 is provided with a control valve V as a pressure control element for adjusting the pressure of the cylinder. In this example, the lower end of the piston rod 12 projecting into the cylinder 10 in FIG. 2 is connected to the front wheel FW or the rear wheel RW of the motorcycle, The upper end in FIG. 2 of 10 is connected to the vehicle body B of the motorcycle. The expansion side chamber R1 and the compression side chamber R2 are filled with a liquid, and the reservoir R includes a liquid chamber L and an air chamber G defined by an elastic partition 19 provided in the tank 13. Instead of the elastic partition wall 19, a free piston slidably inserted into the tank 13 may partition the liquid chamber L and the air chamber G. In addition to hydraulic oil, water, aqueous solution, etc. can be used as the liquid.

The expansion-side damping passage 14 and the compression-side damping passage 16 are provided with a damping valve in the middle thereof to give resistance to the flow of the passing liquid. The pressure side passage 15 and the suction passage 17 are each provided with a check valve in the middle, and regulate the flow of the passing liquid in one way.

The control valve V is, for example, an electromagnetic valve or the like that drives a valve element of a poppet valve with a solenoid, and the opening degree of the valve can be changed according to the amount of supplied electric current to adjust the flow passage area. The resistance given to the liquid flowing through the bypass passage 18 can be changed. The control valve V may be configured to adjust the valve opening pressure, instead of adjusting the flow passage area. Further, the control valve V may be a variable throttle type or an open/close valve type. The solenoid in the control valve V includes a movable core that is connected to the valve body, and a coil that is arranged on the outer peripheral side of the movable core and that drives the movable core when current is supplied. Further, in this embodiment, as shown in FIG. 4, one solenoid is provided with two coils Co1 and Co2 forming a double winding, and even if one of the coils Co1 and Co2 is disconnected, the other coil is disconnected. The valve opening of the control valve V can be adjusted by supplying a current to the control valve V. Further, the amount of current flowing through the coils Co1 and Co2 of the control valve V of each damper FD and RD is detected by the current sensors 5, 5', 6, 6', and the current sensors 5, 5', 6, 6'. Are input to the first control unit U1 and the second control unit U2, which are respectively connected to. The current sensor 5(6) detects the current of the coil Co1, and the current sensor 5'(6') detects the current of the coil Co2. The control valve V may have a stepping motor and a feed screw mechanism instead of the solenoid to move the valve body.

When the front wheel side damper FD and the rear wheel side damper RD are extended, the liquid moves from the compressed side chamber R1 to the expanded pressure side chamber R2 via the extended side damping passage 14. A pressure difference is generated between the expansion side chamber R1 and the compression side chamber R2 due to the resistance given to the flow of the liquid by the expansion side damping passage 14, and the front wheel side damper FD and the rear wheel side damper RD perform the expansion operation according to the pressure difference. Exhibits a damping force on the extension side. Liquid is supplied from the reservoir R into the enlarged pressure side chamber R2 through the suction passage 17, and the volume of the piston rod 12 that withdraws from the cylinder 10 is compensated. Therefore, the front wheel side damper FD and the rear wheel side damper RD function as passive dampers whose damping characteristics do not change during extension operation.

On the contrary, when the front wheel side damper FD and the rear wheel side damper RD contract, the liquid moves from the compressed pressure side chamber R2 through the pressure side passage 15 to the expanded side chamber R1. Further, at this time, since the piston rod 12 enters the cylinder 10, the excess liquid in the cylinder 10 is discharged from the pressure side chamber R2 to the reservoir R via the pressure side damping passage 16 and the bypass passage 18. In this way, the liquid equivalent to the volume of the piston rod 12 that has entered the cylinder 10 is discharged from the cylinder 10 to the reservoir R, and the volume of the piston rod 12 that has entered the cylinder 10 is compensated. When the liquid moves from the pressure side chamber R2 to the reservoir R, the pressure side damping passage 16 and the control valve V provide resistance to the flow of the liquid, so that the pressure in the cylinder 10 increases and the front wheel side damper FD and The rear wheel side damper RD exhibits a compression side damping force that suppresses the contraction operation.

Here, if the flow passage area is changed by adjusting the amount of current supplied to the control valve V provided in the middle of the bypass passage 18, the pressure in the pressure side chamber R2 can be controlled. More specifically, the liquid pushed out from the cylinder 10 due to the intrusion of the piston rod 12 into the cylinder 10 tries to pass through the compression side damping passage 16 and the bypass passage 18 to the reservoir R. Here, if the opening of the control valve V is reduced, it becomes difficult for the liquid to move to the reservoir R, so that the pressure in the pressure side chamber R2 increases, and if the opening of the control valve V is increased, the liquid moves to the reservoir R. Since it becomes easier, the pressure in the pressure side chamber R2 becomes smaller. The front-wheel-side damper FD (rear-wheel-side damper RD) receives the pressure in the pressure-side chamber R2 by the piston 11 and exerts the pressure-side damping force that suppresses the contraction operation. Therefore, when the pressure in the pressure-side chamber R2 is adjusted, the pressure-side damping You can control the force. The pressure in the pressure side chamber R2 of the front wheel side damper FD (rear wheel side damper RD) becomes highest when the contraction speed is the same and the flow passage area in the control valve V is minimized at any contraction speed.

Further, an electro-rheological fluid or a magnetorheological fluid is used as the liquid, and a device capable of adjusting a voltage or a magnetic field applied to the passing fluid instead of the valve is incorporated in the bypass passage 18 to change the resistance given to the fluid flowing through the bypass passage 18. Alternatively, the pressure in the pressure side chamber R2 may be controlled.

Further, the pressure sensor 3 may be attached to a position where the pressure Pf in the pressure side chamber R2 of the front wheel side damper FD can be detected. It is mounted upstream of the control valve V in the bypass passage 18. The pressure sensor 3 detects the pressure Pf of the pressure side chamber R2 in the front wheel side damper FD as information, and directly outputs the information to the first control unit U1. Further, the pressure sensor 4 may be mounted at a position where the pressure Pr in the pressure side chamber R2 of the rear wheel side damper RD can be detected. In this case, the pressure sensor 4 is upstream of the pressure side damping passage 16 that connects the pressure side chamber R2 and the reservoir R. It is attached upstream of the control valve V of the bypass passage 18. The pressure sensor 4 detects the pressure Pr of the pressure side chamber R2 in the rear wheel side damper RD as information, and directly outputs the information to the second control unit U2.

When the front wheel side damper FD and the rear wheel side damper RD are configured as described above, the pressure in the pressure side chamber R2 can be controlled by adding the bypass passage 18 and the control valve V to the general damper. Further, the pressure sensors 3 and 4 are easily installed, and when the cylinder 10 side is installed on the vehicle body B side, the pressure sensors 3 and 4 and the control valve V are arranged on the vehicle body B side, and vibrations of high amplitude and large amplitude are generated. It is not necessary to arrange these on the side of the input wheels. Therefore, the reliability of the control device 1 is enhanced, and the signal lines and harnesses used for signal extraction and current supply are easily handled and deterioration is suppressed.

Subsequently, the rate sensor 2 is, for example, a sensor that uses a rate gyro, and is capable of detecting the pitching angular velocity ω which is the angular velocity around the lateral axis of the vehicle body B. The rate sensor 2 may be a multi-axis rate sensor and detects one or both of a roll angular velocity around the longitudinal axis of the vehicle body B and a yaw angular velocity around the vertical axis of the vehicle body B in addition to the pitching angular velocity ω. May be The rate sensor 2 outputs the pitching angular velocity ω detected as information to the first control unit U1 and the second control unit U2 via the vehicle-mounted network N. When the rate sensor 2 is provided near the center of pitching rotation of the vehicle body B or near the center of gravity of the vehicle body B or near the center of gravity of the vehicle body B, the pitching angular velocity ω of the vehicle body B can be accurately detected. It may be installed.

Further, in the control device 1, the alarm device K is connected through the in-vehicle network N. The alarm device K includes a warning lamp and a speaker that generates a warning sound in order to notify the driver of the motorcycle of the abnormality. When the warning device K receives the warning signal from the first control unit U1 or the second control unit U2, the warning device lights the warning lamp and outputs the warning sound from the speaker to prompt the passengers of the two-wheeled vehicle to stop traveling. To do. The alarm device K may include only one of a warning lamp and a speaker.

As shown in FIGS. 1 and 4, the first control unit U1 and the second control unit U2 respectively include main controllers M1 and M2 and sub-controllers S1 and S2 having a processing speed lower than those of the main controllers M1 and M2. It is equipped with. The main controllers M1 and M2 are high-end microcomputers, respectively, and the sub-controllers S1 and S2 are mid-range microcomputers that are lower in price than the main controllers M1 and M2. Both the first control unit U1 and the second control unit U2 are adapted to operate by receiving power supply from a vehicle-mounted battery (not shown). If the power is supplied from the onboard battery not by one system but by multiple systems, even if one system fails, it can receive power from other systems, so a robust system can be constructed. Further, both the first control unit U1 and the second control unit U2 are equipped with a spare battery SB. Therefore, the first control unit U1 and the second control unit U2 receive power supply from the spare battery SB and can continue to control the dampers FD and RD that are control targets even if the power supply from the vehicle-mounted battery is interrupted. It has become.

Further, the main controllers M1 and M2 both include CAN interfaces 21 and 22 so that CAN communication can be performed between the vehicle-mounted network N and the control units U1 and U2. Further, the main controllers M1 and M2 obtain a control command, but the output port 23 for outputting the PWM command for driving the solenoid of the control valve V according to the control command, the pressure sensor 3(4) and the current. The AD converter 24 is provided which converts an analog signal output from the sensor 5, 5'(6, 6') into a digital signal and receives information from the sensor group.

The sub-controllers S1 and S2 both include CAN interfaces 31 and 32 so that CAN communication can be performed between the vehicle-mounted network N and the control units U1 and U2. Further, the sub-controllers S1 and S2 have an output port 33 for outputting a PWM command for driving the solenoid of the control valve V according to the control command, the pressure sensor 3 (4), and the current sensors 5, 5'(6. , 6') to convert the analog signal output from the sensor group into a digital signal and receive the information from these sensor groups.

Further, each of the control units U1 and U2 has connectors 42 and 43 connected to both the CAN interface 21 of the main controllers M1 and M2 and the CAN interface 31 of the sub-controllers S1 and S2 via an internal signal line 41, and a CAN interface. 22 and the CAN interface 32 are connected to the connector 45 via an internal signal line 44, and are connected to both the output port 23 and the output port 33 via internal signal lines 46 and 47, and the AD converter 24 is also connected. , 34 connected via an internal signal line 52 to both the control signal V and the drive signal 34, and a drive which is provided in the middle of the internal signal lines 46 and 47 and supplies a drive current for driving the solenoid of the control valve V by inputting a PWM command. Circuits 49 and 50 and an amplifier circuit 53 provided in the middle of the internal signal line 52 and amplifying a signal input from the connector 48 side and outputting the amplified signal to both the AD conversion units 24 and 34 are provided. The above-mentioned constituent elements of the one control unit U1 and the second control unit U2 are respectively installed on a single substrate CB, and housed in a casing (not shown). The rate sensor 2 may be installed on the board CB of the first control unit U1 or the board CB of the second control unit U2.

The internal signal line 41 has a connector connection line 41a having one end connected to the connector 42 and the other end connected to the connector 43, and one end connected to the CAN interface 21 of the main controller M1 (M2) and the other end. The controller connection line 41b connected to the CAN interface 31 of the sub-controller S1 (S2), the connection line 41c connecting the middle of the connector connection line 41a and the middle of the controller connection line 41b, and the connection line 41c of the connector connection line 41a. The relays 41d and 41e are provided on both sides of the connection point. Therefore, the main controller M1 and the sub controller S1 can communicate with each other via the controller connection line 41b in the first control unit U1, and the main controller M2 and the sub controller S2 can communicate with each other in the second control unit U2. Can communicate with each other via. The relay 41d is closed when no current is supplied to connect the connector 42 to the main controller M1 (M2) and the sub-controller S1 (S2), and is opened when power is supplied to the main controller M1 from the connector 42. (M2) and the sub-controller S1 (S2) are shut off. Further, the relay 41e is opened when current is not supplied to cut off the connector 43 and the main controller M1 (M2) and the sub controller S1 (S2), and closed when power is supplied to close the connector 43 and the main controller M1 ( M2) and the sub controller S1 (S2) are connected. A control line (not shown) for turning ON/OFF the relays 41d and 41e is wired-OR connected to both the main controller M1 (M2) and the sub-controller S1 (S2), and the command to the relays 41d and 41e is It is possible from either the controller M1 (M2) or the sub-controller S1 (S2).

The connectors 42, 43 of the first control unit U1 and the connectors 42, 43 of the second control unit U2 are connected to each other by the main signal line 51, and not only in the control units U1, U2, but also in the main controllers M1, M2 and the sub-controller S1,. The S2s can communicate with each other. In this example, the main signal line 51 includes two cables 51a and 51b. In addition, in order to increase the amount of information that can be exchanged in each unit time of the cables 51a and 51b that form the main signal line, the communication line for CAN communication is n-folded (n is an integer of 2 or more). It is configured. In response to the n-folded communication lines of the cables 51a and 51b of the main signal line 51, the internal signal line 41 is also configured by the n-folded communication line. When the cables 51a and 51b are not integrated but arranged so as to be separated from each other, the risk of disconnection at one time can be avoided. It should be noted that the number of communication lines in each of the cables 51a and 51b to be n-folded is arbitrary, and may be simply configured by one communication line.

Then, by closing either one of the relays 41d and 41e in the internal signal line 41, either one of the cables 51a and 51b of the main signal line 51 can be made effective, and any one of the cables 51a and 51b is disconnected. However, if the other is enabled, the communication between the first control unit U1 and the second control unit U2 can be secured. Further, as described above, since the relays 41d and 41e have the opposite opening and closing operations due to the power supply, even if the power supply to the relays 41d and 41e is interrupted, the first control unit U1 and the second control unit must be operated. Communication between the units U2 can be secured.

The internal signal line 44 has one end connected to the CAN interface 22 of the main controller M1 (M2) and the other end connected to the CAN interface 32 of the sub controller S1 (S2), and a controller connection line 44a and a controller connection line 44a. And a connector connecting wire 44b for connecting the middle of the above to the connector 45. Therefore, the main controller M1 and the sub controller S1 can communicate with each other via the controller connection line 44a in the first control unit U1, and the main controller M2 and the sub controller S2 can communicate with each other in the second control unit U2. Can communicate with each other via.

Further, the connectors 45 of the first control unit U1 and the second control unit U2 are connected to each other via the signal lines 58 and 59 to the in-vehicle network N. Therefore, the main controllers M1 and M2 and the sub-controllers S1 and S2 can obtain various information on the vehicle-mounted network N other than the rate sensor 2 through the vehicle-mounted network N or the main signal line 51, and other control unit U1. The information detected by the pressure sensors 3 and 4 and the current sensors 5, 5', 6, 6'connected to (U2) can also be obtained.

