JP5067359B2 - Fault diagnosis device for electronic control system - Google Patents

Description

  The present invention relates to a failure diagnosis device for an electronic control system, and more particularly to a device for diagnosing a failure in a control system used for motor drive control of a hybrid vehicle that can run by power from an engine and a motor.

  In general, a control system controls a corresponding control target by a control signal obtained by the arithmetic processing unit. At this time, the control processing unit itself or a control target including the control system, that is, a failure of the control system is diagnosed. Need to be communicated or appropriate countermeasures must be taken.

Conventionally, as described in Patent Document 1, for example, as a failure diagnosis apparatus for a control system, a set of two main / sub operation processing units is provided, and the main operation processing unit as a failure diagnosis target is monitored by the sub operation processing unit. Thus, it is known that a failure or abnormality of the main arithmetic processing unit is detected at an early stage, and the failure or abnormality is transmitted or a countermeasure is taken against the failure or abnormality.
JP 2003-150408 A

However, if the failure or abnormality of the main processing unit is detected and the fail-safe function is performed so as not to cause a problem operation due to the failure or abnormality, the sub-processing unit does not perform the above. When the fail-safe function of the system fails, there arises a problem that fail-safe as planned cannot be obtained.
That is, if the failure processing of the main processing unit is known for the first time when the above-mentioned fail-safe function by the sub-processing unit has failed, the original fail-safe function cannot be achieved.

  Therefore, failure diagnosis is performed in advance to determine whether the sub-processing unit is in a normal state that can reliably perform the above fail-safe function when the main processing unit fails, and the reliability of the fail-safe function by the sub-processing unit is confirmed. Need to increase.

  It is an object of the present invention to provide a failure diagnosis apparatus for an electronic control system that can realize such a demand.

For this purpose, the fault diagnosis device for an electronic control system according to the present invention is constructed as described in claim 1.
First, the electronic control system as a premise includes a plurality of arithmetic processing units, and when one arithmetic processing unit is abnormal, the other arithmetic processing units perform a fail-safe function.

The failure diagnosis apparatus of the present invention is characterized by a configuration in which the following diagnostic failure information transmission means , fail-safe function determination means, and system state determination means are provided for such an electronic control system.
Cross for failure information transmitting unit diagnosis is one which transmits the failure information for diagnosis to the other processing unit from the processing unit of the one.
In response to the failure information for diagnosis from the one arithmetic processing unit to the other arithmetic processing unit by the diagnostic failure information transmitting means, the other arithmetic processing unit performs the fail safe function in response to the failure information for diagnosis from the one arithmetic processing unit. It is determined whether or not a command has been issued.
The system state determination means determines whether or not the electronic control system is in a state to be obtained by the fail-safe function of the other arithmetic processing unit.
According to the failure diagnosis apparatus of the present invention, the fail-safe function determining unit and the system state determining unit cause the fail-safe function by the other arithmetic processing unit to be abnormal, or the electronic control system normally responds to the fail-safe function. It is determined by distinguishing whether the system is abnormal.

In the above-described failure diagnosis device for an electronic control system according to the present invention,
Whether the one arithmetic processing unit transmits diagnostic failure information to the other arithmetic processing unit, and in response to the diagnostic failure information, whether or not the other arithmetic processing unit commands the fail-safe function. In addition to the determination by the fail safe function determining means, the electronic control system determines whether or not the electronic control system is in a state that should be obtained by the fail safe function of the other arithmetic processing unit by the system state determining means. In order to distinguish and determine whether the fail-safe function by the other arithmetic processing unit is abnormal or whether the electronic control system is not normally responding to the fail-safe function, the other arithmetic processing unit ( from fail-safe function is failure by the sub processing unit), the one of the arithmetic processing Uni Rather than first know at the time of failure of the bets (main processing unit), it is possible to know in advance.

