JP2016031631A - Vehicle control device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a vehicle control device capable of outputting a correct arithmetic result even if one of two control arithmetic units is abnormal and preventing the abnormality from disturbing vehicle travel.SOLUTION: A first comparison unit 35 determines whether an arithmetic result of a first control arithmetic unit 31 matches an arithmetic result of a second control arithmetic unit 33. A second comparison unit 36 determines whether the first control arithmetic unit 31 is normal, and a third comparison unit 37 determines whether the second arithmetic unit 33 is normal. A determination unit 38 determines whether a failure is a single failure that one of the two control arithmetic units 31 and 33 is abnormal and the other is normal on the basis of determination results of the second and third comparison units 36 and 37 if the first comparison unit 35 determines that the arithmetic result of the first control arithmetic unit 31 does not match the arithmetic result of the second control arithmetic unit 33, and identifies a normal control arithmetic unit out of the two control arithmetic units 31 and 33 and outputs the arithmetic result of the normal control arithmetic unit if determining the failure is the single failure.SELECTED DRAWING: Figure 2

Description

  The present invention relates to a vehicle control device that controls a drive source mounted on a vehicle.

  In recent electronically controlled vehicles, as a technique for ensuring safety, for example, there is one described in Patent Document 1 (Japanese Patent Laid-Open No. 2003-15743). The main CPU of the computer that controls the vehicle executes various calculations based on the input data, and the sub CPU executes the same calculation process as the main CPU, and the comparison device performs the calculation results of the main CPU and the sub CPU. Compare the result of the operation. As a result, when the calculation result of the main CPU matches the calculation result of the sub CPU, it is determined as normal and the calculation result of the main CPU of this computer is output. On the other hand, if the calculation result of the main CPU and the calculation result of the sub CPU do not match, it is determined that there is an abnormality (failure), and neither the calculation result of the main CPU of the computer nor the calculation result of the sub CPU is output ( The result of another computer's operation is output).

JP 2003-15743 A

  By the way, the present applicant is researching the following system in order to ensure the safety of the hybrid vehicle. An ECU (electronic control unit) that controls a drive source (engine or motor) of the hybrid vehicle executes a calculation for controlling the drive source by the first control calculation unit and a first control calculation unit by the first control calculation unit. The control unit performs the same calculation, and the comparison unit determines whether the calculation result of the first control calculation unit and the calculation result of the second control calculation unit match. Further, the first monitoring unit determines whether or not the first control calculation unit is normal, and the second monitoring unit determines whether or not the second control calculation unit is normal. As a result, when the calculation result of the first control calculation unit and the calculation result of the second control calculation unit do not match, it is determined that the control calculation for the drive source (calculation for controlling the drive source) is abnormal. Thus, both the calculation result of the first control calculation unit and the calculation result of the second control calculation unit are not output regardless of the determination results of the first monitoring unit and the second monitoring unit. Further, as a fail-safe process, for example, when it is determined that the control calculation for the motor is abnormal, the motor is stopped and the vehicle is driven by the engine power. When it is determined that the control calculation for the engine is abnormal, the engine And run with the power of the motor.

  However, when the calculation result of the first control calculation unit and the calculation result of the second control calculation unit do not match, only one of the first control calculation unit and the second control calculation unit is abnormal. The other may be normal. In such a case, in the above system, although the other control calculation unit is normal, the normal control calculation unit cannot be specified, so the calculation result of the normal control calculation unit (correct calculation result) Cannot be output. For this reason, the driving force of the vehicle is greatly limited by the fail-safe process, and there is a possibility that the vehicle travels.

  Therefore, the problem to be solved by the present invention is that even when one of the two control calculation means is abnormal, it is possible to output a correct calculation result and prevent the vehicle from being hindered. An object of the present invention is to provide a control device for a vehicle that can be used.