The internal signal line 46 connects the output port 23 of the main controller M1 (M2) to the connector 48, and the internal signal line 47 connects the output port 33 of the sub controller S1 (S2) to the connector 48. The main controller M1 (M2) processes each information input from the rate sensor 2 and the pressure sensors 3 and 4 to generate a control command for controlling the dampers FD and RD. In addition, the main controller M1 (M2) gives a PWM command to the drive circuit 49 so that the current required to control the dampers FD and RD according to the control command can be supplied to the solenoid of the control valve V via the drive circuit 49. Is output from the output port 23. That is, the main controller M1 (M2) obtains the target pressure for controlling the pressure side damping force of the dampers FD and RD, and the target for driving the solenoid from the difference between the target pressure and the pressure value detected by the pressure sensors 3 and 4. The current is obtained, and further, the PWM command is obtained from the difference between the target current and the amount of current detected by the current sensors 5(5') and 6(6'). Then, the main controller M1 (M2) outputs a PWM command from the output port 23 to the drive circuit 49 to execute control of the dampers FD and RD. When the main controller M1 (M2) is out of order, the sub controller S1 (S2) obtains a PWM command that is a control command instead of the main controller M1 (M2). Then, in this case, the sub controller S1 (S2) outputs a PWM command for driving the control valve V from the output port 33 to the drive circuit 50 instead of the main controller M1 (M2) to control the dampers FD and RD. To execute.

The drive circuits 49 and 50 are PWM drive circuits. When a PWM command is input, the drive circuits 49 and 50 supply a drive current to the coils Co1 and Co2 in the solenoid of the control valve V in accordance with the duty ratio specified by the PWM command. Has become. The coil Co1 is connected to the drive circuit 49, and the coil Co2 is connected to the drive circuit 50. Therefore, if one of the drive circuit 49 and the drive circuit 50 is selected to supply the current, the current can be supplied to one of the two coils Co1 and Co2.

The internal signal line 52 branches from the middle to connect the connector 48 to the AD conversion unit 24 of the main controller M1 ( M2 ) and the AD conversion unit 34 of the sub controller S1 ( S2 ). An amplifier circuit 53 such as a non-inverting amplifier circuit configured by an operational amplifier is provided in the middle of the internal signal line 52. Further, the connector 48 in the first (second) control unit U1 ( U2 ) is connected to the pressure sensor 3(4). Further, the current sensors 5, 5'(6, 6') are composed of shunt resistors and are mounted together with the drive circuits 49, 50 on the substrate CB in this example. Then, the signals from the pressure sensor 3 (4) and the current sensors 5, 5'(6, 6') are input to the amplifier circuit 53 via the internal signal line 52, and the signals from these sensors are amplified by the amplifier circuit 53. It is adapted to be input to the main controller M1 and the sub controller S1 .

In the above description, the first control unit U1 and the second control unit U2 perform CAN communication, but the in-vehicle network N may be included in the FlexRay standard communication.

In this example, each of the main controllers M1 and M2 and each of the sub-controllers S1 and S2 performs the following processing to generate a control command for controlling the compression side damping force of each of the dampers FD and RD. First, each of the main controllers M1 and M2 and each of the sub-controllers S1 and S2 obtains a target torque τ that suppresses the pitching of the vehicle body B from the pitching angular velocity ω detected by the rate sensor 2. Further, each of the main controllers M1 and M2 and each of the sub-controllers S1 and S2 generates a compression side damping force in the direction in which the pitching of the vehicle body B is suppressed from the sign of the target torque τ among the front wheel side damper FD and the rear wheel side damper RD. Select possible dampers. Then, each of the main controllers M1 and M2 and each of the sub-controllers S1 and S2 obtains the target pressures Pf ^* and Pr ^{* of the} pressure side chamber R2 of the selected damper by multiplying the target torque τ by the conversion coefficient. Subsequently, each of the main controllers M1 and M2 and each of the sub-controllers S1 and S2 calculates the deviation between the pressure of the pressure side chamber R2 of the selected damper detected by the pressure sensor 3 or the pressure sensor 4 and the target pressure. Then, each of the main controllers M1 and M2 and each of the sub-controllers S1 and S2 generates a control command for driving the solenoid of the control valve V of the damper selected from the above-mentioned deviation. In this example, specifically, the controllers M1, M2, S1, and S2 use the pressure sides of the dampers FD and RD required to suppress the pitching of the vehicle body based on the pitching angular velocity ω detected by the rate sensor 2. The target pressure Pf ^* or target pressure Pr ^* of the chamber R2 is calculated. Then, each of the controllers M1, M2, S1, S2 sends to the coil Co1 (Co2) of the control valve V based on the control deviation between the target pressures Pf ^* , Pr ^* and the pressures Pf, Pr detected by the pressure sensors 3, 4. The target currents if ^* and ir ^* to be given are calculated. Further, the controllers M1, M2, S1, S2 feed back the current amounts if, ir in the control valve V of the dampers FD, RD detected by the current sensors 5, 6 to feed back the current amounts if, ir and the target current if. ^The PWM commands If and Ir are obtained based on the control deviation from ^* and ir ^* . In this example, the PWM commands If and Ir are used as control commands. The PWM commands If and Ir are amplified by the drive circuits 49 and 50 and output to the coils Co1 and Co2.

The main controllers M1 and M2 generate a control command for each control cycle in order to control the control valve V at a predetermined control cycle. Since the sub-controllers S1 and S2 have lower processing speeds than the main controllers M1 and M2, the sub-controllers S1 and S2 calculate the control command at a rate of once while the main controllers M1 and M2 calculate the control commands a plurality of times. How many times the main controllers M1 and M2 perform calculations while the sub controllers S1 and S2 perform one calculation are set according to the processing speeds of the main controllers M1 and M2 and the sub controllers S1 and S2. For example, if the main controllers M1 and M2 can perform arithmetic processing at a speed 10 times faster than the sub-controllers S1 and S2, the main controllers M1 and M2 calculate control commands 10 times, while the sub-controllers S1 and S2 calculate. It is set to calculate the control command once.

As described above, the main controllers M1 and M2 perform the control command arithmetic processing a plurality of times until the sub-controllers S1 and S2 finish the control instruction arithmetic processing. When the control command as the calculation result obtained by the sub-controllers S1, S2 and the control command as the calculation result obtained by the main controllers M1, M2 are different, either of the controllers M1, M2 , S1, S2 may be abnormal.

Therefore, the control device 1 compares the control commands obtained by the main controllers M1 and M2 and the sub-controllers S1 and S2 each time a control command is obtained by the arithmetic processing of the sub-controllers S1 and S2, and compares each controller M1. , M2, S1, S2 are diagnosed for any abnormality.

First, prior to the control command calculation process, a simulated calculation process with a smaller calculation load than the control command calculation process is performed, and the processing results are compared, and the controllers M1, M2, S1, S2 calculate by themselves based on a majority vote. Diagnose whether you are incapacitated. The comparison of the results of the simulation calculation processing is performed in all the controllers M1, M2, S1, S2. Specifically, when the simulation calculation process is completed and the calculation result is obtained, the controllers M1, M2, S1, S2 communicate with each other to obtain all the calculation results and compare them. When the controllers M1, M2, S1, S2 compare the values of the operation results and make a majority decision, and when they output the operation results different from the majority result among the operation results output by the other controllers, It diagnoses itself as having a poor computing capacity. The simulation calculation process is, for example, a calculation process such as an integer calculation, and is a calculation process that does not delay the calculation process of the next control command. The simulated calculation process is a simple calculation process compared to the calculation of the control command, and the controller that outputs the minority result by the majority decision of the result of the simulated calculation process may be in a serious abnormal state. It is in an unfavorable state for performing calculations and controlling the dampers FD and RD. Therefore, among the controllers M1, M2, S1 and S2, the controller that recognizes itself as having a poor calculation capability does not perform the calculation processing of the control command and does not execute the control of the dampers FD and RD from the output ports 23 and 33. The PWM output of is set to 0. For example, when there is an abnormality in the main controller M1 in the first control unit U1, the sub-controller S1 paired with the main controller M1 in the first control unit U1 is a control target of the first control unit U1 instead of the main controller M1. The front wheel side damper FD is controlled. When there is no malfunction in the arithmetic processing due to this processing, each controller M1, M2, S1, S2 moves to the subsequent arithmetic processing of the control instruction, and further, by comparing the control instructions, the controller M1, M2, S1, S2 It is designed to diagnose abnormalities. It should be noted that the determination as to whether or not there is a malfunction in the calculation performance by this simulation calculation process can be performed for each control cycle of the main controllers M1 and M2, and even if the controller was previously diagnosed as having a malfunction in calculation capability, the next simulation calculation process will be performed. If no malfunction in the computing capacity is recognized in, return to damper control. When all the main controllers M1 and M2 are found to be out of operation capacity, the sub-controllers S1 and S2 control the dampers FD and RD based on the control command adopted before the outage of operation capacity. Further, in the abnormality diagnosis by comparing the calculation results of the simulated calculation processing, the controllers M1, M2, S1 and S2 not only recognize the malfunction of their own computing power due to a majority decision, but also the other controllers are malfunctioning of the computing power. Whether or not it may be diagnosed.

Subsequently, the controller, which is recognized as having no calculation capacity failure by the simulated calculation process by all the controllers M1, M2, S1, S2, performs the calculation process of the control command, compares the control commands, and participates in the calculation process. Performs controller abnormality diagnosis. By the time the sub-controllers S1 and S2 complete the arithmetic processing of one control command, the main controllers M1 and M2 have completed the arithmetic processing of the control commands a plurality of times. The control command obtained from the same information is used by M2, S1, and S2. When the main controllers M1 and M2 and the sub-controllers S1 and S2 start the control command arithmetic processing based on the same information, the main controller M1 and the sub-controllers S1 and S2 wait until the sub-controllers S1 and S2 finish the control command arithmetic processing. M2 processes the control command multiple times. Therefore, the control commands obtained by the main controllers M1 and M2 performing arithmetic processing based on the same information as the sub-controllers S1 and S2 are provided in the main controllers M1 and M2 or stored in an external storage device. deep. Then, the sub-controllers S1 and S2 compare the control command obtained by the arithmetic processing based on the same information as the main controllers M1 and M2 with the control command stored in the storage device. By doing so, the main controller M1, M2 and the sub-controller S1, S2 can compare the control commands obtained from the same information. For example, when the control cycle of the main controllers M1 and M2 is 1 millisecond and the sub-controllers S1 and S2 calculate the control command once every 10 milliseconds, the control command obtained by the main controllers M1 and M2 is about 10 milliseconds. It is held and the control commands are compared every 10 milliseconds.

The comparison of the control commands is performed in all the controllers M1, M2, S1, S2. Specifically, when the calculation of the control command to be compared ends, each controller M1, M2, S1, S2 sends the control command calculated by itself to the other controller M1, M2, S1, S2. It is transmitted via the main signal line 51. Each controller M1, M2, S1, S2 compares the four control commands by adding the three control commands calculated by the other controller to the control command calculated by itself. If all the control commands do not match, the controllers M1, M2, S1, S2 diagnose the controller that has output a control command different from the other control commands including itself by the majority decision as abnormal. If there is a controller that does not participate in the control command by comparing the results of the simulation calculation processing, the majority decision may be made only by the control command obtained by the controller recognized as normal.

Specifically, if all the control commands match, each controller M1, M2, S1, S2 diagnoses that all the controllers M1, M2, S1, S2 are normal. On the other hand, each controller M1, M2, S1, S2 diagnoses the controller that has output a different control command as abnormal if there are control commands with different values for the three matched control commands. In addition, each of the controllers M1, M2, S1, and S2 determines that the controller that outputs two matched control commands is normal when there are two matched control commands and two control commands having different values from the control commands. , Other controllers are diagnosed as abnormal. Further, since the four controllers M1, M2, S1, and S2 perform abnormality diagnosis, if there are two matching control commands and two control commands that match with different values from these control commands, which controller is determined by the majority decision. It is not known whether is abnormal, but it is diagnosed as abnormal. Further, when the control commands differ among the four controllers M1, M2, S1, S2, it is not known which controller is abnormal by majority vote, but it is diagnosed as abnormal. When comparing the control commands, it is determined that the control commands match each other by perfect matching of the values of the control commands, and the deviation between the control commands or the average value of all the control commands and the deviation between the control commands are allowed in advance. It may be determined that the control commands do not match when the value (threshold value) is exceeded.

As a result of the comparison of the control commands, all the control commands match, and in the case where it is diagnosed that all the controllers M1, M2, S1, S2 are normal, the main controllers M1, M2 receive the control commands from the output port 23. It outputs a certain PWM command. Since the main controllers M1 and M2 are normal, the sub-controllers S1 and S2 do not output the PWM command from the output port 33 and set the output current to 0. Thus, since all the controllers M1, M2, S1, S2 are normal, the main controller M1, M2 selects and employs one of the control commands obtained in the current control cycle. While the sub-controllers S1 and S2 calculate the control command once, the main controllers M1 and M2 calculate the control command a plurality of times, and the control commands to be compared are those that the main controllers M1 and M2 have obtained in the past. Is. On the other hand, the control command to be adopted in the control of each damper FD, RD needs to be the latest control command required by the main controllers M1, M2, and the control command to be adopted in the control of each damper FD, RD. Is a control command obtained by the main controllers M1 and M2 in the current control cycle. Therefore, as described above, one of the control commands obtained by the main controllers M1 and M2 in the current control cycle is adopted. Then, based on the adopted control command, the main controllers M1 and M2 output the PWM command, and the drive circuit 49 supplies the drive current to the solenoid of the control valve V to control the pressure side damping force of the dampers FD and RD. To do. When all the controllers M1, M2, S1, S2 are diagnosed as normal, the sub-controllers S1, S2 do not output the PWM command to the drive circuit 50 and do not participate in the control of the dampers FD, RD. In comparing control commands, if only complete matching of control commands is regarded as matching, the control command selected for controlling each damper FD, RD is the control command selected by any main controller M1, M2. However, in selecting the control command, it may be determined in advance whether to select the control command output from one of the main controllers M1 and M2, or may be selected arbitrarily each time. When comparing control commands, if the deviation between control commands, or the average value of all control commands and the deviation between control commands is within an allowable value (threshold value), it is determined that the control commands match. , The average value of the two control commands of the main controllers M1 and M2 may be used as the control command used for controlling the dampers FD and RD, but it is determined that one of the main controllers M1 and M2 has priority. Good.

As a result of the comparison of the control commands, one of the four control commands is different, and a case will be described in which the two main controllers M1 and M2 output the control commands that match each other. In this case, both the main controllers M1 and M2 are normal, and the controller that outputs the control command of a different value among the sub-controllers S1 and S2 is diagnosed to be abnormal. Since the main controllers M1 and M2 are normal, the sub-controllers S1 and S2 can rely on the main controllers M1 and M2 to control the dampers FD and RD. No output is performed and the output current is set to 0. Since the main controllers M1 and M2 are normal, the main controllers M1 and M2 adopt one of the latest control commands obtained by the main controllers M1 and M2 until the next control command comparison, and generate the PWM command. To do. Then, the main controllers M1 and M2 output the generated PWM command to the drive circuit 49, and the drive circuit 49 supplies the drive current to the coil Co1 of the control valve V to control the pressure side damping force of the dampers FD and RD. To be done. Both the sub-controllers S1 and S2 do not output the PWM command to the drive circuit 50 and are not involved in the control of the dampers FD and RD, whether they are normal or abnormal. Note that, of the sub-controllers S1 and S2, the controller diagnosed as abnormal participates in the calculation of the control command and the comparison of the control command when it is recognized as normal in the simulated calculation process executed in the subsequent control cycle.