Therefore, it becomes possible to keep ahead fault diagnosis whether a normal state at the time of failure of the processing unit of the one is the other processing unit may reliably play a fail-safe function of the planned, the other operation process The reliability of the fail-safe function by the unit can be increased, and the original fail-safe function can be surely performed.
In addition, in the failure diagnosis device for an electronic control system according to the present invention, the fail-safe function determination means converts the failure information for diagnosis from the one arithmetic processing unit to the other arithmetic processing unit by the diagnostic failure information transmission means. In response, determine whether the other arithmetic processing unit has commanded the fail-safe function,
The system state determination means determines whether or not the electronic control system is in a state that should be obtained by the fail-safe function of the other arithmetic processing unit.
It is possible to distinguish and determine the failure of the fail-safe function by the above other processing units and the system error that the electronic control system cannot respond normally to the fail-safe function, and can identify the target of the abnormality and take countermeasures Is easy.

Hereinafter, embodiments of the present invention will be described in detail based on examples shown in the drawings.
[Constitution]
FIG. 1 exemplifies a high-voltage circuit of a hybrid vehicle drive device incorporating a failure diagnosis device according to an embodiment of the present invention.
The high-voltage circuit includes a high-voltage battery 1 that stores electrical energy, an inverter 2 that drives a high-voltage motor / generator MG, and a positive-side high-voltage relay 3 that connects and disconnects between the high-voltage battery 1 and the inverter 2. A negative high voltage relay 4 that connects / disconnects between the high voltage battery 1 and the inverter 2 and a precharge high voltage relay 5 provided in parallel to the negative high voltage relay 4 are provided.

  Incidentally, the hybrid vehicle electronic control system is composed mainly of an integrated controller 11 (see FIG. 2) that determines the operating point of the engine (not shown) and the motor / generator MG. The integrated controller 11 integrates the hybrid drive system. Control is implemented.

The main roles of the integrated controller 11 are shown below.
(1) Select the optimal driving mode (electric driving mode, hybrid driving mode) desired by the driver according to the driver's operation and the vehicle system state.
(2) Control each actuator (high voltage relay, DC-DC converter, etc.) in order to achieve the optimal operating state, calculate torque distribution to the engine (not shown) and high voltage motor / generator MG, A command is transmitted to each arithmetic processing unit.
(3) Monitor the vehicle system, switch to fail-safe driving, and turn on warning lights.

In addition, the hybrid vehicle starts the hybrid system according to the following procedure before traveling, and transitions to the travelable mode.
(1) The integrated controller 11 receives an ignition signal ON or a start signal (ON) and detects that the driver has shown an action indicating a driving intention.
(2) If the integrated controller 11 determines that there is no problem even if the high voltage relays 3 to 5 are connected, the positive high voltage relay plus 3 is first connected.
(3) When the connection of the plus side high voltage relay plus 3 is completed, the precharge high voltage relay 5 is connected and the capacitor in the inverter 2 is charged.
This is because the precharge high-voltage relay 5 has a larger resistance component than the plus-side high-voltage relay 3 and the minus-side high-voltage relay 4 and has a time constant for charging the capacitor in the inverter 2.
(4) When charging of the capacitor in the inverter 2 is completed, the integrated controller 11 connects the negative high voltage relay 4.
(5) When the connection of the negative high voltage relay 4 is completed, the precharge high voltage relay 5 is disconnected.
In this state, the high voltage application to the motor / generator MG is completed.
(6) When the integrated controller 11 determines that such high voltage application is completed and there is no problem even if the hybrid vehicle travels, the mode is shifted to the travel enable mode.

On the other hand, after traveling, the hybrid vehicle shuts down the hybrid system according to the following procedure.
(1) If the integrated controller determines that there is no problem even if the high voltage relay is connected, first the high voltage relay minus is cut off.
Here, it is determined whether the high voltage relay minus has a hardware failure (ON failure) by looking at the voltage drop margin of the inverter.
(2) After confirming that the inverter has been discharged, turn off the high-voltage relay plus.
Further, here, a high voltage relay precharge is connected, and it is determined whether the high voltage relay plus has a hardware failure (ON failure) from the voltage increase margin of the inverter. When the hardware failure diagnosis of the high voltage relay plus is completed, the high voltage relay precharge is cut off.