  In order to solve the above-mentioned problems, the invention according to claim 1 is a vehicle control device for controlling a drive source (10, 11, 12) mounted on a vehicle, and controls the drive source (10, 11, 12). A first control calculation means (31) that performs a calculation for the first control calculation means, a second control calculation means (33) that performs the same calculation as the first control calculation means (31), and a first control calculation means ( 31) first monitoring operation means (32) for performing an operation for monitoring, second monitoring operation means (34) for performing an operation for monitoring the second control operation means (33), A first comparison means (35) for determining whether or not the calculation result of the first control calculation means (31) and the calculation result of the second control calculation means (33) match, and a first control calculation The calculation result of the means (31) is compared with the calculation result of the first monitoring calculation means (32) to The second comparison means (36) for determining whether the control calculation means (31) is normal, the calculation result of the second control calculation means (33), and the calculation result of the second monitoring calculation means (34) And the third comparison means (37) for determining whether or not the second control calculation means (33) is normal, the determination result of the first comparison means (35) and the second comparison means ( 36) Based on the determination result of 36) and the determination result of the third comparison means (37), whether the calculation result of the first control calculation means (31) and the calculation result of the second control calculation means (33) can be output. Determination means (38), and the determination means (38) is the first comparison means (35), the calculation result of the first control calculation means (31) and the second control calculation means (33). When it is determined that the calculation result of the second comparison means does not match, the determination result of the second comparison means (36) and the third comparison Based on the determination result of the stage (37), it is determined whether one of the first control calculation means (31) and the second control calculation means (33) is abnormal and the other is a normal single failure. In addition, when it is determined that the single failure has occurred, a normal control calculation means is identified from the first control calculation means (31) and the second control calculation means (33), and the normal control calculation means An operation result is output.

  In this way, when only one of the first control calculation means and the second control calculation means is abnormal and the other is normal, the first control calculation means and the second control calculation means It is possible to specify a normal control calculation means among the control calculation means and output a calculation result (correct calculation result) of the normal control calculation means. As a result, when one of the two control calculation means performing the same calculation is abnormal, it is possible to avoid a situation in which a correct calculation result cannot be output even though the other control calculation means is normal, and correct calculation is performed. A result can be output and it can be prevented that the vehicle travels.

FIG. 1 is a diagram showing a schematic configuration of a hybrid vehicle drive control system in Embodiment 1 of the present invention. FIG. 2 is a block diagram showing a monitoring function of control calculation of the ECU. FIG. 3 is a diagram illustrating a determination method of the determination unit. FIG. 4 is a diagram illustrating the fail-safe process according to the first embodiment. FIG. 5 is a time chart for explaining the weak torque limitation of the first embodiment. FIG. 6 is a diagram illustrating a schematic configuration of a drive control system for a hybrid vehicle according to the second embodiment. FIG. 7 is a diagram for explaining fail-safe processing according to the second embodiment. FIG. 8 is a diagram for explaining the weak torque limitation of the third embodiment.

  Hereinafter, some embodiments embodying the mode for carrying out the present invention will be described.

A first embodiment of the present invention will be described with reference to FIGS.
First, a schematic configuration of a drive control system for a hybrid vehicle will be described with reference to FIG.
An engine 10 that is an internal combustion engine, a first motor generator (hereinafter referred to as “first MG”) 11, and a second motor generator (hereinafter referred to as “second MG”) as a drive source (power source) of the vehicle. Yes) 12 is mounted. The output shaft (crankshaft) of engine 10, the rotation shaft of first MG 11, and the rotation shaft of second MG 12 are coupled via power split mechanism 13 (for example, a planetary gear mechanism), and second MG 12 A rotating shaft is connected to an axle 15 via a reduction gear mechanism 14 and the like, and wheels 16 are connected to the axle 15.

  The first inverter 17 that drives the first MG 11 and the second inverter 18 that drives the second MG 12 are connected to the battery 19, respectively. The MGs 11 and 12 are connected to the battery 19 and the power via the inverters 17 and 18, respectively. Is supposed to give and receive.

  The accelerator sensor 20 detects the accelerator opening (the amount of operation of the accelerator pedal), and the shift switch 21 detects the operation position of the shift lever. Further, a brake operation (or a brake operation amount by a brake sensor) is detected by the brake switch 22, and a vehicle speed is detected by the vehicle speed sensor 23.