One of the four control commands is different, and one of the two main controllers M1 and M2 and the control command output from the two sub-controllers S1 and S2 are the same, and the other of the two main controllers M1 and M2 is the same. A case in which only the control command is different will be described. In this case, the other one of the main controllers M1 and M2 that outputs a different control command is diagnosed as an abnormality because the calculation of the control command has failed. Then, the normal one of the main controllers M1 and M2 adopts the latest control command output by itself to generate a PWM command and outputs the PWM command to the drive circuit 49. On the other hand, the other abnormal one of the main controllers M1 and M2 is in the control command calculation failure state, and therefore controls the damper FD or the damper RD based on the control command output from the normal main controller. For example, when the main controller M1 in the first control unit U1 fails the control command calculation and is diagnosed as abnormal, the first control unit U1 determines whether the first controller M1 of the second control unit U2 has the first control command. The front wheel side damper FD to be controlled by the control unit U1 is controlled. In this case, since the sub controller S1 is normal, the PWM command is generated based on the control command output from the normal main controller M2 of the second control unit U2 instead of the main controller M1, and the front wheel side damper is generated. Control the FD. In the second control unit U2, since the main controller M2 is normal, the main controller M2 controls the rear wheel damper RD to be controlled based on the latest control command, and the sub controller S2 outputs from the output port 33. The current is zero. Note that, of the main controllers M1 and M2, the main controller that is diagnosed as abnormal returns to the comparison of the next control command calculation if it is recognized as normal in the simulated calculation processing executed in the subsequent control cycle, but until then. The control command is not calculated and output every cycle. That is, of the main controllers M1 and M2, the one in the control command calculation failure state is adjusted to the cycle of the sub-controllers S1 and S2 to be the target of the next control command comparison, even if it is recognized as normal by the simulation calculation process. The operation returns to the calculation of the control command, but until then, the control command is not calculated and output in every cycle, and the process waits. Therefore, while the abnormal one of the main controllers M1 and M2 does not perform the control command calculation and output and stands by, only the other normal one of the main controllers M1 and M2 calculates the control command and outputs this control command. Utilizing each control unit U1, U2 controls the dampers FD, RD. If one of the main controllers M1 and M2 remains in the control command calculation failure state for the specified number of times or more, the controller in the failure state may be determined to be in an abnormal state and may be permanently stopped.

Next, as a result of the comparison of the control commands, two control commands out of the four control commands are matched, and two other control commands are different from the control commands matched at different values. To do. First, when the two main controllers M1 and M2 both output control commands that match, the main controllers M1 and M2 are diagnosed as normal, and the sub-controllers S1 and S2 that output different control attitudes are both abnormal. Is diagnosed with. Since the main controllers M1 and M2 are normal, the sub-controllers S1 and S2 do not output the PWM command based on the control command from the output port 33 and set the output current to 0. Since the main controllers M1 and M2 are normal, the main controllers M1 and M2 use any of the latest control commands obtained by the main controllers M1 and M2 to generate the PWM command. Then, the main controllers M1 and M2 output the generated PWM command to the drive circuit 49, and the drive circuit 49 supplies the drive current to the solenoid of the control valve V to control the pressure side damping force of the dampers FD and RD. It Since both of the sub-controllers S1 and S2 are recognized to be abnormal, neither of them outputs the PWM command to the drive circuit 50 and does not participate in the control of the dampers FD and RD. The sub-controllers S1 and S2 diagnosed as abnormal participate in the calculation of the control command and the comparison of the control command when it is recognized as normal in the simulated calculation process executed in the subsequent control cycle.

As a result of the comparison of the control commands, two matching control commands out of the four control commands are output in one of the main controllers M1 and M2 and one of the sub-controllers S1 and S2. Is treated as. In this case, of the main controllers M1 and M2, the main controller that outputs a matching control command is normal, and the main controller that outputs a non-matching control command is diagnosed as abnormal. The main controller of the main controllers M1 and M2 that is diagnosed as abnormal is recognized as being in the control command calculation failure state. Of the main controllers M1 and M2, the main controller that is diagnosed as abnormal returns to the comparison of the next control command calculation when it is recognized as normal in the simulated calculation processing executed in the subsequent control cycle, but until that time Do not calculate or output control commands. That is, of the main controllers M1 and M2, the one in the control command calculation failure state returns to the calculation of the control command according to the cycle of the sub-controllers S1 and S2 which is the target of the next control command comparison. Until that time, the control command is not calculated and output in every cycle, and the process waits. Therefore, while the abnormal one of the main controllers M1 and M2 does not perform the control command calculation and stands by, only the normal other of the main controllers M1 and M2 calculates the control command and uses this control command. The control units U1 and U2 control the dampers FD and RD. The controller of the sub-controllers S1 and S2 that has been diagnosed as abnormal participates in the calculation of the control command and the comparison of the control command when it is recognized as normal in the simulated calculation process executed in the subsequent control cycle. If one of the main controllers M1 and M2 remains in the control command calculation failure state for the specified number of times or more, the controller in the failure state may be determined to be in an abnormal state and may be permanently stopped.

As a result of the comparison of the control commands, the case where the two matching control commands out of the four control commands are the sub-controllers S1 and S2 are processed as follows. In this case, both the main controllers M1 and M2 are in an abnormal state and are in a control command calculation failure state. The main controllers M1 and M2 that have been diagnosed as abnormal return to the next comparison of the control command calculations if they are found to be normal in the simulated calculation process executed in the subsequent control cycles. Do not calculate and output. In this case, since both the main controllers M1 and M2 are in a control command calculation failure state, even if normal operation is recognized in the simulation calculation process, the main controller M1 and M2 will be operated until the next calculation of the control command to be compared with the control command. Standby without performing cycle control command calculation and output. Therefore, while both the main controllers M1 and M2 are on standby without performing the control command calculation, the control commands from the sub-controllers S1 and S2, which are majority just before or just before the diagnosis of abnormality, are used. To control the dampers FD and RD. Even in this case, since the main controllers M1 and M2 control the dampers FD and RD using the control command within 10 milliseconds which is the calculation cycle of the sub controllers S1 and S2, the control can be continued. If the control command calculation failure state of both the main controllers M1 and M2 continues for a specified number of times or more, both of them may be determined to be out of order and may be permanently stopped. The specified number of times as a guide for permanently stopping the main controllers M1 and M2 may be set arbitrarily.

Further, as a result of the comparison of the control commands, there will be described a case in which there are two matched control commands and two control commands that match each other with different values. In this case, since there are two matching control commands, it is not clear which control command is correct depending on the majority decision. That is, in this case, even if the control commands are compared, it cannot be determined which control command is correct, and the control command calculation cannot be confirmed. Therefore, it is not known which of the main controllers M1 and M2 and the sub-controllers S1 and S2 has an abnormality. Therefore, it is not possible to recognize which of the main controllers M1 and M2 and the sub-controllers S1 and S2 has the correct control command, and it is unclear whether the dampers FD and RD can be controlled normally. Therefore, in this control command calculation unconfirmable state, each controller M1, M2, S1, S2 returns to the comparison of the next control command calculation when it is recognized as normal by the simulation calculation process executed in the subsequent control cycle. Until then, it waits without calculating or controlling the control command for each cycle. In this case, since both the main controllers M1 and M2 may be abnormal, the control command calculation is not performed, and it is not preferable to execute the control because the correct control command is unknown. During the period, the output current is set to 0, or the control command value recognized as correct at the time point when the control commands are compared 10 milliseconds before the operation cycle of the sub-controllers S1 and S2 is maintained. In such a control command calculation unconfirmable state, the output current may be output with a constant value such as an intermediate value. Even in this case, since the time during which the main controllers M1 and M2 do not control the dampers FD and RD is 10 milliseconds, there is no problem. However, when the comparison result of the control commands is, for example, 10 times in a row in which the control command calculation cannot be confirmed, it is not preferable to further control the dampers FD and RD. In such a situation, the PWM command for setting the duty ratio to 0 is output from the output ports 23 and 33 with the control command values of all the controllers M1, M2, S1 and S2 set to 0. In this example, if the control command calculation cannot be confirmed 10 times in a row, it is determined that the front wheel side damper FD and the rear wheel side damper RD cannot be controlled appropriately, and the controller M1, M2, S1, S2 is simulated. An alarm signal is output from the controller, which is determined to be normal by calculation, to the alarm device K via the in-vehicle network N. Upon receiving the alarm signal, the alarm device K turns on an alarm lamp and outputs an alarm sound from a speaker to urge the driver of the two-wheeled vehicle to stop traveling. The number of consecutive control command calculation unconfirmable states, which is a criterion for diagnosing a control failure, can be arbitrarily determined. However, in this example, if 10 consecutive times, the calculation failure state continues for 0.1 seconds, so control is stopped. I am trying to let you.

Next, a case will be described in which the control commands output from the four controllers M1, M2, S1, and S2 are different as a result of the comparison of the control commands. In this case, it is not known which control command is correct depending on the majority decision because all the control commands are scattered. That is, even in this case, it is impossible to determine which control command is correct by comparing the control commands, and the control command calculation cannot be confirmed. Therefore, it is not known which of the main controllers M1 and M2 and the sub-controllers S1 and S2 has an abnormality. Therefore, it is not possible to recognize which of the main controllers M1 and M2 and the sub-controllers S1 and S2 has the correct control command, and it is unclear whether the dampers FD and RD can be controlled normally. Therefore, even in this case, when the control command calculation cannot be confirmed, each controller M1, M2, S1, S2 is compared with the next control command calculation when it is recognized as normal by the simulation calculation process executed in the subsequent control cycle. It returns, but until then it waits without calculating or controlling the control commands for each cycle. In this case, since both the main controllers M1 and M2 may be abnormal, the control command calculation is not performed, and it is not preferable to execute the control because the correct control command is unknown. During this period, the output current is set to 0, or the control command value which is recognized as correct when the control commands are compared 10 milliseconds before is maintained. In such a control command calculation unconfirmable state, the output current may be output with a constant value such as an intermediate value. Even in this case, there is no problem because the time during which the main controllers M1 and M2 are not controlled is 10 milliseconds. In this example, if the control command calculation cannot be confirmed 10 times in a row, it is determined that the front wheel side damper FD and the rear wheel side damper RD cannot be controlled appropriately, and the controller M1, M2, S1, S2 is simulated. An alarm signal is output from the controller, which is determined to be normal by calculation, to the alarm device K via the in-vehicle network N. Upon receiving the alarm signal, the alarm device K turns on an alarm lamp and outputs an alarm sound from a speaker to urge the driver of the two-wheeled vehicle to stop traveling. Although the number of consecutive control command calculation unconfirmable states, which is a criterion for diagnosing a control failure, can be arbitrarily determined, in this example, if 10 consecutive times, the control command calculation unconfirmable state continues for 0.1 seconds, I'm trying to stop.

In the above description, the abnormality of each of the controllers M1, M2, S1, S2 is diagnosed by comparing the control commands. However, for example, the target torque τ and the target pressure Pf ^* that should be obtained before the PWM commands If, Ir are obtained ^. , Pr ^* may be the comparison target for abnormality diagnosis. That is, the abnormality diagnosis may be performed by comparing the results of some of various calculations executed in the process of obtaining the control command with the comparison target.

Further, the comparison of the control commands of the four controllers M1, M2, S1, S2 is performed once every time the main controllers M1, M2 calculate the control commands a plurality of times. That is, since the main controllers M1 and M2 calculate the control command for each control command, the main controllers M1 and M2 calculate the control command a plurality of times during the control command comparison cycle. Therefore, when the control commands output from the main controllers M1 and M2 are different before the control commands are compared, the dampers FD and RD are controlled by using the latest matching control command of the past control commands of the both controllers. You may control. In this way, fail-safe is realized, and even before the comparison of the control commands is performed, it is possible to detect an abnormality in the main controllers M1 and M2 and appropriately control the dampers FD and RD.

Returning to this, when the comparison of the control commands is completed, in the state where the front wheel side damper FD and the rear wheel side damper RD can be controlled, the first wheel control unit U1 and the second wheel control unit U2 actually correspond to the front wheel side damper FD and the second wheel control unit U2. The rear wheel side damper RD is controlled. Specifically, the controller selected from the controllers M1 and M2 and the sub-controllers S1 and S2 in each case described above supplies current to one of the coils Co1 and Co2 of the control valve V to control the dampers FD and RD. Is executed. The amount of current supplied to the coil Co1 (Co2) is detected by the current sensors 5(5') and 6(6') and can be monitored by the first control unit U1 and the second control unit U2. There is. Further, the main controllers M1 and M2 and the sub-controllers S1 and S2 are, as described above in this example, the current sensors 5(5') and 6(6') provided in the dampers FD and RD to be controlled by themselves. The current amount detected in () is fed back to control the current amount of the coil Co1 (Co2). The main controllers M1 and M2 and the sub-controllers S1 and S2 are driven when the deviation between the target currents if ^* and ir ^* and the detected current amount always exceeds an abnormality threshold for determining a predetermined abnormality for a certain period of time. One of the control systems of the circuits 49 and 50 that is in control is diagnosed as abnormal. The abnormal threshold value is set to such a value that the target currents if ^* , ir ^* and the control deviation between the current amounts detected by the current sensors 5(5′) and 6(6′) cannot be in a state where normal control can be performed. By the feedback control, the actual currents should follow the target currents if ^* and ir ^* , but if they do not follow even after a certain period of time, an abnormality is diagnosed. Such a state may be due to an abnormality in the drive circuits 49 and 50 themselves, or to the controllers M1, M2, S1 and S2, the coils Co1 and Co2 that output a PWM command to the drive circuits 49 and 50, or the wiring that connects them. There is an abnormality. For example, if an abnormality is recognized while current is being supplied from the drive circuit 49, there is an abnormality in the drive circuit 49 and the control system of the main controller M1 (M2) or the coil Co1 that outputs a PWM signal to the drive circuit 49. Both the controller itself that controls the control valve V and the paired controller perform the abnormality diagnosis. Specifically, for example, when the main controller M1 controls the control valve V in the first control unit U1, the main controller M1 and the sub controller S1 monitor the amount of current detected by the current sensor 5 and the target current if ^* . Then, the abnormality is diagnosed. In the second control unit U2, when the main controller M2 controls the control valve V, the main controller M2 and the sub controller S2 monitor the amount of current detected by the current sensor 6 and the target current ir ^* to perform abnormality diagnosis. To do. Therefore, in the control device 1 of the present embodiment, it is possible to diagnose an abnormality in the current control system, and even if one of the control systems has an abnormality, the other control system is used to perform control. I can continue. Note that, when performing abnormality diagnosis of the controller that is controlling the control valve V, if the pair of controllers is abnormal as a result of simulation calculation processing or comparison of control commands, the controller that is controlling the control valve V drives the drive circuit 49. , 50 abnormality diagnosis should be performed. Since the controller that is controlling the control valve V recognizes the current value, abnormality diagnosis can be easily performed.