FIG. 2 shows a high-voltage (high voltage relay 3 to 5) control unit of the integrated controller 11 that performs the above control.
The integrated controller 11 includes a main processing unit (MainCPU) 12 and a sub-processing unit (SubCPU) 13 as main components. An AND circuit 14, a drive circuit 15 and The current monitor circuit 16 is connected as shown in the figure.

The main arithmetic processing unit (MainCPU) 12 performs predetermined arithmetic operations to perform basic control of the hybrid system.
The sub processing unit (SubCPU) 13 checks the P-RUN (main processing unit operation) output from the main processing unit (MainCPU) 12 and uses the serial communication to check the main processing unit (MainCPU) 12. The operation result output is checked, and the main processing unit (MainCPU) 12 is monitored.

The driving of the high voltage relays 3 to 5 is controlled via the AND circuit 14 by both the main processing unit (MainCPU) 12 and the sub-processing unit (SubCPU) 13.
In other words, if the sub-processing unit (SubCPU) 13 detects an abnormality in the main processing unit (MainCPU) 12 by monitoring the main processing unit (MainCPU) 12, the high-voltage relay of the sub-processing unit (SubCPU) 13 Set the output of the output port to 0 (Lo) and shut off the high voltage relays 3-5.

  Conversely, while the sub-processing unit (SubCPU) 13 does not detect an abnormality of the main processing unit (MainCPU) 12 by the above monitoring of the main processing unit (MainCPU) 12, the sub-processing unit (SubCPU) 13 The output of the voltage relay output port is set to 1 (Hi), and the high voltage relays 3 to 5 are controlled ON / OFF according to the calculation result of the main processing unit (MainCPU) 12 via the drive circuit 15.

The current flowing through the solenoids of the high voltage relays 3 to 5 via the drive circuit 15 is detected by the current monitor 16, and the detected current value is transmitted to the main arithmetic processing unit (MainCPU) 12.
Thereby, the main arithmetic processing unit (MainCPU) 12 can monitor the current flowing through the solenoids of the high voltage relays 3 to 5, and can determine the connection state of the high voltage relays 3 to 5 from the monitoring result.

[Failure diagnosis]
The failure diagnosis of the electronic control system is performed as follows by the integrated controller 11 repeatedly executing the control program shown in FIG. 3 at regular intervals (for example, 10 ms).
First, in step S11, it is determined whether or not the control system is not affected even if the high voltage relays 3 to 5 are disconnected.
Here, “the control system is not affected even if the high voltage relays 3 to 5 are cut off” means, for example, before connection of the high voltage relay at the time of starting the system or after shutdown of the hybrid system.

While it is determined in step S11 that the control system is affected when the high voltage relays 3 to 5 are interrupted, the control is terminated as it is so that the failure diagnosis of the electronic control system is not performed.
As a result, it is possible to avoid the adverse effect that the failure diagnosis accompanied by the interruption of the high-voltage relays 3 to 5 is performed even though the control system is affected.
If it is determined in step S11 that the control system is not affected even if the high voltage relays 3 to 5 are disconnected, the control proceeds to step S12.

In step S12, it is determined whether or not the solenoid connection between the integrated controller 11 and the high voltage relays 3 to 5 is normal (no connection abnormality has occurred).
For example, when the connection is short-circuited (12V system power supply is applied), the main processing unit (MainCPU) 12 detects that the current is always flowing to the relay solenoid through the current monitor circuit 16, and the connection Is determined to be abnormal (causing an abnormal connection).
Therefore, step S12 corresponds to the strong electric system control circuit abnormality determination means in the present invention.