  The hybrid ECU 24 is a computer that comprehensively controls the entire vehicle, and detects the driving state of the vehicle by reading the output signals of the various sensors and switches described above. The hybrid ECU 24 controls an engine ECU 25 that controls the engine 10, a first MG-ECU 26 that controls the first MG 11 by controlling the first inverter 17, and a second inverter 18 that controls the second inverter 18. Control signals and data signals are transmitted / received to / from the second MG-ECU 27 that controls the MG 12. The hybrid ECU 24 controls the engine 10 and the first and second MGs 11 and 12 according to the driving state of the vehicle by the ECUs 25 to 27.

  Next, the monitoring function of the control calculation of each ECU 24 to 27 will be described based on FIG. In addition, since the monitoring function of control calculation of each ECU24-27 is substantially the same structure, it demonstrates using common drawing (FIG. 2).

  As shown in FIG. 2, the CPUs 28 of the ECUs 24 to 27 are provided with a first core 29 and a second core 30, respectively. The first core 29 is a first control calculation unit 31 (first control calculation means), which is a calculation for controlling the engine 10 and the MGs 11 and 12 based on input data (for example, the engine 11 and the MGs 11 and 12). Control value calculation). In addition, a calculation for monitoring the first control calculation unit 31 based on the input data by the first monitoring calculation unit 32 (first monitoring calculation unit) (for example, normal / abnormal of the first control calculation unit 31) Is performed).

  On the other hand, the second core 30 is a second control calculation unit 33 (second control calculation means), which is the same calculation as that of the first control calculation unit 31, that is, the engine 10 and the MGs 11 and 12 based on input data. The calculation for controlling the is executed. In addition, a calculation for monitoring the second control calculation unit 33 based on the input data by the second monitoring calculation unit 34 (second monitoring calculation unit) (for example, normal / abnormal of the second control calculation unit 33) Is performed).

  In the case of the hybrid ECU 24, the first and second control calculation units 31 and 33 control the calculation for controlling the engine 10 (for example, calculation of the control value of the engine 10) and the first MG 11. Calculation (for example, calculation of the control value of the first MG 11) and calculation for controlling the second MG 12 (for example, calculation of the control value of the second MG 12) are executed. In the case of the engine ECU 25, the first and second control calculation units 31 and 33 execute calculations for controlling the engine 10. In the case of the first MG-ECU 26, the first and second control calculation units 31 and 33 execute a calculation for controlling the first MG 11. In the case of the second MG-ECU 27, the first and second control calculation units 31 and 33 execute calculation for controlling the second MG 12.

  Further, the CPU 28 determines whether or not the calculation result of the first control calculation unit 31 and the calculation result of the second control calculation unit 33 coincide with each other in the first comparison unit 35 (first comparison unit). judge. In addition, the second comparison unit 36 (second comparison unit) compares the calculation result of the first control calculation unit 31 with the calculation result of the first monitoring calculation unit 32 to compare the calculation result of the first control calculation unit 31 with the first control calculation unit 31. Whether or not is normal. Furthermore, the third comparison unit 37 (third comparison unit) compares the calculation result of the second control calculation unit 33 with the calculation result of the second monitoring calculation unit 34 to compare the calculation result of the second control calculation unit 33 with the second control calculation unit 33. Whether or not is normal. Each of the first to third comparison units 35 to 37 performs determination in multiple (for example, double) by each lock step core (for example, a dual lock step core in which two cores monitor each other's operation). ing.

  Thereafter, the determination unit 38 (determination means) performs the first control based on the determination result of the first comparison unit 35, the determination result of the second comparison unit 36, and the determination result of the third comparison unit 37. Whether the calculation result of the calculation unit 31 and the calculation result of the second control calculation unit 33 can be output is determined. Note that the determination unit 38 performs determination in multiple (for example, double) by using a lock step core (for example, a dual lock step core in which two cores monitor each other's operation).