As described above, when the drive circuits 49 and 50 have an abnormality, when the controllers M1, M2, S1 and S2 cannot normally output the PWM command to the drive circuits 49 and 50, or when the coils Co1 and Co2 are broken, The control capability is poor, and the corresponding system on the controller side cannot control the dampers FD and RD any more. Therefore, when the control capability malfunction occurs, the PWM command is output to the drive circuits 49 and 50 that supply current to the coils Co1 and Co2 of the control valve V of the main controllers M1 and M2 and the sub-controllers S1 and S2. It is not preferable that the controller continuously outputs the PWM command. Therefore, of the controllers M1, M2, S1, S2, the controller that outputs the PWM command when the control capability malfunction occurs outputs an error code to the other controllers. That is, among the controllers M1, M2, S1, S2, the controller of the system including the drive circuits 49, 50 in which an abnormality is recognized outputs the error code. However, when this controller itself is abnormal and cannot output the error code, the controller paired with this controller in the control units U1 and U2 outputs the error code instead. The other controllers receiving the error code ignore the controller in which the abnormality is recognized by the error code, and continue the control only by the controller having no abnormality. Specifically, for example, when an abnormality is recognized in the system of the sub controller S1 that supplies the PWM command to the drive circuit 50 in the first control unit U1, the sub controller S1 issues an error code. Further, in this case, when the sub controller S1 cannot issue the error code due to some kind of failure, the paired main controller M1 instead outputs the error code because the drive circuit 50 has an abnormality. The sub-controller S1 does not perform control command calculation and PWM command generation and output until the power supply to the first control unit U1 and the second control unit U2 is stopped after the next control cycle. Therefore, after the next control cycle, if the vehicle is stopped and the control device 1 is not restarted, only the main controllers M1 and M2 and the sub controller S2 calculate the control command and control command unless the control device 1 is restarted. Make a comparison. Even if one controller is abnormal, if the three controllers are functioning normally, the correct control command can be obtained by the majority vote, so that the abnormality diagnosis can be continued by comparing the control commands. However, since one controller is abnormal, even in such a case, an alarm signal is output from the controllers M1, M2, S1, S2 to the alarm device K via the in-vehicle network N in order to prompt the vehicle to stop.

If control system malfunction is found in both the main controller M1 system and the sub-controller S1 system of the first control unit U1, the front wheel side damper FD cannot be controlled normally. When an error code is output from both the main controller M1 and the sub-controller S1, the entire first control unit U1 is malfunctioning, so the normal controller M2, S2 sends an alarm signal to the alarm device K via the in-vehicle network N. Is output to prompt the vehicle driver to make an emergency stop. When the control capability malfunction is recognized in both the main controller M2 system and the sub controller S2 system in the second control unit U2, the second control unit U2 also takes the same measures as the first control unit U1.

Furthermore, in this embodiment, since the pressure sensors 3 and 4 are provided, the pressure of the pressure side chamber R2 can be detected as the first control target information regarding the dampers FD and RD that are control targets. Further, the valve opening pressure of the control valve V can be adjusted by the amount of current applied to the coils Co1 and Co2. Therefore, when the expansion and contraction speeds of the dampers FD and RD are low, the pressure of the pressure side chamber R2 is estimated from the amount of current detected by the current sensors 5 and 6 as the second control target information regarding the dampers FD and RD that are control targets. it can. Therefore, there is a large discrepancy between the pressure of the pressure side chamber R2 as the second control target information obtained from the current amount of the current sensor 5 and the pressure of the pressure side chamber R2 as the first control target information detected by the pressure sensors 3 and 4. It is possible to diagnose that there is some abnormality in the entire system of the control device 1. That is, the abnormality of the entire system of the control device 1 including the sensors 3, 4, 5, 6 and the dampers FD and RD can be detected. When the expansion/contraction speed of each damper FD, RD is low, the pressure of the pressure side chamber R2 of each damper FD, RD can be estimated from the amount of current detected by the current sensors 5, 6, so this pressure can be applied to each damper FD, RD. The damping force on the compression side can be estimated. Furthermore, the damping force on the pressure side of each damper FD, RD can be obtained from the pressure of the pressure side chamber R2 detected by the pressure sensors 3 and 4. Therefore, the first controlled object information and the second controlled object information may be the damping force on the pressure side of each damper FD, RD. Further, for example, a G sensor for detecting the vertical acceleration of the vehicle body B, the front wheels FW, and the rear wheels RW is provided, and the vertical acceleration of the vehicle body B and the vertical accelerations of the front and rear wheels FW, RW obtained from these sensors are integrated. Then, the expansion/contraction speed of each damper FD, RD is obtained. The expansion/contraction speed and damping force characteristics of the dampers FD and RD tend to be close to a proportional relationship when the expansion/contraction speed is high. The damping force on the pressure side of the dampers FD and RD is obtained from this expansion/contraction speed and used as the first control target information. Further, the damping force on the pressure side of each of the dampers FD and RD can be estimated from the pressure of the pressure side chamber R2 detected by the pressure sensors 3 and 4, and this is used as second control target information. If the first control target information and the second control target information are compared and there is a large discrepancy between them, it can be diagnosed that there is some abnormality in the entire system of the control device 1. That is, if two kinds of information of the same kind regarding the control target (in this case, the dampers FD and RD) are obtained from the information detected by different sensors, and comparing these information as the first control target information and the second control target information, Can perform abnormality diagnosis. That is, the first control target information and the second control target information may be information detected by different sensors or the same type of information obtained by calculation from this information. In addition, when it is necessary to use a plurality of sensors together to obtain the first control target information and the second control target information, the sensor group and the second control target information used to obtain the first control target information are It is only necessary that all of the sensors used to obtain them match. That is, it is not prevented that a part of the sensor groups described above coincide with each other. When a clear abnormality is recognized by such a procedure, an error code is output from the controllers M1, M2, S1 and S2, and when it can be determined that the details of the failure pose a danger to the driver, an alarm signal is issued to the alarm device K. To prompt the driver of the motorcycle to stop traveling.

The recorder 63 has a memory (not shown) and records the error code when the error code is output as described above. The first control unit U1 and the second control unit U2 also output the same information to the in-vehicle network N when communicating via the main signal line 51. The recorder 63 records a part of mutual communication contents of the first control unit U1 and the second control unit U2 other than the error code through the signal line 57 and the in-vehicle network N. As described above, even if one or both of the recorder 63 , the first control unit U1, and the second control unit U2 are directly connected by a signal line to enable communication such as Ethernet (registered trademark) or CAN communication. Good. In that case, communication is ensured even if one of the in-vehicle network N and the signal line becomes unusable. Further, the recorder 63 may be integrated with an in-vehicle information collecting device such as a drive recorder. When the communication with the wireless communication device 54 and the mobile terminal 55 is established, the recording device 63 takes advantage of the opportunity to send the error code to the outside through the Internet communication network 56 and the first control unit U1 and the second control. The contents of mutual communication between the units U2 are transmitted. The error code and the like transmitted in this way are received and accumulated in a server (not shown) of the suspension manufacturer, for example. When a unique number such as the serial number of the control device 1 is transmitted together with the information such as the error code, the suspension manufacturer can identify the control device 1 and the same abnormality may occur in the manufacturing lot. It will be possible for the suspension manufacturer to notify the vehicle owner. Also, suspension manufacturers can analyze the cause of abnormalities by accumulating error codes, etc., and can take countermeasures in a timely manner. In addition to the error code output date and time, the information transmitted by the recorder 53 can be transmitted to the suspension manufacturer if the vehicle or the mobile terminal 55 is equipped with a device capable of acquiring the positional information. Since the position information is information relating to privacy, it is preferable that the vehicle occupant can select whether or not to transmit. The wireless communication device 54 may be one that can directly access the Internet communication network 56 without using the mobile terminal 55. In that case, communication with the outside can be performed without using the mobile terminal 55.

In addition to the above-mentioned abnormality diagnosis, a watchdog timer for monitoring each controller M1, M2, S1, S2 is provided to periodically check whether each controller M1, M2, S1, S2 is operating normally. Alternatively, the controller having the abnormality may be stopped.

The operation of the main controllers M1 and M2 and the sub-controllers S1 and S2 will be described with reference to the state transition diagrams of FIGS. As shown in FIG. 5, if the main controller M1 (M2) is normal, the main controller M1 (M2) always functions as a primary controller that executes the control of preferentially supplying the current to the coil Co1 of the control valve V (state ST1). .. Then, when the main controller M1 (M2) is defeated by the majority decision of the simulation calculation result, the state shifts to the state ST2. This state is a state in which the computing capacity is not good. Then, in the state ST2, the main controller M1 (M2) sets the current output to 0, shifts to the state ST1 in the next control cycle, returns to the control, and participates in the simulation calculation, but maintains the current output 0 until then. To do. Further, when the main controllers M1 and M2 are defeated by the majority decision of the comparison of the control commands, the main controllers M1 and M2 shift to the state ST3. The main controller M1 (M2) that has transitioned to the state ST3 is in a control command calculation failure state. The main controller M1 (M2) in the state TS3 sets the output current to 0. The main controller M1 (M2) in the state TS3 participates in the comparison calculation of the next control command and shifts to the state ST1 when winning the majority decision.

Subsequently, when the control commands cannot be determined to be correct by comparing the control commands, that is, when the control command calculation cannot be confirmed, the main controllers M1 and M2 shift to the state ST4. In this state ST4, the control command calculation cannot be confirmed. In this state ST4, the main controllers M1 and M2 return to the comparison of the next control command calculation, but do not calculate the control command until then, when the simulation calculation process executed in the subsequent control cycle is found to be normal. stand by. In this control command calculation unconfirmable state, both of the main controllers M1 and M2 may be abnormal. Therefore, it is not preferable to execute the control command calculation and to execute the control because the correct control command is unknown. Therefore, the output current is set to 0 during standby. However, if the comparison result of the control commands indicates that the control command calculation cannot be confirmed 10 times in a row, it is not preferable to further control the dampers FD and RD. Therefore, as a result of the comparison of the control commands, if the control command calculation inability cannot be confirmed 10 times in a row, the state shifts to the state ST5, and the output currents from all the controllers M1, M2, S1, S2 to the drive circuits 49, 50 are 0. And stop control. This state is maintained until the control device 1 is restarted. It should be noted that the restart of the control device 1 is executed when the ignition of the vehicle is turned on from off. Further, if the control system of the main controllers M1 and M2 is out of order, the state shifts to the state ST6 in which the control capability is out of order, and the main controllers M1 and M2 set the output current to 0, but the control command calculation continues. .. Then, in this state ST6, the control capability of the control system of the sub-controllers S1 and S2, which is a pair, also becomes unsuccessful, and all the controllers M1 and S1 of the first control unit U1 or all the controllers M2 and S2 of the second control unit U2. Shifts to the control state ST7, the state shifts to state ST7. In this state ST7, an error code is output from the unit having no malfunction of the first control unit U1 or the second control unit U2, the power is turned off, the function is stopped, and the control is stopped. This state is maintained until the control device 1 is restarted.

As shown in FIG. 6, when the paired main controller M1 (M2) is normal, the sub-controller S1 (S2) does not execute the control of preferentially supplying the current to the coil Co1 of the control valve V. , And functions as a secondary controller (state ST11). Then, when the sub-controller S1 (S2) is defeated by the majority decision of the simulation calculation result, the sub-controller S1 (S2) shifts to the state ST12 in which the calculation capacity is in a disabling state, sets the current output to 0, and returns to the control in the next control cycle to perform the simulation calculation. Keep that state until you join. Subsequently, when the main controller M1 (M2) is defeated by the majority result of the simulation calculation result or the control command, the sub-controller S1 (S2) paired by shifting to the state ST13 is a primary controller that executes the control of the control valve V. Function. The sub-controller S1 (S2) transitions to the state ST11 when the paired main controller M1 (M2) is in a normal state as a result of the simulation calculation result or the comparison of the control commands, and switches the role from the primary controller to the secondary controller. .. The sub-controller S1 (S2) maintains the state of the state ST13 and functions as a primary controller when the paired main controller M1 (M2) is abnormal as a result of the simulation calculation result or the comparison of the control commands. Further, if the sub-controller S1 (S2) is the primary controller and loses the majority decision of the simulation calculation result, the sub-controller S1 (S2) and the paired main controller M1 (M2) will be in a state of malfunction, so the state shifts to the state ST14. Error code is output. Further, when the control system of the sub controller S1 (S2) is out of order, it is determined that the control capability is out of order, and the state shifts to state ST15. The sub controller S1 (S2) sets the output current to 0 and stops the control. This state is maintained until the control device 1 is restarted. In the state of this state ST15, the control capability of the control system of the main controllers M1 and M2 forming a pair also becomes unsuccessful, and all the controllers M1 and S1 of the first control unit U1 or all the controllers M2 and S2 of the second control unit U2. Shifts to the state ST16 when the control ability becomes sick. In this state ST16, an error code is output from the unit that is not out of order among the first control unit U1 or the second control unit U2, the power is turned off, the function is stopped, and the control is stopped. This state is maintained until the control device 1 is restarted.

As described above, in the control device 1 of the present invention, the first control unit U1 and the second control unit U2 are respectively provided with the main controllers M1 and M2 and the sub-controllers S1 and S2 as a pair. Therefore, even if some of the controllers M1, M2, S1, S2 fall into a malfunction, the control target can be controlled, so that the control of the control target can be continued to exhibit the fault tolerance function. Further, even for some sensor values and estimated values, control can be performed by adopting a correct control command by majority voting, so that robust control is possible without being easily affected by noise and the like. Furthermore, since it is possible to control by adopting the correct control command by majority decision, it is not necessary to grasp all the abnormal patterns and judge whether they correspond to the abnormal patterns to recognize the abnormalities. Even if the error occurs, control can be performed with a correct control command.

Each of the first control unit U1 and the second control unit U2 is designed to directly control the controlled object, and the central processor is not required. In addition, since the sub-controller S1 (S2) has a low calculation processing capability with respect to the main controller M1 (M2), an inexpensive microcomputer can be used for the sub-controller S1 (S2) and the controller 1 The entire system can be constructed inexpensively.

The first control unit U1 and the second control unit U2 are both connected to the vehicle-mounted network N, and the information flowing on the vehicle-mounted network N and the information detected by the rate sensor 2 are the first control unit U1 and the second control unit U2. It is input to both of the control units U2. Therefore, even if one of the first control unit U1 and the second control unit U2 is disconnected from the vehicle-mounted network N, the first control unit U1 and the second control unit U2 can communicate with each other and control the control target. You can continue without interruption.

Further, since the first control unit U1 and the second control unit U2 are provided with the spare battery SB, the control of the controlled object can be continued even if the power supply from the power source (not shown) of the vehicle is interrupted.

Further, in the control device 1, the sub-controllers S1 and S2 each having a low calculation capability calculate a control command based on the same information as the main controllers M1 and M2 at a calculation speed lower than the calculation speed of the main controllers M1 and M2. Therefore, the abnormality diagnosis is performed by comparing the calculation results. Therefore, even if an inexpensive microcomputer is used for the sub-controllers S1 and S2, the abnormality diagnosis can be reasonably performed and the fault tolerance can be realized.

It should be noted that the sub-controllers S1 and S2 perform a part of the arithmetic processing for the main controllers M1 and M2 to obtain a control command based on the same information, and the main controllers M1 and M2 perform a part of the arithmetic processing. When performing an abnormality diagnosis by comparing the obtained calculation result with the calculation result of each sub-controller S1, S2, the above-mentioned calculation result is obtained in a time shorter than the time required for the sub-controllers S1, S2 to calculate the control command. Therefore, the frequency of abnormality diagnosis per unit time can be increased, and the abnormality diagnosis can be performed closely.

The pressure of the pressure side chamber R2 of the damper FD (RD) as the first control target information regarding the damper FD (RD) which is the control target detected by the pressure sensor 3 (4), and includes a plurality of sensors 3, 4, 5, 6. And the pressure of the pressure side chamber R2 of the damper FD (RD) as the second control target information of the same type, which is obtained from the amount of current detected by the current sensor 5 (6), to further diagnose the abnormality. Therefore, the abnormality of the entire system of the control device 1 including the hydraulic system can be diagnosed. The first control target information and the second control target information of the same type as the first control target information may be information on the control target and are not limited to the embodiments.