While it is determined in step S12 that the solenoid connection between the integrated controller 11 and the high voltage relays 3 to 5 is not normal (the wiring abnormality has occurred), the control is terminated as it is and a failure diagnosis of the electronic control system is performed. Do not.
As a result, even if the fault diagnosis of the control system is performed due to the above-described connection abnormality, the trouble that the fault diagnosis is performed is avoided even though the fault of the control system cannot be diagnosed.
If it is determined in step S12 that the solenoid connection between the integrated controller 11 and the high-voltage relays 3 to 5 is normal (no connection abnormality has occurred), the control proceeds to step S13, and the control system failure diagnosis is performed. Let it begin.

In this fault diagnosis, first, in step S14, the P-RUN (main arithmetic processing unit operation) signal from the main arithmetic processing unit (MainCPU) 12 to the sub arithmetic processing unit (SubCPU) 13 is stopped for fault diagnosis. The failure information for diagnosis is transmitted from the main processing unit (MainCPU) 12 to the sub-processing unit (SubCPU) 13.
Therefore, step S14 corresponds to diagnostic failure information transmitting means in the present invention.

In the next step S15, it is determined whether or not the sub-processing unit (SubCPU) 13 has commanded the high voltage relays 3 to 5 to be cut off.
As the determination method, information may be acquired from the sub-processing unit (SubCPU) 13 through serial communication.
If it is not determined in step S15 that the sub-processing unit (SubCPU) 13 has instructed to shut off the high voltage relays 3 to 5 (fail-safe function), it does not support the transmission of diagnostic failure information in step S14. From this, it is diagnosed as “failure” and the control is terminated as it is.
Therefore, step S15 corresponds to the fail safe function determining means in the present invention.

If it is determined in step S15 that the sub-processing unit (SubCPU) 13 has commanded the high-voltage relays 3 to 5 to be cut off, it is diagnosed as “normal” because it corresponds to the transmission of diagnostic failure information in step S14. Then, control proceeds to step S16.
In this step S16, the output port related to the negative high voltage relay 4 and the output port related to the precharge high voltage relay 5 of the main processing unit (MainCPU) 12 are set to 1 (Hi), respectively, and the high voltage relays 4, 5 The connection command is issued.

In the next step S17, the solenoid currents of the negative high voltage relay 4 and the precharge high voltage relay 5 are also changed in response to the cutoff command determination of the high voltage relays 3 to 5 in step S15 also by the process of step S16. Check if it is not flowing.
Despite the disconnection command determination of the high voltage relays 3 to 5 in step S15, it is determined in step S17 that the solenoid current of the negative high voltage relay 4 and precharge high voltage relay 5 is flowing by the process in step S16. In this case, since the drive circuits of the minus side high voltage relay 4 and the precharge high voltage relay 5 are out of order, a diagnosis of “failure” is made and the control is terminated as it is.
Therefore, step S17 corresponds to the system state determination means in the present invention.

  If it is determined in step S17 that the solenoid current of the negative high-voltage relay 4 and precharge high-voltage relay 5 is not flowing, in response to the high-voltage relay 3 to 5 cutoff command determination in step S15, step S16 Because the solenoid current of the negative high-voltage relay 4 and precharge high-voltage relay 5 does not flow even after the process of step 1, the drive circuits of the negative high-voltage relay 4 and precharge high-voltage relay 5 are diagnosed as “normal”. Then, the control proceeds to step S18.

  When performing fault diagnosis in the phase where the high voltage relays 3 to 5 are shut off after traveling, it is determined that the high voltage relays 3 to 5 are not in a hardware fault (ON fault) from the voltage drop margin of the inverter 2 You can also.

  In this step S18, the output port related to the negative high voltage relay 4 and the output port related to the precharge high voltage relay 5 of the main processing unit (MainCPU) 12 are set to 0 (Lo), respectively, and the high voltage relay 4, In addition to issuing a disconnection command 5, the output port related to the positive high voltage relay 3 of the main processing unit (MainCPU) 12 is set to 1 (Hi) and a connection command for the high voltage relay 3 is issued.