The determination method of this determination part 38 is demonstrated using FIG.
Here, when the determination result of the first comparison unit 35 is “◯”, it is determined that “the calculation result of the first control calculation unit 31 and the calculation result of the second control calculation unit 33 match”. And the determination result of the first comparison unit 35 is “x”, “the calculation result of the first control calculation unit 31 and the calculation result of the second control calculation unit 33 do not match (do not match)” It means that it was determined.

  When the determination result of the second comparison unit 36 is “◯”, it is determined that “the first control calculation unit 31 is normal”, and when the determination result of the second comparison unit 36 is “×”, “first” This means that the control calculation unit 31 has determined “abnormal”.

  When the determination result of the third comparison unit 37 is “◯”, it means that “the second control calculation unit 33 is normal”, and when the determination result of the third comparison unit 37 is “x”, This means that the control calculation unit 33 has determined “abnormal”.

  (a) When all the determination results of the first to third comparison units 35 to 37 are “◯”, both the first control calculation unit 31 and the second control calculation unit 33 determine that they are normal. The calculation result of the first control calculation unit 31 is output (or the calculation result of the second control calculation unit 33 may be output).

  (b) When the determination result of the first comparison unit 35 is “◯” and the determination results of the second and third comparison units 36 and 37 are both “x”, the second and third comparisons It is determined that the systematic abnormality of the units 36 and 37 (abnormality that always occurs in a specific situation such as a software bug), and both the first control calculation unit 31 and the second control calculation unit 33 are determined to be normal. To do. In this case, the calculation result of the first control calculation unit 31 is output (or the calculation result of the second control calculation unit 33 may be output).

  (c), (d) The determination result of the first comparison unit 35 is “◯”, and one of the determination result of the second comparison unit 36 and the determination result of the third comparison unit 37 is “◯”. When the other is “x”, the normal / abnormality of the first control calculation unit 31 and the second control calculation unit 33 cannot be specified, and it is determined that a multiple failure has occurred. In this case, neither the calculation result of the first control calculation unit 31 nor the calculation result of the second control calculation unit 33 is output. (C) Multiplexing when the determination result of the first comparison unit 35 is “◯”, the determination result of the second comparison unit 36 is “◯”, and the determination result of the third comparison unit 37 is “×”. As the failure, for example, a double failure of the first comparison unit 35 and an abnormality of the second control calculation unit 33, a double failure of the second comparison unit 36, or two of the third comparison unit 37 are used. A serious failure is considered. On the other hand, (d) Multiplexing when the determination result of the first comparison unit 35 is “◯”, the determination result of the second comparison unit 36 is “x”, and the determination result of the third comparison unit 37 is “◯”. As the failure, for example, a double failure of the first comparison unit 35 and an abnormality of the first control calculation unit 31, a double failure of the second comparison unit 36, or two of the third comparison unit 37 are used. A serious failure is considered.

  (e) When all the determination results of the first to third comparison units 35 to 37 are “x”, it can be determined that the second and third comparison units 36 and 37 are systematic abnormalities, but the first control The normality / abnormality of the calculation unit 31 and the second control calculation unit 33 cannot be specified, and it is determined that multiple failures have occurred. In this case, neither the calculation result of the first control calculation unit 31 nor the calculation result of the second control calculation unit 33 is output. As a multiple failure in this case, for example, a double failure of the first comparison unit 35 and a systematic abnormality of the comparison units 36 and 37, an abnormality of the control calculation units 31 and 33, or the like can be considered.

  (f), (g) The determination result of the first comparison unit 35 is “x”, and one of the determination result of the second comparison unit 36 and the determination result of the third comparison unit 37 is “◯”. When the other is “x”, it is determined that one of the first control calculation unit 31 and the second control calculation unit 33 is abnormal and the other is normal. In this case, if the determination result of the second comparison unit 36 is “◯” and the determination result of the third comparison unit 37 is “x”, the first control calculation unit 31 is normal (the second The control calculation unit 33 is specified as abnormal) and the calculation result of the first control calculation unit 31 is output. On the other hand, (g) If the determination result of the second comparison unit 36 is “x” and the determination result of the third comparison unit 37 is “◯”, the second control calculation unit 33 is normal (first control The calculation unit 31 is specified as abnormal) and the calculation result of the second control calculation unit 33 is output.

