JP2016115142A - Electronic control device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an electronic control device capable of reducing a processing load.SOLUTION: An electronic control device 100 comprises a vehicle control unit 11 which controls operation of a control object 200, a first monitoring unit 12a and a second monitoring unit 12b which are means for monitoring a plurality of monitoring target objects for determining the occurence of abnormality and which are provided correspondingly to the respective monitoring target objects, and a first verification unit 21a and a second verification unit 21b which are provided correspondingly to the respective monitoring units and which verify whether or not the respective monitoring units are in the state of being able to normally monitor. The electronic control device 100 further comprises: a first selection unit 12c which determines one monitoring target object necessary to be monitored from among the plurality of monitoring target objects and which selects one monitoring unit corresponding to the monitoring target object determined to be monitored between the first monitoring unit 12a and the second monitoring unit 12b; and a second selection unit 21c which selects one verification unit corresponding to the monitoring unit selected by the first selection unit 12c between the first verification unit 21a and the second verification unit 21b.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an electronic control device that controls the operation of a controlled object.

  Conventionally, as an example of an electronic control device, there is a vehicle control device disclosed in Patent Document 1. This vehicle control device has a first level that is a functional level, a second level that is a first level monitoring level, and a third level that is used to protect the computer architecture. In the vehicle control device, each value for setting the torque target value is transmitted to the hybrid drive unit to be controlled within the first functional level. This hybrid drive unit has an internal combustion engine and an electric drive unit. The first level can be said to be control means. The second level can be said to be monitoring means. Furthermore, the third level can be said to be verification means.

  In the vehicle control device, an allowable torque value is input to a comparison stage in the monitoring unit, and an actual torque value is input as a monitoring target for determining occurrence of abnormality. The actual torque value is output from the internal combustion engine and the electric drive unit. The comparison stage compares the allowable torque value with the actual torque value. In the vehicle control device, the error action unit is activated when the actual torque value exceeds the allowable torque value.

Special table 2009-522153

  By the way, the vehicle control apparatus which is an example of an electronic control apparatus always monitors the monitoring target. However, the electronic control device does not necessarily need to constantly monitor all the monitoring targets. That is, the electronic control unit may monitor only one of a plurality of monitoring targets at a certain timing. The electronic control device has a problem that if all the monitoring targets are constantly monitored, unnecessary monitoring targets are also monitored, so that the processing load increases.

  The present invention has been made in view of the above problems, and an object thereof is to provide an electronic control device capable of reducing the processing load.

In order to achieve the above object, the present invention provides:
A control means (11) for controlling the operation of the control object and a means for monitoring a plurality of monitoring objects for determining the occurrence of an abnormality that requires the operation of the control object to be stopped, provided corresponding to each of the monitoring objects A plurality of monitoring means (12a, 12b),
It is means for verifying whether or not each monitoring means can be normally monitored, and comprises a plurality of verification means (21a, 21b) provided corresponding to each of the monitoring means. ,
Each monitoring means determines the occurrence of an abnormality, and when it is determined that an abnormality occurs, the operation of the controlled object controlled by the control means is forcibly stopped,
Each verification means is an electronic control device for forcibly stopping the operation of the controlled object controlled by the control means when it is determined that the state is not normally monitored,
A first selection unit (12c) for determining one of the plurality of monitoring targets that needs monitoring, and selecting one of the plurality of monitoring units corresponding to the monitoring target determined to be monitored;
A second selection means (21c) for selecting one of the plurality of verification means corresponding to the monitoring means selected by the first selection means;
Only the monitoring means selected by the first selection means among the plurality of monitoring means executes monitoring, and only the verification means selected by the second selection means among the plurality of verification means executes verification. Features.

  As described above, the present invention selects one monitoring unit corresponding to the monitoring target that needs to be monitored from among the plurality of monitoring units, and also selects one verification unit corresponding to the monitoring unit. In the present invention, only one selected monitoring unit executes monitoring, and only the verification unit provided corresponding to this monitoring unit executes verification. That is, according to the present invention, when monitoring is performed by one monitoring unit corresponding to a monitoring target that requires monitoring, and verification by a verification unit corresponding to this monitoring unit is performed, monitoring by another monitoring unit, and other There is no need for verification by a verification means. Therefore, the present invention can reduce the processing load as compared with the case where monitoring by a plurality of monitoring units and verification by a plurality of verification units are always performed.

  The reference numerals in parentheses described in the claims and in this section indicate the correspondence with the specific means described in the embodiments described later as one aspect, and the technical scope of the invention is as follows. It is not limited.