Further, in the present embodiment, the main signal line 51 connecting the first control unit U1 and the second control unit U2 is provided with the cable 51a (51b) in which the communication line is n-folded. In comparison with the case of connecting with, the amount of data communication can be transferred n times per unit time, and high-speed communication is possible. The main signal line 51 includes two cables 51a and 51b, and the first control unit U1 and the second control unit U2 can communicate by selecting either of the cables 51a and 51b by switching the relays 41d and 41e. Therefore, even if one of them is disconnected, communication can be secured. Furthermore, as described above, the relay 41d and the relay 41e have the opposite opening/closing operation due to the power supply, so that even if the power supply is interrupted, the communication between the first control unit U1 and the second control unit U2 must be performed. It can be secured.

In addition, in the control device 1 of the present embodiment, the recorder 63 records an error code and can transmit the error code to the outside. Therefore, the cause of the abnormality can be analyzed by analyzing the error code, which is convenient. Further, since the error code can be transmitted to the suspension maker, it is possible for the suspension maker to analyze the error code and not only take measures such as preventive measures against abnormalities in the control device 1 It is possible to promptly notify the owner of the vehicle equipped with the control device 1 that may cause such a problem such as recommending refraining from using the vehicle.

In the above description, the control objects of the control device 1 are the dampers FD and RD, but a steering damper that can adjust the damping force that suppresses the vibration of the steering wheel of the vehicle, a hydraulic pump, and a jack that adjusts the vehicle height by an electric actuator. When a device is provided, one or both of the steering damper and the jack device may be controlled in addition to or instead of the dampers FD and RD. In that case, the main controllers M1 and M2 and the sub-controllers S1 and S2 together control all control commands of the control commands to the dampers FD and RD, the control commands to the steering damper, and the control commands of the jack device, or the control commands that are arbitrarily selected. The arithmetic processing may be performed, and the abnormality result may be diagnosed by making a majority decision on the result of the arithmetic operation based on the comparison as described above. Of course, instead of comparing all the control commands, a part of the calculation results of the calculation process may be compared for all the control commands to perform the abnormality diagnosis.

<Second embodiment>
Next, the control device 101 according to the second embodiment shown in FIG. 7 will be described. As shown in FIG. 7, the control device 101 according to the second embodiment includes a first control unit U11, a second control unit U12 provided separately from the first control unit U11, and three sub control units SU1 and SU2. , SU3. In the present embodiment, as shown in FIG. 7, the four dampers D1, D2, D3, D4 of a four-wheeled vehicle and the motor M that generates an auxiliary torque for assisting the driver's operation of the steering wheel SW of the vehicle are provided. It is used as a control device to control.

As shown in FIG. 7, in this example, the control device 101 applies auxiliary torque to the four dampers D1, D2, D3 and D4, which are interposed between the vehicle body VB of the automobile and the wheels W, and the steering wheel SW. The motor M is controlled. Although not shown in detail, the dampers D1, D2, D3, and D4 include a cylinder, a piston that is slidably inserted into the cylinder and divides the cylinder into a liquid-filled expansion side chamber and a compression side chamber, and a cylinder inside. Piston rod that is movably inserted into the piston and connected to the piston, a passage that connects the expansion side chamber and the compression side chamber, and a damping force variable valve that is provided in the middle of the passage and that resists the flow of liquid passing through the passage. And V1. The control device 101 can change the resistance given to the flow of the liquid by the damping force variable valve V1 and can control the damping force generated when the dampers D1, D2, D3 and D4 expand and contract. The damping force variable valve V1 is, for example, an electromagnetic valve using a solenoid. In addition, as long as the control device 101 can control the damping force of the dampers D1, D2, D3, D4, the configuration is not limited to the above-described configuration, and various types of dampers can be used. Therefore, even in the dampers D1, D2, D3, and D4 that are the control targets of the control device 101 in the second embodiment, the electrorheological fluid or the magnetorheological fluid is used as the liquid, and the voltage applied to the fluid passing through the passage. Alternatively, a device capable of adjusting the magnetic field may be incorporated to control the damping force.

The control device 101 also includes stroke sensors SFR, SFL, SRR, and SRL that detect strokes of the dampers D1, D2, D3, and D4, and four accelerations that detect vertical acceleration immediately above each wheel W of the vehicle body VB. The sensors GFR, GFL, GRR, GRL and the current sensors CFR, CFL, CRR, CRL for detecting the currents of the coils Co3, Co4 in the solenoid of the damping force variable valve V1 are connected. Then, the control device 101 controls the dampers D1, D2, D3, D4 based on the strokes of the dampers D1, D2, D3, D4 and the sprung acceleration, which is the vertical acceleration immediately above each wheel W of the vehicle body VB. Calculate the target damping force. The solenoid of the damping force variable valve V1 is provided with two coils Co3 and Co4 that form a double winding, and even if current is supplied to any of them, the same operation is performed according to the amount of current and the liquid flows. The resistance given is changed. Then, the control device 101 obtains, as a control command, a target current instructing the amount of current given to the coils Co3 and Co4 in the solenoid of the damping force variable valve V1 according to this target damping force. Further, the control device 101 feedback-controls the amount of current flowing through the coils Co3 and Co4 detected by the current sensors CFR, CFL, CRR, and CRL to adjust the resistance of the damping force variable valve V1 and to adjust the dampers D1 and D2. , D3, D4 are controlled. Although four acceleration sensors GFR, GFL, GRR, and GRL are provided to detect the accelerations directly above the four wheels W, the vehicle body VB is regarded as a rigid body, and the accelerations obtained from the three acceleration sensors are used. The remaining acceleration to be provided can be estimated. That is, when the three acceleration sensors are installed on the vehicle body VB directly above the three wheels W and the acceleration is detected, the acceleration of the vehicle body VB immediately above the wheel W without the acceleration sensor can be estimated. Further, the acceleration sensor can be installed at a position other than the position of the vehicle body VB immediately above the wheel W, and if the three acceleration sensors are not arranged in the same straight line on the vehicle body VB, the acceleration sensor detects acceleration. The acceleration directly above the four wheels W can be estimated.

In the motor M, the rotor is linked to the rotating shaft of the steering wheel SW via a gear, transmits rotational power to the steering wheel SW, and gives an auxiliary torque to the steering wheel SW. The control device 101 includes a torque sensor TS that detects a steering torque when the driver operates the steering wheel SW, a steering angle sensor RS that detects a steering angle of the steering wheel SW, and a current that detects a current flowing through the motor M. It is connected to the sensor MCS and a vehicle speed sensor VS for detecting the vehicle speed. The control device 101 obtains the auxiliary torque from the steering torque of the steering wheel SW, the steering angle, and the vehicle speed, and obtains the target current that indicates the amount of current given to the motor M according to the auxiliary torque as a control command. It should be noted that the motor M is provided with two coils Co5 and Co6 forming a double winding so that even if one of the coils Co5 and Co6 is disconnected, the motor M can be driven by supplying a current to the other. It has become. Further, the control device 101 controls the amount of current flowing through the coils Co5 and Co6 by feedback, adjusts the output torque of the motor M, and controls the auxiliary torque applied to the steering wheel SW. Alternatively, the steering angle of the steering wheel SW may be detected by detecting the rotation angle of the rotor of the motor M with the steering angle sensor RS.

The first control unit U11 and the second control unit U12 in the control device 101 are connected by the main signal line 151 as in the control device 1 of the first embodiment, and are capable of mutual communication. Further, the sub control units SU1, SU2, SU3 are arranged and connected in series in the middle of a sub signal line 161 that connects the first control unit U11 and the second control unit U12 in parallel with the main signal line 151. There is. Therefore, the first control unit U11, the second control unit U12, and the sub control units SU1, SU2, SU3 can communicate with each other. Further, the first control unit U11 and the second control unit U12 are also connected to the vehicle-mounted network N1 as a network that is connected to a sensor or the like mounted on the vehicle and can perform CAN standard communication via signal lines 162 and 163. Has been done. The network may be a communication network using a communication standard other than CAN communication.

In this embodiment, the first control unit U11 operates the motor M, the second control unit U12 operates the damper D1, the sub control unit SU1 operates the damper D2, the sub control unit SU2 operates the damper D3, and the sub control unit SU3 operates. Respectively controls the damper D4. The first control unit U11 is arranged in the vicinity of the motor M that is a control target, and the second control unit U12 and the sub control units SU1, SU2, SU3 have the dampers D1, D2, D3, D4 that are their control targets. They are placed close to each other. When the first control unit U11, the second control unit U12, and the sub control units SU1, SU2, and SU3 are arranged in this way, the cables and the main signal line 151 and the sub signal line 161 used for communication with the controlled object and the sensors are arranged. The advantage is that the total wiring length can be shortened.

The first control unit U11 is directly connected to the torque sensor TS, the steering angle sensor RS, and the current sensor MCS, and is also connected to the vehicle speed sensor VS via the vehicle-mounted network N1. Then, the operation torque, the steering angle, the vehicle speed, and the current amount are input to the first control unit U11 as information for controlling the motor M. The second control unit U12 is directly connected to the stroke sensor SFR, the acceleration sensor GFR, and the current sensor CFR, and the stroke amount, the acceleration, and the current amount detected by them are directly used as information for controlling the damper D1. It is input to the control unit U12. Further, the sub control unit SU1 is directly connected to the stroke sensor SFL, the acceleration sensor GFL, and the current sensor CFL, and the stroke amount, the acceleration, and the current amount detected by them are directly used as information for controlling the damper D2. Input to SU1. The sub control unit SU2 is directly connected to the stroke sensor SRR, the acceleration sensor GRR, and the current sensor CRR, and the stroke amount, the acceleration, and the current amount detected by these are directly provided to the sub control unit SU2 as information for controlling the damper D3. Is entered. The sub-control unit SU3 is directly connected to the stroke sensor SRL, the acceleration sensor GRL, and the current sensor CRL, and the stroke amount, acceleration, and current amount detected by them are directly connected to the sub-control unit SU3 as information for controlling the damper D4. Is entered.

Further, the first control unit U11 and the second control unit U12 obtain a control command for controlling the dampers D1, D2, D3, D4 and a control command for controlling the motor M every predetermined control cycle. Therefore, in the first control unit U11 and the second control unit U12, the stroke sensors SFR, SFL, SRR, SRL, the acceleration sensors GFR, GFL, GRR, GRL, the current sensors CFR, CFL, CRR, CRL, and the torque sensor described above are included. All of the information obtained from the TS, the steering angle sensor RS, the current sensor MCS, and the vehicle speed sensor VS are input through the main signal line 151, the sub signal line 161, and the vehicle-mounted network N1. When controlling the dampers D1, D2, D3, and D4 in consideration of the brake operation and the accelerator operation that have an influence on the posture change of the vehicle body VB, the brake operation information and the accelerator opening information are first set. It may be input to the control unit U11 and the second control unit U12.

In the present embodiment, the recording unit that records the error code output by the first control unit U11, the second control unit U12, and the sub-control units SU1, SU2, SU3, and the communication content that is exchanged with each other, and the recorded information. Although no wireless communication device for transmitting to the outside is provided, these may be provided as in the first embodiment.

Further, the control device 101 is connected to the alarm device K1 through the vehicle-mounted network N1 similarly to the control device 1 of the first embodiment. Therefore, when an abnormality that causes the control device 101 to stop the vehicle occurs, a warning lamp or the like can be turned on from the alarm device K1 so as to prompt the driver to stop traveling.

The first control unit U11 and the second control unit U12 are, as in the control device 1 of the first embodiment, respectively, as shown in FIG. 8, a main controller M11, M12 and a main controller M11, M12, respectively. It is configured to include sub-controllers S11 and S12 having a low processing speed. In the first embodiment, the main controllers M11 and M12 are high-end microcomputers, respectively, and the sub-controllers S11 and S12 are mid-range microcomputers in a lower price range than the main controllers M11 and M12. The control device 1 is the same as the control device 1. Both the first control unit U11 and the second control unit U12 operate by being supplied with electric power from a vehicle-mounted battery (not shown), but can be operated for a certain period of time by being supplied with electric power from the spare battery BS1.

Further, the main controllers M11 and M12 are both CAN interfaces 121, 122 and 125 for performing CAN communication between the vehicle-mounted network N1 and the control units U11 and U12, and the motor M or the attenuation, as in the first embodiment. The output port 123 for outputting the PWM command for controlling the coils C03, Co5 of the force variable valve V1 is provided, and in this example, the current sensors MCS, CFR, the stroke sensor SFR, the acceleration sensor GFR, and the torque sensor TS. The steering angle sensor RS includes an AD conversion unit 124 that converts an analog signal output from a connected sensor group into a digital signal and receives information from the sensor group.

Further, the sub-controllers S11 and S12 are both CAN interfaces 131, 132 and 135 for performing CAN communication between the vehicle-mounted network N1 and the control units U11 and U12, and the motor M or the attenuation, as in the first embodiment. In addition to the output port 133 for outputting the PWM command for controlling the coils Co4 and Co6 of the force variable valve V1, in this example, the current sensors MCS and CFR, the stroke sensor SFR, the acceleration sensor GFR, and the torque sensor TS. The steering angle sensor RS includes an AD conversion unit 134 that converts an analog signal output from a connected sensor group into a digital signal and receives information from the sensor group.

Further, each control unit U11, U12 has a connector 142 connected to both the CAN interface 121 of the main controllers M11, M12 and the CAN interface 131 of the sub-controllers S1, S2 via an internal signal line 141, a CAN interface 122, and A connector 144 connected to both CAN interfaces 132 via an internal signal line 143, a connector 145 connected to both CAN interface 125 and CAN interface 135 via an internal signal line 152, an output port 123 and an output port. A connector 150 connected to both 133 via internal signal lines 146, 147 and connected to both AD converters 124, 134 via internal signal line 148, and provided in the middle of internal signal lines 146, 147. The drive circuits P1 and P2 that supply a drive current to the coils M3, Co4, Co5, and Co6 of the motor M or the damping force variable valve V1 by the input of the PWM command, and the connector 150 side provided in the middle of the internal signal line 148. And an amplifier circuit 149 for amplifying a signal input from the A/D converter and outputting the amplified signal to both the AD conversion units 124 and 134. The above-described components of the first control unit U11 and the second control unit U12 are installed on a single board CB1 and housed in a housing (not shown). The acceleration sensor GFR may be mounted on the board CB1 of the second control unit U12 as long as the installation position of the second control unit U12 on the vehicle body is directly above the damper D1 of the front right wheel in charge of control. Further, since the drive circuits P1 and P2 for supplying the drive current to the motor M or the coils Co3, Co4, Co5 and Co6 of the damping force variable valve V1 are provided, the current sensors CFR, CFL, CRR, CRL and MCS are also provided on the substrate CB1. You can implement it on top.

The internal signal line 141 connects the connector 142 to both the CAN interface 121 of the main controllers M11 and M12 and the CAN interface 131 of the sub-controllers S1 and S2. In this case, four communication lines for CAN communication are used. It is configured by converting. The connectors 142 of the first control unit U11 and the second control unit U12 are connected by a main signal line 151, and the main controllers M11, M12 and the sub-controllers S11, S12 communicate with each other via the main signal line 151. It is possible. The main signal line 151 is also configured by quadrupling the communication lines for performing CAN communication, and since the amount of information that can be exchanged per unit time is large, the main controllers M11, M12 and the sub-controllers S11, S12 are High-speed communication is possible. If the quartetized communication lines are arranged apart from each other, it is possible to avoid the risk that all of them will be disconnected once. The number of communication lines of the main signal line 151 can be set arbitrarily.