In the next step S19, the disconnection command determination of the high voltage relays 3 to 5 in step S15 and the disconnection command of the high voltage relays 4 and 5 in step S18 also by the connection command for the high voltage relay 3 in step S18. Correspondingly, it is checked whether the solenoid current of the plus side high voltage relay 3 is not flowing.
Despite the disconnection command determination of high-voltage relays 3 to 5 in step S15 and the disconnection command for high-voltage relays 4 and 5 in step S18, the high-voltage relay 3 connection command in step S18 If it is determined in step S19 that the solenoid current of the relay 3 is flowing, the drive circuit of the plus-side high-voltage relay 3 is faulty, so that “failure” is diagnosed and the control is terminated.
Therefore, step S19 corresponds to the system state determination means in the present invention.

  As described above, step S15 corresponds to the fail safe function determining means in the present invention, and step S17 and step S19 correspond to the system state determining means in the present invention, respectively, and step S15 (fail safe function determining means) and Step S17 and step S19 (system state determination means) constitute fail-safe abnormality determination means in the present invention.

  When it is determined in step S19 that the solenoid current of the positive high-voltage relay 3 is not flowing, the high-voltage relay 3 to 5 cutoff command determination in step S15 and the high-voltage relays 4 and 5 cutoff command in step S18 Corresponding to the above, because the solenoid current of the positive high voltage relay 3 is not flowing even by the connection command of the high voltage relay 3 in step S18, the drive circuit of the positive high voltage relay 3 is diagnosed as “normal”. To finish the control.

  When performing fault diagnosis in the phase where the high-voltage relays 3 to 5 are disconnected after traveling, the positive-side high-voltage relay 3 has a hardware failure due to the voltage increase of the inverter 2 by connecting the precharge high-voltage relay 5 It can also be determined that (ON failure) has not occurred.

[Effect]
In the above-described failure diagnosis apparatus for an electronic control system according to the present embodiment, diagnosis failure information is transmitted from the main processing unit (MainCPU) 12 to the sub-processing unit (SubCPU) 13 (step S14). In response to the failure information, when the electronic control system does not enter the non-energized state of the high voltage relays 3 to 5 to be obtained by the fail safe function of the sub-processing unit (SubCPU) 13 (NO in step S17 and step S19) In order to determine that the fail-safe function of the electronic control system is not working properly, the main processor unit (MainCPU) Instead of knowing for the first time when there are 12 failures, you can know in advance.

  For this reason, if the main processing unit (MainCPU) 12 fails, the sub-processing unit (SubCPU) 13 is diagnosed in advance to determine whether it is in a normal state that can reliably perform the intended failsafe function. The reliability of the fail-safe function by the arithmetic processing unit (SubCPU) 13 can be increased, and the original fail-safe function can be surely achieved.

  In addition, the electronic control system responds to the failure information for diagnosis (Step S14) from the main processing unit (MainCPU) 12 to the sub-processing unit (SubCPU) 13, and the fail-safe function of the sub-processing unit (SubCPU) 13 Fail-safe abnormality determination that the fail-safe function of the electronic control system is not functioning normally when the high-voltage relays 3 to 5 to be obtained by the above are not de-energized (when NO is determined in step S17 and step S19) At this time, whether the sub-processing unit (SubCPU) 13 does not perform the fail-safe function in response to the diagnostic failure information (step S14) (step S15), the sub-processing unit (SubCPU) 13 performs this fail-safe function. Even so, the electronic control system is in a state that should be obtained by the fail-safe function of the sub-processing unit (SubCPU) 13. To determine whether not (steps S17 and step S19), can be determined to distinguish these two, it is easy to failure countermeasure.

  Furthermore, the above-mentioned failure diagnosis of the electronic control system can be performed in the same way as before the connection of the high-voltage system where the high-voltage system of the electronic control system is cut off or after the high-voltage system is cut off. Even if the high-voltage relays 3 to 5 are disconnected for diagnosis, the operation of the electronic control system is not affected (step S11). There can be no influence on.