It is a block diagram showing a schematic structure of an electronic control unit in an embodiment. It is a flowchart which shows the processing operation of the electronic control apparatus in embodiment. 10 is a flowchart showing a processing operation of an electronic control device according to Modification 1. 10 is a flowchart showing a processing operation of an electronic control device according to Modification 2.

  Hereinafter, a plurality of embodiments for carrying out the invention will be described with reference to the drawings. In each embodiment, portions corresponding to the matters described in the preceding embodiment may be denoted by the same reference numerals and redundant description may be omitted. In each embodiment, when only a part of the configuration is described, the other configurations described above can be applied to other portions of the configuration.

  In the present embodiment, as shown in FIG. 1, an example in which the present invention is applied to an electronic control device 100 is employed.

  The electronic control device 100 is an in-vehicle electronic device mounted on a car. Further, the automobile includes an engine and a motor as power sources, and a battery that supplies electric power to the motor. Further, the battery is configured to be rechargeable via a charging plug from a public charging facility or a household outlet. In other words, the automobile is configured such that the battery can be charged via a charging plug that can be attached to and detached from the automobile. That is, the automobile is a so-called plug-in hybrid automobile.

  The electronic control device 100 includes a first processing unit 10 and a second processing unit 20, and controls the control target 200.

  In this embodiment, as an example, a control object 200 including an electronic throttle that adjusts the amount of intake air to the engine and a battery device that connects and disconnects the electrical connection state between the battery and the charging plug is adopted. ing. The control target 200 operates according to a control signal from the electronic control device 100. The electronic throttle, which is a part of the controlled object 200, opens and closes the throttle valve according to a control signal from the electronic control device 100. On the other hand, the battery device that is a part of the control target 200 performs an opening / closing operation of a relay interposed between the battery and the charging plug in response to a control signal from the electronic control device 100. In other words, the battery device establishes an electrical connection between the battery and the charging plug by closing the relay, and opens an electrical connection between the battery and the charging plug by opening the relay. Set the connection status to disconnected. Further, as will be described in detail later, the control target 200 stops its operation in response to a stop signal from the electronic control device 100.

  The electronic control device 100 has a three-level monitoring concept. The electronic control device 100 includes a vehicle control unit 11 as level 1, an emergency stop determination unit 12 as level 2, and a function verification unit 21 as level 3. In the electronic control device 100, the first processing unit 10 includes a vehicle control unit 11 and an emergency stop determination unit 12, and the second processing unit 20 includes a function verification unit 21. That is, the 1st process part 10 is provided with the vehicle control part 11 and the emergency stop determination part 12 as a functional block. On the other hand, the 2nd monitoring part 12b is provided with the function verification part 21 as a functional block. Further, in the electronic control device 100, the first processing unit 10 includes a first selection unit 12c, and the second processing unit 20 includes a second selection unit 21c.

  Moreover, the 1st process part 10 is comprised by CPU. On the other hand, the second processing unit 20 is configured by a CPU different from the first processing unit 10. That is, the first processing unit 10 and the second processing unit 20 are provided separately. In addition to the first processing unit 10 and the second processing unit 20, the electronic control apparatus 100 includes a storage unit such as a ROM, a RAM, a register, and a microcomputer including an I / O. That is, the first processing unit 10 and the second processing unit 20 can be said to be part of the microcomputer. Each of the first processing unit 10 and the second processing unit 20 executes a program stored in the ROM according to a predetermined order while using a temporary storage function of a RAM or a register, and also via an I / O. Signal processing is performed according to the acquired signal. Therefore, the electronic control unit 100 is configured to include hardware such as the first processing unit 10, the second processing unit 20, a storage unit, and I / O, and software such as a program stored in the ROM. I can say that.

  CPU is an abbreviation for Central Processing Unit. ROM is an abbreviation for Read Only Memory. RAM is an abbreviation for Random Access Memory. I / O is an abbreviation for Input / Output. Moreover, the 2nd process part 20 may be comprised by ASIC. ASIC is an abbreviation for Application Specific Integrated Circuit.

  Note that the vehicle control unit 11 and the emergency stop determination unit 12 share the storage unit of the electronic control device 100. Similarly, the first monitoring unit 12a, the second monitoring unit 12b, and the first selection unit 12c share the storage unit of the electronic control device 100.