The internal signal line 143 has one end connected to the CAN interface 122 of the main controller M11 (M12) and the other end connected to the CAN interface 132 of the sub controller S11 (S12), and a controller connection line 143a and a controller connection line 143a. A connector connection line 143b for connecting the middle of the connector to the connector 144 and a relay 143c provided in the middle of the connector connection line 143b are provided. Therefore, the main controller M11 and the sub-controller S11 are in the first control unit U11 via the controller connection line 143a, and the main controller M12 and the sub-controller S12 are in the second control unit U12 via the controller connection line 143a. Can communicate with each other.

In addition, the internal signal line 152 connects the connector 145 to both the CAN interface 125 of the main controllers M11 and M12 and the CAN interface 135 of the sub-controllers S1 and S2.

The connector 144 is connected to the sub signal line 161, and the connector 145 is connected to the in-vehicle network N1 via the signal line 162 (163). Thus, the sub signal line 161 is parallel to the main signal line 151 and connects the first control unit U11 and the second control unit U12. Therefore, the first control unit U11 and the second control unit U12 can communicate with the sub control units SU1, SU2, SU3 connected in series to the sub signal line 161, and also via the signal lines 162, 163. It is connected to the vehicle-mounted network N1 so that the information detected by the vehicle speed sensor VS can be obtained. The sub signal line 161 is configured by duplicating a communication line for performing CAN communication, and increases the amount of information that can be exchanged in a unit time. If the duplicated communication lines are arranged apart from each other, the risk of disconnecting all of them at once can be avoided. The relay 143c is opened when power is supplied to disconnect the connector 144 from the CAN interfaces 122 and 132, and closed when power is not supplied to connect the connector 144 to the CAN interfaces 122 and 132. To do. Therefore, even if the power supply to the first control unit U11 and the second control unit U12 is interrupted, the connector 144 and the CAN interfaces 122 and 132 are connected to each other and are in the connection state with the sub signal line 161. A control line (not shown) for turning ON/OFF the relay 143c is wired-OR connected to both the main controller M1 (M2) and the sub controller S1 (S2), and a command to the relay 143c is issued to the main controller M1 (M2). ) And the sub-controller S1 (S2).

The internal signal line 146 connects the output port 123 of the main controller M11 (M12) to the connector 150, and the internal signal line 147 connects the output port 133 of the sub controller S11 (S12) to the connector 150. The main controllers M11 and M12 both obtain the auxiliary torque τ ^* from the steering torque of the steering wheel SW, the steering angle, and the vehicle speed information, and the target current iM ^* to be given to the motor M in accordance with the auxiliary torque τ ^* . Further, since the control target of the first control unit U11 is the motor M, the main controller M11 feeds back the current amount iM flowing through the coil Co5 of the motor M detected by the current sensor MCS to feed back the current amount iM and the target current iM. A PWM command IM as a control command is obtained based on the control deviation from ^* . The PWM command IM is obtained as a three-phase PWM drive signal in this example. The main controller M11 generates the PWM command IM required by the drive circuit P1 based on the target current iM ^* , outputs the PWM command IM from the output port 23, and inputs the PWM command IM to the drive circuit P1.

Further, the main controllers M11, M12 are based on the information on the strokes of the dampers D1, D2, D3, D4 and the sprung acceleration immediately above the wheel W provided with the dampers D1, D2, D3, D4 of the vehicle body VB. Then, the target damping forces f1 ^* , f2 ^* , f3 ^* , f4 ^* of the dampers D1, D2, D3, D4 are obtained using the Carnop control law, for example. Further, the main controllers M11 and M12 follow the target damping forces f1 ^* , f2 ^* , f3 ^* , f4 ^* according to the target currents id1 ^* , id2 ^* , id3 ^{* to be} applied to the coil Co3 (Co4) of the damping force variable valve V1 ^. , Id4 ^* is obtained. The control target of the second control unit U12 is the damper D1. Therefore, the main controller M12 feeds back the current amount id1 flowing in the coil Co3 of the damping force variable damper detected by the current sensor CFR, and based on the control deviation between the current amount id1 and the corresponding target current id1 ^* , the control command is issued. Obtain the PWM command ID1. The main controller M12 generates the PWM command ID1 requested by the drive circuit P1 based on the target current id1 ^* , outputs the PWM command ID1 from the output port 23, and inputs it to the drive circuit P1.

The drive circuit P1 supplies a drive current to the coil Co5 of the motor M or the coil Co3 of the damping force variable valve V1 of the damper D1 according to the duty ratio designated by the PWM command. When the paired main controller M11 (M12) is out of order, the sub-controller S11 (S12) obtains a PWM command based on the control command IM (ID1) instead of the main controller M11 (M12). Then, the sub-controller S11 (S12) outputs a PWM command from the output port 33 to the drive circuit P2 that supplies power to the coil Co4 (Co6) of the damping force variable valve V1 of the motor M or the damper D1.

The main controllers M11 and M12 generate control commands for each control cycle in order to control the motor M and the dampers D1, D2, D3 and D4 at a predetermined control cycle. Since the sub-controllers S11 and S12 have lower processing speeds than the main controllers M11 and M12, the sub-controllers S11 and S12 calculate the control command once every while the main controllers M11 and M12 calculate the control commands a plurality of times. How many times the main controllers M11 and M12 perform calculations while the sub-controllers S11 and S12 calculate once is set according to the processing speeds of the main controllers M11 and M12 and the sub-controllers S11 and S12. For example, if the main controllers M11 and M12 can perform arithmetic processing at a speed 10 times faster than the sub-controllers S11 and S12, the main controllers M11 and M12 calculate the control command 10 times while the sub-controllers S11 and S12 calculate. It is set to calculate the control command once.

The drive circuits P1 and P2 are PWM drive circuits. When a PWM command is input, the drive circuits P1 and P2 supply a drive current to the coils Co3, Co4, Co5, and Co6 according to the duty ratio specified by the PWM command. There is. The two coils Co5 and Co6 provided in the motor M are connected to the drive circuits P1 and P2 in the corresponding first control unit U11. Therefore, if one of the drive circuit P1 and the drive circuit P2 is selected to supply the current, either one of the two coils Co5 and Co6 can be selected to supply the current. The two coils Co3 and Co4 provided in the damping force variable valve V1 of the damper D1 are connected to the drive circuits P1 and P2 of the corresponding second control unit U12. Therefore, if one of the drive circuit P1 and the drive circuit P2 is selected to supply the current, either one of the two coils Co3 and Co4 can be selected to supply the current.

The internal signal line 148 branches from the middle to connect the connector 150 to the AD conversion unit 124 of the main controller M11 (M12) and the AD conversion unit 134 of the sub controller S11 (S12). In the middle of the internal signal line 148, an amplifier circuit 149 such as a non-inverting amplifier circuit composed of an operational amplifier is provided. Further, the connector 150 in the first control unit U11 is connected to the torque sensor TS and the steering angle sensor RS. In addition, the current sensor MCS is composed of a shunt resistor and is mounted on the substrate CB1 together with the drive circuits P1 and P2 in this example. Then, the signals from the current sensor MCS, the torque sensor TS, and the steering angle sensor RS are amplified by the amplifier circuit 149 and input to the main controller M11 and the sub controller S11. The connector 150 in the second control unit U12 is connected to the stroke sensor SFR and the acceleration sensor GFR. Further, the current sensor CFR, which is constituted by a shunt resistor in this example, is mounted together with the drive circuits P1 and P2 on the substrate CB1. Then, the signals from the current sensor CFR, the stroke sensor SFR, and the acceleration sensor GFR are amplified by the amplifier circuit 149 and input to the main controller M12 and the sub controller S12. Also, two coils Co3 and Co4 of the damping force variable valve V1 of the dampers D2, D3 and D4 are prepared in duplicate, and even if one of them is disconnected, the current is supplied to the other damper D2, D3. , D4 damping force can be controlled.

As shown in FIG. 9, the sub-control units SU1, SU2, SU3 are respectively provided with two low-order controllers L1, L2. The low-order controllers L1 and L2 are low-end microcomputers, respectively, and are low-priced microcomputers having a lower calculation processing speed than the sub-controllers S11 and S12. Each of the sub-control units SU1, SU2, SU3 is adapted to operate by receiving power supply from a vehicle-mounted battery (not shown). If the power is supplied from the onboard battery not by one system but by multiple systems, even if one system fails, it can receive power from other systems, so a robust system can be constructed. The sub-control units SU1, SU2, SU3 are both provided with a spare battery SB2. Therefore, even if the power supply from the vehicle-mounted battery is interrupted, the sub-control units SU1, SU2, SU3 can continue to control the corresponding control target dampers D2, D3, D4 by receiving the power supply from the spare battery SB2. It is like this.

Further, the low-order controllers L1 and L2 are provided with a CAN interface 171 so that the control units U11 and U12 and the sub-control units SU1, SU2, and SU3 can mutually perform CAN communication, and current sensors CFL, CRR, CRL, and stroke. The sensor SFL, SRR, SRL and the acceleration sensors GFL, GRR, GRL are provided with an AD converter 173 that converts an analog signal output from the connected sensor group into a digital signal and receives information from the sensor group. There is.

Further, the low-order controllers L1 and L2 receive a control command from the first control unit U11 or the second control unit U12, and supply electric power to the coils Co3 and Co4 of the damping force variable valve V1 according to the control command. An output port 172 is provided for outputting the PWM command.

Each of the sub control units SU1, SU2, SU3 has both connectors 182, 183 connected to both CAN interfaces 171, 171 of the low-order controllers L1, L2 via an internal signal line 181, and output ports 172, 172. To the AD converters 173 and 173 via an internal signal line 186, and a PWM command provided in the middle of the internal signal line 186. Drive circuits P3 and P4 that supply a drive current to the coils Co3 and Co4 of the damping force variable valve V1, and a signal provided from the connector 188 side provided in the middle of the internal signal line 186 to amplify each AD. An amplifier circuit 187 that outputs to both the conversion units 173 and 173 is provided. The above-described constituent elements of the sub-control units SU1, SU2, SU3 are respectively installed on the single board CB2 and housed in a casing (not shown). If the location of the sub-control units SU1, SU2, SU3 installed on the vehicle body VB is directly above each wheel W to which the dampers D2, D3, D4 to be controlled are connected, the acceleration sensors GFL, GRR, GRL correspond to the corresponding sub-vehicles. It may be mounted on the board CB2 of the control units SU1, SU2, SU3.

The internal signal line 181 has a connector connection line 181a having one end connected to the connector 182 and the other end connected to the connector 183, and one end connected to the CAN interface 171 of the low-order controller L1 and the other end connected to the connector connection line 181a. A controller connection line 181b connected to one of the connector connection lines 181a, and a controller connection line 181c having one end connected to the CAN interface 171 of the low-order controller L2 and the other end connected to one of the connector connection lines 181a; Relays 181d and 181e are provided on both sides of the connection point of the controller connection lines 181b and 181c of the connector connection line 181a. The connector connection line 181a is configured by duplicating a communication line capable of CAN communication, similarly to the sub signal line 161 having a duplicated communication line. The controller connection line 181b is composed of a single communication line, is connected to one of the two communication lines of the connector connection line 181a, and the controller connection line 181c is composed of a single communication line. It is connected to the other of the two communication lines of the connector connection line 181a. The low-order controllers L1 and L2 are connected to each other by a communication line 189 provided so that they can perform serial communication with each other. Therefore, the lower controller L1 is connected to one of the duplicated communication lines of the sub signal line 161 through the internal signal line 181, and the lower controller L2 is connected to the other of the duplicated communication lines of the sub signal line 161 with the internal signal. Connected through line 181. Even with this connection, the low-order controllers L1 and L2 can exchange information with each other through the communication line 189. Therefore, in addition to the information directly obtained from one of the communication lines of the sub-signal line 161, the low-order controller L1 can also obtain information from the other communication line of the sub-signal line 161 via the low-order controller L2. This is the same in the lower controller L2. Therefore, the low-order controllers L1 and L2 can obtain all the information from the sub-signal line 161 including the duplicated communication line by providing only one CAN interface 171 respectively. The relays 181d and 181e are closed when no current is supplied to connect the connectors 182 and 183 to the low level controllers L1 and L2, and are opened when power is supplied to open the low level controllers L1 and L2 from the connectors 182 and 183. Cut off. Therefore, even if the power supply to any of the sub control units SU1, SU2, SU3 is interrupted, the connectors 182 and 183 are connected and the control units U11, U12 and the sub control units SU1, SU2 are connected through the sub signal line 161. It is in a connection state with SU3. A control line (not shown) for turning ON/OFF the relays 181d and 181e is wired-OR connected to both the low order controllers L1 and L2, and a command to the relays 181d and 181e is issued from either the low order controllers L1 and L2. It is possible. Further, in the present control device 101, when the sub signal line 161 is not broken, the relay 181d of the sub control unit SU2 and the relay 181e of the sub control unit SU3 are opened to connect the sub control unit SU2 and the sub control unit SU3. The sub signal line 161 between them is in a cutoff state. That is, as shown in FIG. 10, the sub-signal line 161 between the sub-control unit SU2 and the sub-control unit SU3 is cut off, and the two do not communicate with each other without the control units U11 and U12. In addition, in FIG. 10, in order to facilitate understanding of the connection state of each control unit U11, U12, SU1, SU2, SU3, the relay is illustrated independently of the control unit. For example, as shown in FIG. 11, when one of the duplicated communication lines of the sub signal line 161 between the control unit U11 and the sub control unit SU1 is disconnected, the control unit U11 and the sub control unit SU1 are connected to each other. In the communication using the sub signal line 161, the communication speed is reduced although the communication is possible. In this case, as shown in FIG. 12, the sub-signal line 161 between the control unit U11 and the sub-control unit SU1 is cut off by opening the relays 143c and 181e, and the communication between the two is controlled by the control unit U12 and the sub-control unit SU2. Higher speed communication is possible through SU3. Further, since the sub control units SU1, SU2, SU3 are connected in series to the sub signal line 161 that connects the control units U11 and U12 to the main signal line 151 in parallel, one portion of the sub signal line 161 is completely disconnected. Even then, it is possible to communicate with the control units U11, U12 and all the sub control units SU1, SU2, SU3. That is, if there is a break in the middle of the sub signal line 161, communication can be secured by opening/closing the relay 143c and the relays 181d and 181e depending on the broken part. Further, since the relays 181d and 181e are closed when no power is supplied, even if the sub control units SU1, SU2, SU3 are stopped, the communication of the sub signal line 161 is possible.

Returning to this, the internal signal line 184 connects the output port 172 of the low-order controller L1 to the connector 188, and the internal signal line 185 connects the output port 172 of the low-order controller L2 to the connector 188. When the lower controller L1, L2 receives the input of the target current obtained by the first control unit U11 or the second control unit U12 via the sub signal line 161, either one of them preferentially outputs a PWM command based on the target current. Is generated and output from the output port 172. The lower controller L1 of the lower controllers L1 and L2 preferentially outputs the PWM command in advance, and the lower controller L2 outputs the PWM command when an abnormality is recognized in the lower controller L1. When the low-order controller L1 is prioritized, the low-order controller L1 in each of the sub control units SU1, SU2, SU3 has a current amount id2, id3 flowing through the coil Co3 of the damping force variable damper detected by the current sensors CFL, CRR, CRL, respectively. By feeding back id4, the PWM commands ID2, ID3, and ID4 are obtained based on the control deviation between each current amount and the corresponding target current. Then, each low-order controller L1 generates the PWM commands ID2, ID3, ID4 required by the drive circuit P3 to control the dampers D2, D3, D4, which are its control targets, and outputs the PWM commands ID2, ID3, ID4 from the output port 172. .. When an abnormality is recognized in the low-order controller L1 and the malfunction occurs, the low-order controller L2 takes charge of the generation of the above-mentioned PWM command, and feeds back the current amounts id2, id3, id4 flowing in the coil Co4 of the damping force variable damper to generate the PWM command. Is output to the drive circuit P4.