  (h) When the determination result of the first comparison unit 35 is “x” and the determination results of the second and third comparison units 36 and 37 are both “◯”, the first control calculation unit 31 The normal / abnormality of the second control calculation unit 33 cannot be specified, and it is determined that a multiple failure has occurred. In this case, neither the calculation result of the first control calculation unit 31 nor the calculation result of the second control calculation unit 33 is output. As the multiple faults in this case, for example, a double fault in the first comparison unit 35 and a double fault in the second comparison unit 36, or a double fault and a third comparison unit in the first comparison unit 35 are used. There are 37 possible double failures.

  In the first embodiment, when it is determined that there is a multiple failure, the fail safe unit 39 (see FIG. 2) executes a fail safe process at the time of multiple failures. On the other hand, if it is determined that there is a single failure, the fail-safe unit 39 executes a fail-safe process for a single failure. The fail safe unit 39 may be provided by a circuit different from the CPU 28. Further, a fail-safe unit that performs fail-safe processing at the time of multiple failures and a fail-safe unit that executes fail-safe processing at the time of a single failure may be provided separately.

  As shown in FIG. 4, in the fail-safe process at the time of multiple failures, (1) when an abnormality occurs in the calculation for controlling the engine 10 or the first MG 11 (the control value of the engine 10 or the first MG 11 is When the output is stopped), the engine 10 and the first MG 11 are stopped, and the vehicle travels with the power of the second MG 12. In this case, the maximum drive torque of the vehicle is limited to the maximum torque Tmax (mg2) of the second MG 12.

  On the other hand, (2) when an abnormality occurs in the calculation for controlling the second MG 12 (when the output of the control value of the second MG 12 is stopped), the second MG 12 is stopped and the engine 10 And it drive | works with the motive power of 1st MG11. In this case, the maximum drive torque of the vehicle is limited to the maximum torque (= direct torque) Tmax (eng, mg1) transmitted through the engine 10 and the power split mechanism 13 (for example, the planetary gear mechanism) of the first MG 11. .

  Furthermore, in the fail-safe process at the time of multiple failure (that is, when it is determined as multiple failure), abnormality notification processing for notifying the occurrence of abnormality (for example, lighting or blinking of a warning lamp, warning display on a warning display unit, Warning sound or sound output).

  On the other hand, in fail-safe processing at the time of a single failure, weak torque restriction is performed to restrict the required torque of the vehicle so weak that it does not hinder the running of the vehicle. Thus, while preventing the vehicle from being hindered, the driver feels a little uncomfortable due to the weak torque limitation to notify the occurrence of an abnormality (single failure). Specifically, as shown in FIG. 5, when the accelerator opening of the vehicle is increased, the weak torque is limited by delaying the change (increase) in the required torque with respect to the change (increase) in the accelerator opening. In this case, for example, the required torque calculated based on the accelerator opening or the like (normal required torque) is subjected to a first-order delay process or a smoothing process to delay the change in the required torque. As a result, even when an abnormality (single failure) occurs, the maximum driving torque of the vehicle can be maintained at the same level as that during normal operation (see FIG. 4).

  Furthermore, in the fail-safe process at the time of a single failure (that is, when it is determined as a single failure), an abnormality notification process for notifying the occurrence of an abnormality (for example, lighting or blinking of a warning lamp, warning at a warning display unit) Display, warning sound or sound output). In the first embodiment, the fail safe unit 39 serves as a torque limiting unit and an abnormality notification unit in the claims.

  By the way, if it is determined that there is a single failure while the vehicle is running, switching from a state without torque limitation due to weak torque limitation to a state with torque limitation stepwise changes the required torque, and torque shock (torque (Shock due to fluctuations) may occur.

  Therefore, the fail-safe unit 39 gradually changes from a state without torque limitation due to weak torque limitation to a state with torque limitation when it is determined that a single failure occurs while the vehicle is running. In this case, for example, the torque limit degree (the delay in the change in the required torque with respect to the change in the accelerator opening) is gradually increased.