  The vehicle control unit 11 controls the operation of the controlled object 200 and corresponds to the control means in the claims. The vehicle control unit 11 controls the operation of the control target 200 by outputting a control signal to the control target 200.

  The emergency stop determination unit 12 includes a first monitoring unit 12a and a second monitoring unit 12b. The first monitoring unit 12a corresponds to the first monitoring unit in the claims. On the other hand, the 2nd monitoring part 12b is corresponded to the 2nd monitoring means in a claim. Specifically, the emergency stop determination unit 12 is a means for monitoring a plurality of monitoring targets for determining the occurrence of an abnormality that requires the operation of the control target 200 to be stopped, and is provided corresponding to each monitoring target. The first monitoring unit 12a and the second monitoring unit 12b are provided.

  Each of the first monitoring unit 12a and the second monitoring unit 12b determines the occurrence of an abnormality, and when it is determined that an abnormality occurs, the operation of the control target 200 is urgently stopped. That is, each of the first monitoring unit 12a and the second monitoring unit 12b forcibly stops the operation of the control target 200 controlled by the vehicle control unit 11 when it is determined that an abnormality occurs. Each of the first monitoring unit 12a and the second monitoring unit 12b outputs a stop signal to the control target 200 to forcibly stop the operation of the control target 200. That is, this stop signal has priority over the control signal output from the vehicle control unit 11.

  The first monitoring unit 12a monitors whether the vehicle overruns as one of a plurality of monitoring targets. That is, the first monitoring unit 12a monitors whether or not the vehicle is overrun as a monitoring target in order to determine the occurrence of an abnormality that requires the electronic throttle to stop operating. In other words, the first monitoring unit 12a monitors whether the vehicle overruns as a monitoring target for determining occurrence of an abnormality that requires the vehicle to stop traveling. The first monitoring unit 12a monitors whether or not the vehicle overruns based on a plurality of information such as the depression state of the accelerator pedal of the vehicle and the presence or absence of torque. Therefore, it can be said that the first monitoring unit 12a monitors the monitoring target based on a plurality of pieces of information.

  Note that the electronic throttle operation stop means that the throttle valve is not opened, and the throttle valve is changed from the open state to the closed state. The overrun here indicates that the vehicle travels even though the driver does not intend to drive the vehicle.

  The second monitoring unit 12b monitors whether or not an abnormality occurs when charging the battery via the charging plug as one of a plurality of monitoring targets. That is, the second monitoring unit 12b monitors whether or not an abnormality occurs when charging the battery as a monitoring target in order to determine the occurrence of an abnormality that requires the operation of the battery device to be stopped. The abnormality that occurs when charging the battery is, for example, overcharging or fire hazard. The second monitoring unit 12b monitors whether or not an abnormality occurs when charging the battery based on a plurality of information such as the temperature and voltage of the battery. Therefore, it can be said that the second monitoring unit 12b monitors the monitoring target based on a plurality of information. Note that the operation stop of the battery device is to stop the closed state of the relay and to change the relay from the closed state to the open state.

  Furthermore, the emergency stop determination unit 12 includes a first selection unit 12c. The 1st selection part 12c is equivalent to the 1st selection means in a claim. The first selection unit 12c determines one of the plurality of monitoring targets that needs to be monitored and one of the first monitoring unit 12a and the second monitoring unit 12b that corresponds to the monitoring target determined to be monitored Select. In other words, it can be said that the first selection unit 12c switches the monitoring unit to be operated to either the first monitoring unit 12a or the second monitoring unit 12b in accordance with the monitoring target determined to be monitored.

  The first selection unit 12c determines one monitoring target that needs to be monitored based on the environmental state signal. As the environmental state signal, for example, a signal indicating whether or not a charging plug is attached to the automobile is employed. That is, the 1st selection part 12c can judge whether it is a connection state where the charge plug is attached to the automobile, or a non-connection state where the charge plug is not attached to the automobile based on the environmental state signal. Then, when the charging plug is in a connected state, the first selection unit 12c determines that it is necessary to monitor whether or not an abnormality occurs when charging the battery via the charging plug, and selects the second monitoring unit 12b. . Further, when the charging plug is in a disconnected state, the first selection unit 12c determines that it is necessary to monitor whether or not the vehicle overruns and selects the first monitoring unit 12a. Thus, the environmental state signal is a signal indicating switching of the monitoring target, and corresponds to the switching signal in the claims. The connection state of the charging plug can also be referred to as plug-in charging.