The drive circuits P3 and P4 are PWM drive circuits. When a PWM signal is input, the drive circuits P3 and P4 supply a drive current to the coils Co3 and Co4 in accordance with the duty ratio designated by the PWM command. The coils Co3 and Co4 for driving the damping force variable valve V1 in the dampers D2, D3 and D4 are connected to the drive circuits P3 and P4 in the sub control units SU1, SU2 and SU3, respectively. Therefore, if one of the drive circuit P3 and the drive circuit P4 is selected and the current is supplied, the current can be supplied to either one of the two coils Co3 and Co4.

The internal signal line 186 branches from the middle to connect the connector 188 to the AD conversion unit 173 of the low-order controller L1 and the AD conversion unit 173 of the low-order controller L2. An amplifier circuit 187 such as a non-inverting amplifier circuit configured by an operational amplifier is provided in the middle of the internal signal line 186. The connectors 188 of the sub control units SU1, SU2, SU3 are connected to stroke sensors SFL, SRR, SRL and acceleration sensors GFL, GRR, GRL provided on the corresponding dampers D2, D3, D4, respectively. In this example, the current sensors CFL, CRR, and CRL are composed of shunt resistors and are mounted on the substrate CB2 together with the drive circuits P3 and P4. The information from the stroke sensors SFL, SRR, SRL, the acceleration sensors GFL, GRR, GRL and the current sensors CFL, CRR, CRL is amplified by the amplifier circuit 187 and input to the lower controllers L1, L2. ..

Although the first control unit U11, the second control unit U12, and the sub-control units SU1, SU2, SU3 are configured to perform CAN communication in the above-described places, they are configured to communicate according to the FlexRay standard including the in-vehicle network N. May be.

Subsequently, the main controllers M11 and M12 generate control commands for each control cycle in order to control the motor M and the dampers D1, D2, D3 and D4 at a predetermined control cycle. Similar to the control device 1 of the first embodiment, since the sub-controllers S11 and S12 have lower processing speeds than the main controllers M11 and M12, the sub-controllers S11 and S12 are set to 1 while the main controllers M11 and M12 calculate the control command multiple times. Calculate the control command at the rate of times Therefore, like the control device 1 of the first embodiment, the control device 101 compares the control commands of all the controllers M11, M12, S11, S12 every time the sub-controllers S11, S12 request the control command, and all the controllers M11. , M12, S11, S12 are diagnosed.

Similar to the control device 1 of the first embodiment, the number of times the main controllers M11 and M12 calculate while the sub-controllers S11 and S12 calculate once is determined by the processes of the main controllers M11 and M12 and the sub-controllers S11 and S12. It is set according to the speed. Also in this example, the sub-controllers S11 and S12 are set to calculate the control command once while the main controllers M11 and M12 calculate the control command 10 times. Therefore, also in this example, every time the main controller M11, M12 calculates the control command 10 times, the control command is compared with the control command obtained by the sub-controllers S11, S12 to perform the abnormality diagnosis.

Prior to the abnormality diagnosis by comparing the control commands, even in the control device 101 of the second embodiment, similar to the control device 1 of the first embodiment, a simulation calculation process with a light calculation load is performed on all the control units U11, U12. , SU1, SU2, SU3 all controllers to perform abnormality diagnosis.

Therefore, the controllers M11, M12, S11, S12, L1, and L2 of all the control units U11, U12, SU1, SU2, and SU3 compare the calculation results obtained by the simulation calculation processing, and determine whether or not the calculation capacity is themselves poor due to the majority decision. To diagnose.

In this way, the comparison of the results of the simulation calculation processing is performed in all the controllers M11, M12, S11, S12, L1 and L2. Specifically, when the simulation calculation process is completed and a calculation result is obtained, the controllers M11, M12, S11, S12, L1 and L2 communicate with each other to obtain all the calculation results and compare them. Then, each of the controllers M11, M12, S11, S12, L1 and L2 compares the values of the operation results and makes a majority decision. As a result, the controller itself produces an operation result different from the majority result among the operation results output by the other controllers. When outputting, it diagnoses itself as in a state of incompetent computing power. The simulated calculation process is, for example, a simple calculation process, and is a calculation process that does not delay the calculation process of the control command that follows. Among the controllers M11, M12, S11, and S12, the controller that has recognized itself as having a poor calculation capability does not perform the control command calculation process and sets the output currents from the output ports 123 and 133 to zero. Further, the low-order controllers L1 and L2 do not perform control command calculation processing, but control the dampers D2, D3 and D4 to be controlled. Therefore, the low-order controllers L1 and L2 do not participate in the control of their own control targets among the dampers D2, D3, and D4 when the majority of the simulated calculation results determines that there is an abnormality. Each controller M11, M12, S11, S12 excluding the low-order controllers L1, L2 moves to the subsequent control command calculation process when there is no malfunction in the simulated calculation process, and further, these controller M11, M12 The abnormality of M12, S11, S12 is diagnosed. It should be noted that the determination as to whether or not there is a malfunction in the computing capacity by this simulated computing process is performed for each control cycle of the main controllers M11 and M12. Among the controllers M11, M12, S11, and S12, even if the controller that was previously diagnosed as having a malfunctioning computing capacity is not found to have a malfunctioning computing capacity in the next simulated computing process, control is returned to the damper. Among the lower controllers L1 and L2, even if the controller that has been previously diagnosed as having a malfunction in computing power is not found to have a malfunction in computing power in the next simulated computing process, it is possible to return to the control of the damper that is the control target.

When all the main controllers M11 and M12 are found to have a malfunction in the computing capability, the sub-controller S11 controls the motor M based on the control command adopted before the malfunction in the computing capability, and the sub-controller S12 activates the damper D1. Control. In addition, when all the main controllers M11 and M12 are found to have a malfunction in computing capacity, one of the lower controllers L1 and L2 operates the respective dampers D2, D3 and D4 based on the control command adopted before the malfunction in computing power. Control. In the abnormality diagnosis by comparing the calculation results of the simulated calculation processing, the controllers M11, M12, S11, S12, L1 and L2 not only recognize the malfunction of their own computing power due to a majority vote but also the other controllers do not It may be diagnosed as to whether or not

Subsequently, the controller, which is recognized as having no calculation performance failure by the simulated calculation processing by all the controllers M11, M12, S11, S12, performs the calculation processing of the control command, compares the control commands, and participates in the calculation processing. Performs controller abnormality diagnosis. By the time the sub-controllers S11, S12 complete the arithmetic processing of one control command, the main controllers M11, M12 have completed the arithmetic processing of the control instruction a plurality of times. The control command obtained from the same information is used by M12, S11, and S12. When the main controllers M11 and M12 and the sub-controllers S11 and S12 start the control command calculation process based on the same information, the main controller M11, S12 waits until the sub-controllers S11 and S12 finish the control command calculation process. M12 arithmetically processes the control command a plurality of times. Therefore, the control commands obtained by the main controllers M11, M12 performing arithmetic processing based on the same information as the sub-controllers S11, S12 are provided in the main controllers M11, M12 or stored in an external storage device. deep. Then, the sub-controllers S11 and S12 compare the control command obtained by the arithmetic processing based on the same information as the main controllers M11 and M12 with the control command stored in the storage device. By doing so, the main controller M11, M12 and the sub-controller S11, S12 can compare the control commands obtained from the same information. For example, when the control cycle of the main controllers M11 and M12 is 1 millisecond and the sub-controllers S11 and S12 calculate the control command once every 10 milliseconds, the control command obtained by the main controllers M11 and M12 is about 10 milliseconds. It is held and the control commands are compared every 10 milliseconds.

The comparison of the control commands is performed in all the controllers M11, M12, S11, S12. Specifically, when the calculation of the control command to be compared ends, each controller M11, M12, S11, S12 sends the control command calculated by itself to the other controller M11, M12, S11, S12 via the internal signal line 141 and It is transmitted via the main signal line 151. Each controller M11, M12, S11, S12 adds four control commands calculated by another controller to the control command calculated by itself, and compares the four control commands. Then, if all the control commands do not match, each of the controllers M11, M12, S11, S12 diagnoses the controller, which has output a control command different from the other control commands, as an abnormality by a majority vote. The case in which an abnormality is diagnosed as a result of the majority decision is the same as in the control device 1 of the first embodiment.

Specifically, if all the control commands match, each controller M1, M2, S1, S2 diagnoses that all the controllers M1, M2, S1, S2 are normal. In the case where one of the four control commands is different and the two main controllers M11 and M12 output control commands that match each other, the controller that outputs the control commands of different values among the sub-controllers S11 and S12. Is diagnosed as abnormal. In the case where one of the four control commands is different and the control commands output from one of the two main controllers M11 and M12 and the two sub-controllers S11 and S12 match, the main controller that outputs different control commands is controlled. It is diagnosed as abnormal because the calculation of failed. In this state, one of the main controllers M11 and M12 that is recognized as abnormal is set to the control command calculation failure state. In the case where the control commands of the two main controllers M11 and M12 match and the control commands of the sub-controllers S11 and S12 have different values than the others, the main controllers M11 and M12 are normal and the sub-controllers S11 and S12 are Diagnosed as abnormal. In the case where only one of the main controllers M11 and M12 and one of the sub-controllers S11 and S12 output a control command that matches, the controller that outputs the matching control command is normal and outputs a control command that does not match. The existing controller is diagnosed as abnormal. In this state, one of the main controllers M11 and M12, which is recognized as abnormal, is recognized as being in the control command calculation failure state. In the case where the control commands of the sub-controllers S11 and S12 match and the control commands of the main controllers M11 and M12 have different values than the others, the sub-controllers S11 and S12 are normal and both the main controllers M11 and M12 are abnormal. Is diagnosed with. In this state, both the main controllers M11 and M12 are recognized as a control command calculation failure state. In the case where there are two matching control commands and two control commands that match with different values from this control command, depending on the majority decision, it is not clear which control command is correct, but there is an abnormality and the control command calculation cannot be confirmed. Is diagnosed. In the case where the four control commands are different from each other, it is abnormal because it is not clear which control command is correct depending on the majority decision because all the control commands are different. Be recognized. The measures taken by the control device 101 of the second embodiment in each of the aforementioned cases are the same as those of the control device 1 of the first embodiment. If there is a controller that does not participate in the control command by comparing the results of the simulation calculation processing, the majority decision may be made only with the control command obtained by the controller recognized as normal. Further, each of the controllers M11, M12, S11, S12 may make a majority decision on all control commands for controlling the motor M and the dampers D1, D2, D3, D4 and perform an abnormality diagnosis. The abnormality diagnosis may be performed by comparing only some control commands. Further, similarly to the control device 1 of the first embodiment, in the control device 101 of the second embodiment as well, a part of the results of various calculations executed in the process of obtaining the control command is compared to perform an abnormality diagnosis. Good.

Further, the comparison of the control commands of the four controllers M11, M12, S11, S12 is performed once while the main controllers M11, M12 calculate the control commands a plurality of times. That is, since the main controllers M11 and M12 calculate the control command for each control command, the main controllers M11 and M12 calculate the control command a plurality of times during the control command comparison cycle. Therefore, when the control commands output from the main controllers M11 and M12 are different before the comparison of the control commands, the motor M and the dampers D1, D2, D2 are used by using the latest matching control command among the past control commands. You may control D3 and D4. In this way, fail-safe is realized, and even while the control commands are being compared, it is possible to detect an abnormality in the main controllers M11, M12 and appropriately control the motor M and the dampers D1, D2, D3, D4.

Returning to this, when the comparison of the control commands is completed, in the controllable state, the first control unit U11 operates the motor M, the second control unit U12 operates the damper D1, and the sub-control units SU1, SU2, SU3 respectively operate the corresponding dampers. Control D2, D3 and D4.

In the first control unit U11, the main controller M11 controls the motor M when the main controller M11 of the main controller M11 and the sub-controller S11 is normal. When the main controller M11 is in a state in which the computing capacity is in a disordered state or the control capability is in a disordered state described below, the sub-controller S11 controls the motor M. The amount of current flowing through the coil Co5 (Co6) of the motor M is detected by the current sensor MCS and used for feedback control, and is also monitored by the first control unit U11 and has the following control capability as in the first embodiment. Used for abnormality diagnosis. If the deviation between the current amount of the motor M and the target current always exceeds the abnormality threshold for determining a predetermined abnormality for a certain period of time, control is performed among the drive circuits P1 and P2 in the first control unit U11. It is diagnosed that the existing control system is abnormal and the control capability is poor. This abnormality diagnosis is performed by both the main controller M11 and the sub-controller S11 which are not controlled and which are controlled.

In the second control unit U12, when the main controller M12 of the main controller M12 and the sub-controller S12 is normal, the main controller M12 controls the damper D1. When the main controller M12 is in a state in which the arithmetic capacity is out of order or the control capacity is out of order, the sub controller S12 controls the damper D1. The amount of current flowing through the coil Co3 (Co4) of the damping force variable valve V1 of the damper D1 is detected by the current sensor CFR and used for feedback control, and is also monitored by the second control unit U12 and similar to the first embodiment. It is used for the subsequent abnormality diagnosis of control capability. When the deviation between the current amount of the coil Co3 (Co4) of the damper D1 and the target current always exceeds the abnormality threshold for determining a predetermined abnormality for a fixed time, the drive circuits P1 and P2 in the second control unit U12. Among them, it is diagnosed that the control system under control is abnormal and the control capability is poor. This abnormality diagnosis is performed by both the main controller M12 and the sub-controller S12 which are not controlled and which are controlled.

In the sub-control unit SU1, if the lower controller L1 of the lower controllers L1 and L2 is normal, the lower controller L1 is the lower controller L1 if the lower controller L1 is abnormal. The controller L2 controls the damper D2. The amount of current flowing through the coil Co3 (Co4) of the damping force control valve V1 of the damper D2 is detected by the current sensor CFL and used for feedback control, and is also monitored by the sub control unit SU1 and used for abnormality diagnosis of control capability. R. When the deviation between the current amount of the coil Co3 (Co4) of the damper D2 and the target current always exceeds the abnormality threshold for determining a predetermined abnormality for a certain period of time, the drive circuits P3 and P4 of the sub control unit SU1 Among them, it is diagnosed that there is an abnormality in the control system that is performing control and the control capability is poor. The abnormality diagnosis is performed by both of the lower controllers L1 and L2 that are not controlled and the one that is controlled.

In the sub-control unit SU2, as a result of the majority decision of the simulation calculation processing results, if the lower controller L1 of the lower controllers L1 and L2 is normal, the lower controller L1 is the lower controller L1, and if the lower controller L1 is abnormal, the lower controller L1 is the lower controller. The controller L2 controls the damper D3. The amount of current flowing through the coil Co3 (Co4) of the damping force variable valve V1 of the damper D3 is detected by the current sensor CRR and used for feedback control, and is also monitored by the sub control unit SU2 and used for abnormality diagnosis of control capability. R. When the deviation between the current amount of the coil Co3 (Co4) of the damper D3 and the target current always exceeds the abnormality threshold for determining a predetermined abnormality for a certain period of time, the drive circuits P3 and P4 of the sub control unit SU2 are Among them, it is diagnosed that there is an abnormality in the control system that is performing control and the control capability is poor. The abnormality diagnosis is performed by both of the lower controllers L1 and L2 that are not controlled and the one that is controlled.