  Further, the fail safe unit 39 starts the weak torque limitation, and then when the vehicle is in a safe state, specifically, when the vehicle speed decreases to a predetermined value or less (for example, 20 km / h or less) or When the vehicle control system is stopped (or started after the stop), the weak torque limit is switched to the strong torque limit. In the strong torque limitation, the required torque is limited more strongly than the weak torque limitation (for example, the upper limit value of the required torque is reduced to the extent that retreat travel is possible).

  In addition, after starting fail-safe processing at the time of multiple failure or single failure, when all the determination results of the first to third comparison units 35 to 37 are “◯”, the fail-safe processing is ended. Then, normal control is restored.

  In the first embodiment described above, the determination result of the first comparison unit 35 is “x”, and one of the determination result of the second comparison unit 36 and the determination result of the third comparison unit 37 is “◯”. When the other is “x”, it is determined that one of the first control calculation unit 31 and the second control calculation unit 33 is abnormal and the other is normal. In this case, if the determination result of the second comparison unit 36 is “◯” and the determination result of the third comparison unit 37 is “x”, the first control calculation unit 31 is normal (the second control calculation unit 33 is abnormal), and the calculation result of the first control calculation unit 31 is output. On the other hand, if the determination result of the second comparison unit 36 is “x” and the determination result of the third comparison unit 37 is “◯”, the second control calculation unit 33 is normal (the first control calculation unit 31). And the calculation result of the second control calculation unit 33 is output.

  In this way, when only one of the first control calculation unit 31 and the second control calculation unit 33 is abnormal and the other is normal, the first control calculation unit 31 It is possible to specify a normal control calculation unit in the second control calculation unit 33 and output the calculation result (correct calculation result) of the normal control calculation unit. As a result, when one of the two control calculation units 31, 33 that perform the same calculation is abnormal, a situation in which a correct calculation result cannot be output even though the other control calculation unit is normal is avoided. Thus, it is possible to output a correct calculation result and prevent the vehicle from being hindered.

  In the first embodiment, each of the first to third comparison units 35 to 37 and the determination unit 38 is configured to perform multiple (for example, double) determination using the lockstep core. 37, the reliability of the determination result of the determination unit 38 can be improved.

  Further, in the first embodiment, when it is determined that there is a single failure, fail-safe processing at the time of a single failure is executed. In the fail-safe process at the time of a single failure, weak torque restriction is performed to restrict the required torque of the vehicle so weak that it does not hinder the running of the vehicle. In this way, it is possible to notify the driver of the occurrence of an abnormality (single failure) by making the driver feel a little uncomfortable due to the weak torque limitation while preventing the vehicle from traveling. As a result, the driver can be urged to repair the vehicle, and it is possible to prevent the abnormality (single failure) from being left unattended and resulting in multiple failures.

  In this case, in the first embodiment, when the accelerator opening of the vehicle is increased, the weak torque is limited by delaying the change (increase) in the required torque with respect to the change (increase) in the accelerator opening. In this way, even when an abnormality (single failure) occurs, the maximum driving torque of the vehicle is maintained at the same level as during normal operation, and the driver feels uncomfortable due to a delay in the change of the torque, so that the abnormality (single The occurrence of a single failure) can be notified.

  Further, in the first embodiment, when it is determined that a single failure occurs while the vehicle is traveling, the state is gradually changed from a state without torque limitation due to weak torque limitation to a state with torque limitation. In this way, when it is determined that a single failure occurs while the vehicle is traveling, the required torque can be prevented from changing suddenly, and the occurrence of torque shock can be suppressed.

  Furthermore, in the first embodiment, when the vehicle speed drops below a predetermined value after the start of the weak torque limit or when the vehicle control system is stopped (or at the start after the stop), the weak torque limit is increased. Switch to torque limit. In this way, once the vehicle is in a safe state, such as when the vehicle goes from high speed to low speed or when the vehicle is finished driving, the required torque is strongly limited by the strong torque limit. Thus, it is possible to prevent the vehicle from continuing normal driving with an abnormality (single failure) occurring.