  The environmental state signal may be an on signal or an off signal output from a switch that is turned on when the charging plug is attached to the automobile and turned off when the charging plug is removed from the automobile. Therefore, the first selection unit 12c determines whether the charging plug is in a connected state or a non-connected state based on the on signal and the off signal output from the switch. For this reason, it can be said that the 1st selection part 12c can determine easily whether a charge plug is a connection state or a non-connection state. That is, the determination by the first selection unit 12c whether the charging plug is in the connected state or the non-connected state is more than the monitoring of the monitoring target based on the plurality of information by the first monitoring unit 12a and the second monitoring unit 12b. Easy.

  The function verification unit 21 includes a first verification unit 21a, a second verification unit 21b, and a second selection unit 21c.

  The first verification unit 21a and the second verification unit 21b correspond to verification means in the claims. The first verification unit 21a and the second verification unit 21b are means for verifying whether or not each of the first monitoring unit 12a and the second monitoring unit 12b can perform normal monitoring. It is provided corresponding to each of the monitoring unit 12a and the second monitoring unit 12b.

  When it is determined that the first verification unit 21a and the second verification unit 21b are not in a state where monitoring can be performed normally, the operation of the control target 200 is urgently stopped. That is, the first verification unit 21a and the second verification unit 21b forcibly stop the operation of the control target 200 controlled by the vehicle control unit 11 when it is determined that the monitoring cannot be normally performed. .

  The first verification unit 21a is provided corresponding to the first monitoring unit 12a. The first verification unit 21a is in a state in which the first monitoring unit 12a can perform normal monitoring depending on whether hardware or software in the electronic control device 100 used by the first monitoring unit 12a is normal. Verify whether or not.

  For example, the first monitoring unit 12a is set to transmit a verification signal to the first verification unit 21a at a predetermined timing. That is, the first monitoring unit 12a is set to transmit a verification signal spontaneously instead of an instruction from the first verification unit 21a. Then, the first verification unit 21a determines whether the hardware and software used in the first monitoring unit 12a are normal based on the verification signal, so that the first monitoring unit 12a is normal. It is verified whether or not monitoring is possible. In this case, this verification signal can be referred to as a function verification signal.

  In addition, the first verification unit 21a transmits a test signal to the first processing unit 10 to cause the first monitoring unit 12a to execute a process according to the test signal, and an answer signal as a result of the execution is sent. Send it. Then, the first verification unit 21a determines whether the hardware and software used in the first monitoring unit 12a are normal based on the answer signal from the first monitoring unit 12a. It may be verified whether or not the unit 12a is in a state where it can be normally monitored. In this case, the test signal and the answer signal can be referred to as a function verification signal.

  The second verification unit 21b is provided corresponding to the second monitoring unit 12b. The second verification unit 21b is in a state in which the second monitoring unit 12b can perform normal monitoring depending on whether the hardware and software in the electronic control device 100 used by the second monitoring unit 12b are normal. Verify whether or not.

  For example, the second monitoring unit 12b is set to transmit a verification signal to the second verification unit 21b at a predetermined timing. That is, the second monitoring unit 12b is set to transmit a verification signal spontaneously instead of an instruction from the second verification unit 21b. Then, the second verification unit 21b determines whether the hardware and software used in the second monitoring unit 12b are normal based on the verification signal, so that the second monitoring unit 12b is normally operated. It is verified whether or not monitoring is possible.

  The second verification unit 21b transmits a test signal to the first processing unit 10 to cause the second monitoring unit 12b to execute a process according to the test signal, and an answer signal that is the execution result is sent. Send it. And the 2nd verification part 21b determines whether the hardware and software in the electronic controller 100 used by the 2nd monitoring part 12b are normal based on the reply signal from the 2nd monitoring part 12b. Accordingly, the second verification unit 21b may verify whether or not the second monitoring unit 12b is in a state where it can be normally monitored.

  The second selection unit 21c corresponds to second selection means in the claims. The second selection unit 21c selects one of the first verification unit 21a and the second verification unit 21b corresponding to the monitoring unit selected by the first selection unit 12c. For example, like the first selection unit 12c, the second selection unit 21c determines one of the plurality of monitoring targets that needs to be monitored based on the environmental state signal. Then, the second selection unit 21c selects one of the first verification unit 21a and the second verification unit 21b corresponding to the monitoring unit that monitors the monitoring target determined to be monitored. Thus, the second selection unit 21c selects the second verification unit 21b corresponding to the second monitoring unit 12b when the charging plug is in the connected state. Moreover, the 2nd selection part 21c selects the 1st verification part 21a corresponding to the 1st monitoring part 12a, when a charge plug is a non-connecting state.