In the sub-control unit SU3, as a result of the majority decision of the simulated operation processing results, the lower controller L1 is lower if the lower controller L1 of the lower controllers L1 and L2 is normal, and the lower controller L1 is lower if the lower controller L1 is abnormal. The controller L2 controls the damper D4. The amount of current flowing through the coil Co3 (Co4) of the damping force control valve V1 of the damper D4 is detected by the current sensor CRL and used for feedback control, as well as monitored by the sub control unit SU3 and used for abnormality diagnosis of control capability. R. When the deviation between the current amount of the coil Co3 (Co4) of the damper D4 and the current command ID4 target current always exceeds the abnormality threshold for determining a predetermined abnormality for a certain period of time, the drive circuit P3 in the sub-control unit SU3. , P4, there is an abnormality in the control system that is controlling, and it is diagnosed that the control capability is poor. The abnormality diagnosis is performed by both of the lower controllers L1 and L2 that are not controlled and the one that is controlled.

When the control system of the first control unit U11, the second control unit U12, and the sub-control units SU1, SU2, SU3 is abnormal as described above, the control capability of the control system is defective, and the control system is not used. It cannot be controlled normally.

Therefore, like the control device 1 of the first embodiment, even in the control device 101 of the second embodiment, the controller of the control system in which the control capability malfunction occurs outputs an error code to another controller. .. However, if the controller itself is abnormal and cannot output the error code, the controller paired with this controller outputs the error code instead. The other controllers receiving the error code ignore the controller in which the abnormality is recognized by the error code, and continue the control only by the controller having no abnormality. The controller belonging to the control system recognized as abnormal does not return to all the arithmetic processing and control until the vehicle is stopped, the power supply is stopped, and the control device 101 is restarted.

In this example, the first control unit U11 controls the motor M that generates the auxiliary torque that affects the steering of the vehicle. Therefore, when there is an abnormality in the entire control system of the first control unit U11, the alarm device K1 is used. An alarm signal is output to prompt the vehicle driver to make an emergency stop. In this example, the second control unit U12 and the sub-control units SU1, SU2, SU3 control the dampers D1, D2, D3, D4, and if they cannot be controlled normally, the riding comfort is adversely affected. Therefore, when one of the second control unit U12 and the sub-control units SU1, SU2, SU3 has an abnormality, an alarm signal is output to the alarm device K1 to prompt the vehicle driver to stop the vehicle.

In addition to the above-described abnormality diagnosis, a watchdog timer for monitoring each controller M11, M12, S11, S12, L1, L2 is provided to monitor each controller M11, M12, S11, S12, L1, L2. The abnormal controller may be stopped.

Further, in the present embodiment, since four acceleration sensors GFR, GFL, GRR, GRL are provided, the acceleration detected by the acceleration sensor GRL is estimated from the acceleration detected by the three acceleration sensors GFR, GFL, GRR, for example. it can. If there is a deviation that cannot be overlooked between the estimated acceleration and the acceleration detected by the acceleration sensor GRL, an abnormality in the acceleration sensors GFR, GFL, GRR, GRL can be found. Therefore, in addition to the above-described abnormality diagnosis of the control units U11, U12, SU1, SU2, SU3, abnormality diagnosis of the acceleration sensors GFR, GFL, GRR, GRL may be performed. Further, the acceleration sensors GFR, GFL, GRR, GRL are provided independently of the control units U12, SU1, SU2, SU3, and the control units U12, SU1, SU2, SU3 have one-axis or multi-axis substrates CB1, CB2. An inexpensive and auxiliary acceleration sensor may be provided. In this case, the accelerations detected by the acceleration sensors GFR, GFL, GRR, GRL can be estimated from the outputs of the acceleration sensors provided on the boards CB1 and CB2. Therefore, the estimated acceleration may be compared with the acceleration detected by the acceleration sensors GFR, GFL, GRR, GRL to diagnose the abnormality of the acceleration sensors GFR, GFL, GRR, GRL. Further, when an abnormality is recognized, the control command can be generated by utilizing the acceleration detected by the inexpensive and auxiliary acceleration sensor provided on the boards CB1 and CB2, so that a robust control system can be constructed. When the auxiliary acceleration sensor is provided, the acceleration sensor is inexpensive because it is provided on the boards CB1 and CB2.

Although the abnormality diagnosis in the control device 101 of the second embodiment is performed as described above, the correspondence between the main controllers M11 and M12 and the sub-controllers S11 and S12 when it is determined to be abnormal is the control device 1 of the first embodiment. Is the same as. That is, the main controllers M11 and M12 change their states according to their own states, as shown in the state transition diagram shown in FIG. 5, and the sub-controllers S11 and S12 take actions that should be taken, as shown in the state transition diagram shown in FIG. Is determined. On the other hand, the lower level controllers L1 and L2 in the sub control units SU1, SU2, and SU3 act according to the state transition diagram shown in FIG. Basically, the lower controller L1 of the lower controllers L1 and L2 operates in advance as a primary controller in the sub control units SU1, SU2, SU3. The lower controller L2 may be the primary controller. When the low-rank controller L1 is the primary controller, the controller maintains its position as the primary controller if the controller itself is in good condition, and performs control to energize the coil Co3 of the damping force control valve V1 of the damper to be controlled ( State ST21). On the other hand, when the low-order controller L1 which is the primary controller is defeated by the majority decision of the simulation calculation processing result, the state shifts to the state ST22, the current output from the output port 172 is set to 0, and the control returns to the control in the next control cycle. It keeps that state until it participates in the simulation calculation. When the result of comparison of the simulation calculation processing performed in the next control cycle is normal, the control is returned to the normal state, but the controller returns to the secondary controller (state ST23). That is, the secondary controller participates in the majority decision of the simulation calculation result, but sets the output current to 0 and does not participate in the control. Furthermore, when the secondary controller also loses the majority of the simulated calculation processing results, the state shifts to state ST26. In the state ST26, the lower controllers L1 and L2 in the sub control units SU1, SU2 and SU3 stop the control to set the output current to 0, output an error code and stop the control unit. Therefore, if the low-order controller L2 can normally stand by as the secondary controller when the low-order controller L1 is defeated by the majority decision of the simulation calculation processing result, the low-order controller L2 starts to function as the primary controller. Then, even if the lower controller L1 wins and the control can be restored by the majority decision of the simulation calculation processing result of the next control cycle, the lower controller L1 functions as the secondary controller and the lower controller L2 continues to function as the primary controller. In this state, when the lower controller L2 is defeated by the majority decision of the simulation calculation processing result and the lower controller L1 wins by the majority decision of the simulation calculation processing result, the lower controller L1 shifts to the state ST21 and functions as the primary controller. Further, in the state ST22, if the arithmetic capacity of the secondary controller is further poor, that is, if the secondary controller L1 and L2 are defeated by the majority decision of the simulated arithmetic processing results and the arithmetic capacity is poor, the state ST26 is reached. Move to. In this case, the subordinate controllers L1, L2 in the sub control units SU1, SU2, SU3 stop the control to set the output current to 0, output an error code, and stop the control unit (ST26).

When the control system of the low-order controller L1 (L2) functioning as the primary controller becomes out of order, the output of the out-of-order control system is set to 0 and control is stopped (state ST24). In this state, if the control system of the lower controller L2 (L1), which is a further pair, becomes out of order, the process proceeds to state ST25. In this state ST25, since the lower controllers L1 and L2 cannot be controlled, an error code is output and the control is stopped. This state is maintained until the control device 101 is restarted.

As described above, in the control device 101 of the present invention, the first control unit U11 and the second control unit U12 are provided with the main controllers M11 and M12 and the sub-controllers S11 and S12 having a low calculation processing capability as a pair. Therefore, even if some of the controllers M11, M12, S11, and S12 are out of order, the control target can be controlled, so that the control target can be continued to exhibit the fault tolerance function. In addition, since a correct control command can be adopted for control by majority decision, it is possible to perform robust control without being easily affected by noise or the like. Furthermore, since it is possible to control by adopting the correct control command by majority decision, it is not necessary to grasp all the abnormal patterns and judge whether they correspond to the abnormal patterns to recognize the abnormalities. Even if the error occurs, control can be performed with a correct control command.

Each of the first control unit U11 and the second control unit U12 is designed to directly control the controlled object, and the central processor is not required. In addition, since the sub-controller S11 (S12) has a low calculation processing capability with respect to the main controller M11 (M12), an inexpensive microcomputer can be used for the sub-controller S11 (S12) and the controller 1 The entire system can be constructed inexpensively.

Further, both the first control unit U11 and the second control unit U12 are connected to the in-vehicle network N1, and information necessary for control is input to both the first control unit U11 and the second control unit U12. Therefore, even if one of the first control unit U11 and the second control unit U12 is disconnected from the vehicle-mounted network N1, the first control unit U11 and the second control unit U12 can communicate with each other and control the control target. You can continue without interruption.

Further, since the first control unit U11 and the second control unit U12 are provided with the spare battery SB1, even if the power supply from the power source (not shown) of the vehicle is interrupted, the control of the controlled object can be continued.

Further, in the control device 1, the sub-controllers S11 and S12, which have low computing power, compute the control command based on the same information as the main controllers M11 and M12 at a computation speed lower than the computation speed of the main controllers M11 and M12. Therefore, the abnormality diagnosis is performed by comparing the calculation results. Therefore, even if an inexpensive microcomputer is used for the sub-controllers S11 and S12, the abnormality diagnosis can be reasonably performed and the fault tolerance can be realized.

It should be noted that the sub-controllers S11 and S12 perform a part of the arithmetic processing for each of the main controllers M11 and M12 to obtain a control command based on the same information, and the main controllers M11 and M12 perform a part of the arithmetic processing. When performing an abnormality diagnosis by comparing the obtained calculation result with the calculation results of the sub-controllers S11 and S12, the above-mentioned calculation result is shorter than the time required for the sub-controllers S11 and S12 to calculate all the control commands. Therefore, the frequency of abnormality diagnosis per unit time can be increased, and the abnormality can be closely diagnosed.

Further, in the present embodiment, a main signal line 151 connecting the first control unit U11 and the second control unit U12 is provided with a sub signal line 161 connecting them in parallel, and the sub signal line 161 is used for sub control. The units SU1, SU2, SU3 are connected in series, and in the middle of the sub signal line 161, between the first control unit U11 and the sub control unit SU1, between the sub control units SU1, SU2, SU3, and the second control. Relays 143c, 181d and 181e are provided between the unit U12 and the sub control unit SU3. Therefore, even if the sub-signal line 161 is broken, communication is performed by bypassing the broken portion of the sub-signal line 161 to maintain a communicable state, and a decrease in communication speed is suppressed. In the case where there is one sub control unit, a relay may be provided on the sub signal line 161 between the first control unit U11 and the sub control unit and between the second control unit U12 and the sub control unit. Of course, if there are a plurality of sub-control units, they may be provided between the sub-control units in addition to this.

In the above description, the control target of the control device 101 is the motor M and the dampers D1, D2, D3, D4. However, when the number of control targets increases or decreases, the number of sub-control units may be appropriately adjusted according to the number of control targets. You can increase or decrease. For example, if two motors are provided in the power steering device that require a large torque and the number of controlled objects is six including the dampers D1, D2, D3, and D4, one sub-control unit is added to provide six motors. It is sufficient to prepare the control unit of. Further, when controlling the damper interposed between the vehicle body and the wheels, the control device 101 may determine the number of sub control units according to the number of wheels of the vehicle.

While this concludes the description of the embodiments of the present invention, the scope of the present invention is not limited to the details shown or described.

1, 101... Control device, 3, 4... Pressure sensor (sensor), 5, 6... Current sensor (sensor), 5, 151... Main signal line, 49, 50, P1, P2 , P3, P4... Driving circuit, 53... Recording device (recording unit), 54... Wireless communication device, 161... Sub signal line, Co1, Co2, Co3, Co4, Co5, Co6... Coil, CFR, CFL, CRR, CRL, MCS... Current sensor, M1, M2, M11, M12... Main controller, N, N1... In-vehicle network (network), S1, S2, S11, S12 ... Sub-controller, SB, SB1... Spare battery, SU1, SU2, SU3... The sub-control unit, U1, U11... First control unit, U2, U12... Second control unit

Claims (10)

A first control unit,
A second control unit provided separately from the first control unit,
Each of the first control unit and the second control unit has a main controller and a sub-controller having a processing speed lower than that of the main controller,
Each of the main controller and each of the sub-controllers can communicate with each other,
Each of the main controller and each of the sub-controllers differs from the majority of the calculation results of the main controller and each of the sub-controllers based on the calculation result obtained by the calculation of the control command. The controller that has output the calculation result is diagnosed as abnormal, and a simulation calculation process having a calculation load lighter than the control command is performed, and the result of the simulation calculation process is compared to determine whether or not the calculation processing capability is poor. A control device characterized by diagnosing whether or not . Wherein each sub-controller, performs arithmetic processing for obtaining the said control command at a lower computation rate than the computation rate of the main controller,
The control device according to claim 1, wherein the main controller and the sub-controller perform an operation diagnosis by comparing the operation results obtained by performing the operation of the control command based on the same information. .. Wherein each secondary controller calculates the portion of the calculation processing said respective main controller at a lower computation rate than the computation rate of the main controller obtains the control command,
The abnormality diagnosis is performed by comparing the calculation results obtained by each of the main controllers and the sub-controllers executing a part of the calculation processing based on the same information. Control device. Each of the main controller and each of the sub-controllers calculates the control command until an abnormality is recognized by comparing the results of the simulation calculation processing until it is recognized as normal by comparing the results of the simulation calculation processing from the next time onward. The control device according to any one of claims 1 to 3, wherein the control device does not participate in. With multiple sensors,
Information detected by any sensor of the sensors or first controlled object information regarding a controlled object obtained from this information, and information detected by any sensor other than the sensor used to obtain the first controlled object information The control device according to any one of claims 1 to 4 , wherein abnormality diagnosis is performed by comparing the first control target information obtained from the first control target information with the second control target information of the same type. A main signal line connecting the first control unit and the second control unit,
A sub-signal line connecting the first control unit and the second control unit,
One or more sub control units provided in the middle of the sub signal line,
In the middle of the sub signal line, between the first control unit and the sub control unit, between the second control unit and the sub control unit, and when there are a plurality of sub control units, the sub control unit The control device according to any one of claims 1 to 5 , further comprising a relay that is provided between the control units and that opens and closes the sub signal line. The first control unit and the second control unit are both according to any one of claims 1 6, characterized in that connected to the sensor for collecting information necessary for the control over the vehicle network Control device. The control device according to any one of claims 1 to 7 , wherein the first control unit and the second control unit include a backup battery. Further, a recording unit for recording the error code output by each controller,
Control device according to any one of the error codes stored in the recording unit and a transmission capable wireless communication apparatus to the outside from claim 1, wherein 8. Two drive circuits that respectively supply power to the two coils provided in the controlled object,
A current sensor for detecting the current amount of each coil,
The main controller is connected to one of the drive circuits so as to be able to output a PWM command to form one control system,
The sub-controller is connected to the other of the drive circuits so as to be able to output a PWM command to form the other control system,
If the deviation between the current amount of the coil and the target current obtained based on the control command exceeds an abnormal threshold value for a certain period of time, the control system that outputs the PWM command to the coil is diagnosed as having a control capability malfunction. The control device according to any one of claims 1 to 9 , characterized in that.