  Further, in the first embodiment, when it is determined as a single failure, an abnormality notification process for notifying the occurrence of an abnormality (for example, lighting or blinking of a warning lamp, warning display on a warning display unit, warning sound or sound) Output etc.). In this way, it is possible to reliably notify the driver of the occurrence of an abnormality (single failure) through the abnormality notification process.

  Next, Embodiment 2 of the present invention will be described with reference to FIGS. However, parts that are substantially the same as those in the first embodiment are denoted by the same reference numerals, and description thereof is omitted or simplified, and parts different from those in the first embodiment are mainly described.

  In the first embodiment, the engine 10 and the two MGs 11 and 12 are mounted as a vehicle drive source. However, in the second embodiment, as shown in FIG. 6, the engine 10 and one MG 11 are used as the vehicle drive source. Is installed. The power of the output shaft (crankshaft) of the engine 10 is transmitted to the transmission 40 through the MG 11 or the like, and the power of the output shaft of the transmission 40 is transmitted to the wheels 16 through the differential gear mechanism 41, the axle 15 or the like. The A rotating shaft of the MG 11 is connected between the engine 10 and the transmission 40 in the power transmission system for transmitting the power of the engine 10 to the wheels 16 so that the power can be transmitted. Further, a first clutch 42 for interrupting power transmission is provided between the engine 10 and the MG 11, and a second clutch 43 for interrupting power transmission is provided between the MG 11 and the transmission 40. Is provided.

The hybrid ECU 24 transmits and receives control signals and data signals between the engine ECU 25 that controls the engine 10 and the MG-ECU 26 that controls the inverter 17 and controls the MG 11, and each ECU 25, 26 responds to the driving state of the vehicle. The engine 10 and the MG 11, etc. are controlled.
The monitoring function of the control calculation of each ECU 24 to 26 is the same as that of the first embodiment (see FIGS. 2 and 3).

  In the second embodiment, as shown in FIG. 7, in the fail-safe process at the time of multiple failures, (1) when an abnormality occurs in the calculation for controlling the engine 10 (output of the control value of the engine 10 is stopped) In the case), the engine 10 is stopped and the vehicle is driven by the power of the MG 11. In this case, the maximum driving torque of the vehicle is limited to the maximum torque Tmax (mg) of MG11. On the other hand, (2) When an abnormality occurs in the calculation for controlling the MG 11 (when the output of the control value of the MG 11 is stopped), the MG 11 is stopped and the vehicle runs with the power of the engine 10. In this case, the maximum driving torque of the vehicle is limited to the maximum torque Tmax (eng) of the engine 10.

  On the other hand, in the fail-safe process at the time of a single failure, as in the first embodiment, when the accelerator opening of the vehicle is increased, a change (increase) in the required torque with respect to the change (increase) in the accelerator opening is delayed. Thus, the weak torque is limited (see FIG. 5). Thus, even when an abnormality (single failure) occurs, the maximum driving torque of the vehicle can be maintained at the same level as that during normal operation (see FIG. 7).

  In the second embodiment described above, substantially the same effects as those of the first embodiment can be obtained.

  Next, Embodiment 3 of the present invention will be described with reference to FIG. However, description of substantially the same parts as those of the first and second embodiments will be omitted or simplified, and different parts from the first and second embodiments will be mainly described.

  In the third embodiment, when the weak torque is limited by the fail-safe process at the time of a single failure, the weak torque is limited by limiting the required torque with a predetermined upper limit guard value as shown in FIG. ing. This upper limit guard value is, for example, higher than the torque upper limit value (maximum torque when some drive sources are stopped) when fail-safe processing at the time of multiple failures is performed so as not to hinder high-speed driving or the like. It is set to a large value. By doing so, it is possible to make the driver feel uncomfortable due to a decrease in the torque upper limit value and to notify the occurrence of an abnormality (single failure).

  In each of the first to third embodiments, when it is determined that there is a single failure, both the weak torque limitation and the abnormality notification process are executed. However, the present invention is not limited to this, and the weak torque limitation and the abnormality notification are performed. Only one of the processes may be executed.