  The environmental state signal is input in common to the first processing unit 10 and the second processing unit 20. That is, the 2nd selection part 21c can determine whether a charge plug is a connection state or a non-connection state based on the environmental state signal similar to the 1st selection part 12c. Therefore, it can be said that the second selection unit 21c can easily determine whether the charging plug is in a connected state or a disconnected state.

  Here, the processing operation of the electronic control apparatus 100 will be described with reference to FIG. The electronic control device 100 executes the processing shown in the flowchart of FIG. 2 every predetermined time.

  In step S10, it is determined whether or not plug-in charging is in progress. If the electronic control unit 100 determines that plug-in charging is in progress, the electronic control unit 100 proceeds to step S20. More specifically, the first selection unit 12c and the second selection unit 21c determine whether or not plug-in charging is being performed. If the first selection unit 12c determines that plug-in charging is in progress, the first selection unit 12c selects the second monitoring unit 12b on the assumption that it is necessary to monitor whether or not an abnormality occurs when charging the battery via the charging plug. When it is determined that the plug-in charging is being performed, the second selection unit 21c selects the second verification unit 21b corresponding to the second monitoring unit 12b.

  On the other hand, when it is determined that the plug-in charging is not being performed, the electronic control unit 100 proceeds to step S30. If it is determined that the plug-in charging is not being performed, the first selection unit 12c determines that it is necessary to monitor whether or not the vehicle overruns and selects the first monitoring unit 12a. When it is determined that the plug-in charging is not being performed, the second selection unit 21c selects the first verification unit 21a corresponding to the first monitoring unit 12a.

  In step S20, an abnormality during charging is monitored. The second monitoring unit 12b monitors whether or not an abnormality occurs when charging the battery via the charging plug. In step S40, the second monitoring unit is verified. The second verification unit 21b verifies whether or not the second monitoring unit 12b is in a state where monitoring can be performed normally. In this way, the electronic control unit 100 monitors only whether or not an abnormality occurs when charging the battery via the charging plug without monitoring overrun when plug-in charging is in progress. Therefore, the electronic control device 100 does not need to be verified by the first verification unit 21a, and only the second verification unit 21b needs to perform verification.

  In step S30, overrun is monitored. The first monitoring unit 12a monitors whether the vehicle is overrun. In step S50, the first monitoring unit is verified. The first verification unit 21a verifies whether or not the first monitoring unit 12a is in a state where monitoring can be performed normally. As described above, when the plug-in charging is not being performed, the electronic control unit 100 monitors only overrun without monitoring whether or not an abnormality occurs during charging. Therefore, the electronic control device 100 does not need to be verified by the second verification unit 21b, and only the first verification unit 21a needs to perform verification.

  Thus, it can be said that the electronic control apparatus 100 can perform monitoring by the first monitoring unit 12a and the second monitoring unit 12b at different timings. Similarly, it can be said that the electronic control device 100 can perform verification by the first verification unit 21a and the second verification unit 21b at different timings.

  Moreover, since the electronic control apparatus 100 includes the first selection unit 12c and the second selection unit 21c, it can be said that the monitoring target can be dynamically switched. Therefore, it can be said that the electronic control device 100 can switch the plurality of monitoring units 12a and 12b and can switch the plurality of verification units 21a and 21b in accordance with the switching of the monitoring target.

  In step S60, the first selection unit is verified. The second processing unit 20 verifies whether or not the first selection unit 12c can normally perform the selection regardless of the environmental state signal (second verification unit). The second processing unit 20 is in a state in which the first selection unit 12c can normally select depending on whether hardware or software in the electronic control device 100 used in the first selection unit 12c is normal. Verify whether or not.

  For example, the first selection unit 12c is set to transmit a verification signal to the second processing unit 20 at a predetermined timing. That is, the first selection unit 12c is set to transmit a verification signal spontaneously instead of an instruction from the second processing unit 20. Then, the second processing unit 20 determines whether the hardware and software used in the first selection unit 12c are normal based on the verification signal, so that the first selection unit 12c is normal. It is verified whether or not monitoring is possible.