  In addition, since the fault diagnosis of the electronic control system is prohibited when the high-voltage control circuit of the electronic control system has a connection abnormality (step S12), the fault diagnosis of the electronic control system is impossible due to the connection abnormality. Regardless, this trouble diagnosis can be avoided.

  Furthermore, if the positive control system and the negative control system are individually cut off as shown in the example, failure diagnosis of the electronic control system is performed separately for the positive control system and the negative control system. (Step S16 to step S19), it is possible to specify whether the fault location is the positive side strong electric system or the negative side strong electric system of the electronic control system, and it is easy to take countermeasures against the failure.

In the above-described embodiment, the case where the failure diagnosis target is an electronic control system of a hybrid vehicle has been explained.
Needless to say, the present invention is not limited to an electronic control system for a hybrid vehicle, and can be used in any control system to achieve the same effects.

It is a circuit diagram which illustrates the high electric circuit of the hybrid drive device incorporating the failure diagnosis apparatus which becomes one Example of this invention. FIG. 2 is a block diagram showing a control unit of an integrated controller for the high-voltage circuit of FIG. 3 is a flowchart showing a failure diagnosis program executed by the integrated controller of FIG.

Explanation of symbols

1 High voltage battery 2 Inverter 3 Positive high voltage relay 4 Negative high voltage relay 5 Precharge high voltage relay
MG motor / generator
11 Integrated controller
12 Main processing unit
13 Sub-processing unit
14 AND circuit
15 Drive circuit
16 Current monitor circuit

Claims (5)

In an electronic control system comprising a plurality of arithmetic processing units, and when one arithmetic processing unit has an abnormality, the other arithmetic processing unit performs a fail-safe function.
Diagnostic fault information transmitting means for transmitting diagnostic fault information from the one arithmetic processing unit to the other arithmetic processing unit;
Fail-safe function determination for determining whether the other arithmetic processing unit has commanded the fail-safe function in response to diagnostic failure information from the one arithmetic processing unit to the other arithmetic processing unit by the means Means,
System state determination means for determining whether or not the electronic control system is in a state to be obtained by the fail-safe function of the other arithmetic processing unit;
Whether the fail-safe function by the other arithmetic processing unit is abnormal by the fail-safe function determining unit and the system state determining unit, or whether the electronic control system is not normally responding to the fail-safe function. A failure diagnosis apparatus for an electronic control system, characterized in that the determination is made by distinguishing between the two . In the failure diagnosis device for an electronic control system according to claim 1, wherein the fail-safe function is to cut off a strong electric system of the electronic control system.
A failure diagnosis apparatus for an electronic control system, characterized in that the failure diagnosis of the electronic control system is performed at a stage before connection of a strong electric system where the high electric system of the electronic control system is interrupted. In the failure diagnosis device for an electronic control system according to claim 1 or 2 , wherein the fail-safe function is to cut off a strong electric system of the electronic control system.
A failure diagnosis apparatus for an electronic control system, characterized in that the failure diagnosis of the electronic control system is performed at a stage after the strong electric system is shut off, where the strong electric system of the electronic control system is shut off. In the failure diagnosis device for an electronic control system according to any one of claims 1 to 3 , wherein the fail-safe function is to cut off a strong electric system of the electronic control system.
A high-power control circuit abnormality determining means for determining whether or not the high-power control circuit of the electronic control system has a wiring abnormality;
A fault diagnosis apparatus for an electronic control system, characterized in that the fault diagnosis of the electronic control system is prohibited when the strong electric system control circuit abnormality determination means determines a connection abnormality of the high electric system control circuit. In the failure diagnosis apparatus for an electronic control system according to any one of claims 1 to 3 , wherein the fail-safe function is to individually block the positive-side strong electric system and the negative-side strong electric system of the electronic control system.
A fault diagnosis apparatus for an electronic control system, wherein the fault diagnosis of the electronic control system is performed individually for the plus-side high-voltage system and the minus-side high-voltage system.

Images