  In the first to third embodiments, the present invention is applied to a hybrid vehicle that uses both the engine and MG as drive sources. However, the present invention is not limited to this, and only a vehicle or motor that uses only the engine as a drive source can be used as a power source. The present invention may be applied to an electric vehicle as a source.

  DESCRIPTION OF SYMBOLS 10 ... Engine (drive source), 11, 12 ... MG (drive source), 31 ... 1st control calculating part (1st control calculating means), 32 ... 1st monitoring calculating part (1st monitoring calculating means) ), 33... Second control arithmetic unit (second control arithmetic means), 34... Second monitoring arithmetic unit (second monitoring arithmetic means), 35... First comparison part (first comparison means). , 36 ... second comparison unit (second comparison unit), 37 ... third comparison unit (third comparison unit), 38 ... determination unit (determination unit), 39 ... fail safe unit (torque limiting unit, Abnormality notification means)

Claims (8)

In a vehicle control device for controlling a drive source (10, 11, 12) mounted on a vehicle,
First control calculation means (31) for performing calculation for controlling the drive source (10, 11, 12);
Second control calculation means (33) for performing the same calculation as the first control calculation means (31);
First monitoring calculation means (32) for performing calculation for monitoring the first control calculation means (31);
Second monitoring calculation means (34) for performing calculation for monitoring the second control calculation means (33);
First comparison means (35) for determining whether or not the calculation result of the first control calculation means (31) matches the calculation result of the second control calculation means (33);
The calculation result of the first control calculation means (31) and the calculation result of the first monitoring calculation means (32) are compared to determine whether or not the first control calculation means (31) is normal. Second comparing means (36);
The calculation result of the second control calculation means (33) and the calculation result of the second monitoring calculation means (34) are compared to determine whether or not the second control calculation means (33) is normal. Third comparing means (37);
Based on the determination result of the first comparison means (35), the determination result of the second comparison means (36), and the determination result of the third comparison means (37), the first control calculation means ( 31) and determination means (38) for determining whether or not to output the calculation result of the second control calculation means (33).
In the determination means (38), the calculation result of the first control calculation means (31) and the calculation result of the second control calculation means (33) coincide with each other in the first comparison means (35). If it is determined that there is not, based on the determination result of the second comparison means (36) and the determination result of the third comparison means (37), the first control calculation means (31) and the It is determined whether one of the second control calculation means (33) is abnormal and the other is a normal single failure. If it is determined that the single failure is the case, the first control calculation means (31) is determined. And a second control calculation means (33), wherein a normal control calculation means is specified and a calculation result of the normal control calculation means is output.   The vehicle according to claim 1, wherein the first comparison means (35), the second comparison means (36), and the third comparison means (37) each make multiple determinations. Control device.   Torque limiting means (39) for performing a weak torque limit that limits the required torque of the vehicle to a level that does not hinder the running of the vehicle when the determination means (38) determines that the single failure has occurred. The vehicle control device according to claim 1, wherein the vehicle control device is provided.   The vehicle control according to claim 3, wherein the torque limiting means (39) performs the weak torque limitation by delaying a change in the required torque with respect to a change in accelerator opening of the vehicle. apparatus.   The vehicle control device according to claim 3, wherein the torque limiting means (39) limits the weak torque by limiting the required torque with a predetermined upper guard value.   When the determination means (38) determines that the single failure occurs while the vehicle is running, the torque limiting means (39) changes from a state without torque limitation due to the weak torque limitation to a state with torque limitation. 6. The vehicle control device according to claim 3, wherein the vehicle control device is gradually changed.   The torque limiting means (39) reduces the required torque when the vehicle speed drops below a predetermined value after starting the weak torque limitation or when the vehicle control system is stopped or started after the stop. The vehicle control device according to claim 3, wherein the vehicle control device switches to a strong torque limit that is stronger than the weak torque limit.   8. An abnormality notifying means (39) for performing a process for notifying the occurrence of an abnormality when said determining means (38) determines that said single failure has occurred. The vehicle control device described in 1.

Images