  In addition, the second processing unit 20 transmits a test signal to the first processing unit 10 to cause the first selection unit 12c to execute processing according to the test signal, and an answer signal as a result of the execution is sent. Send it. Then, the second processing unit 20 determines whether the hardware and software in the electronic control device 100 used by the first selection unit 12c are normal based on the answer signal from the first selection unit 12c. Thus, the second processing unit 20 verifies whether or not the first selection unit 12c is in a state where selection can be performed normally. As described above, the electronic control device 100 ensures safety in order to verify whether or not the first selection unit 12c can normally perform the selection even when the environmental state signal is used. it can. In addition, the electronic control apparatus 100 does not need to perform step S60.

  As described above, the electronic control device 100 selects one monitoring unit corresponding to the monitoring target that needs to be monitored from the first monitoring unit 12a and the second monitoring unit 12b, and the first verification unit 21a and the second monitoring unit 12b. One verification unit corresponding to the selected monitoring unit is selected from the verification units 21b. In the electronic control device 100, one selected monitoring unit executes monitoring, and a verification unit provided corresponding to the monitoring unit executes verification. That is, the electronic control unit 100 performs monitoring by one monitoring unit corresponding to a monitoring target that needs to be monitored, and when performing verification by a verification unit corresponding to the monitoring unit, monitoring by another monitoring unit, and There is no need for verification by another verification unit. Therefore, the electronic control apparatus 100 can reduce a processing load compared with the case where the monitoring by the 1st monitoring part 12a and the 2nd monitoring part 12b and the verification by the 1st verification part 21a and the 2nd verification part 21b are always performed. Further, since the electronic control device 100 can simplify the emergency stop determination unit 12 and the function verification unit 21, it is difficult for errors to be mixed, and safety can be ensured.

  In addition, when constantly monitoring all monitoring targets, the electronic control device 100 performs monitoring by the first monitoring unit 12a and the second monitoring unit 12b and verification by the first verification unit 21a and the second verification unit 21b within a predetermined time. Need to be done. However, when the electronic control unit 100 performs monitoring by one monitoring unit corresponding to a monitoring target that needs monitoring, and verification by a verification unit corresponding to the monitoring unit, monitoring by another monitoring unit, and There is no need for verification by another verification unit. For this reason, if the electronic control apparatus 100 performs the monitoring by the first monitoring unit 12a and the verification by the first verification unit 21a or the monitoring by the second monitoring unit 12b and the verification by the second verification unit 21b within a predetermined time. Good. Therefore, the electronic control apparatus 100 can employ a microcomputer having a lower specification than that in the case of constantly monitoring all monitoring targets, in other words, a microcomputer having a low processing capability. For this reason, the electronic control apparatus 100 can suppress an increase in cost.

  The first processing unit 10 and the second processing unit 20 may be mounted on a single CPU having at least two processor cores. This CPU can be said to be a multi-core CPU. In this case, the first processing unit 10 and the second processing unit 20 correspond to different cores mounted on one CPU.

  Moreover, in this embodiment, the example provided with two monitoring parts, the 1st monitoring part 12a and the 2nd monitoring part 12b, is employ | adopted. However, the present invention is not limited to this. In the present invention, three or more monitoring units may be provided. In this case, three or more verification units are provided corresponding to each monitoring unit.

  The preferred embodiments of the present invention have been described above. However, the present invention is not limited to the above-described embodiments, and various modifications can be made without departing from the spirit of the present invention. Hereinafter, modifications 1 and 2 of the present invention will be described. The above-described embodiment and Modifications 1 and 2 can be implemented independently, but can also be implemented in appropriate combination. The present invention is not limited to the combinations shown in the embodiments, and can be implemented by various combinations.

(Modification 1)
The electronic control device 100 according to the first modification has the same configuration as the above embodiment, but the processing content is different. For this reason, the description regarding a structure is abbreviate | omitted here using the code | symbol similar to the said embodiment. In the following, the electronic control device 100 of the first modification is also simply referred to as the electronic control device 100.

  The electronic control device 100 is mounted on an automobile capable of moving forward and backward including an engine as a power source. Further, the electronic control device 100 includes an electronic throttle that adjusts the amount of intake air to the engine as a control target. Furthermore, the electronic control unit 100 receives a signal indicating whether or not the shift is in reverse as the environmental state signal. As this environmental state signal, an on signal and an off signal output from a switch that is turned on when the shift lever is reversed and turned off when the shift lever is switched from reverse can be adopted. Therefore, the first selection unit 12c determines whether or not the shift is reverse based on the on signal and the off signal output from the switch.

  When the shift is reverse, the automobile moves backward when the driver steps on the accelerator pedal. In addition, when the shift is not reverse, the automobile may move forward, and the driver may move forward by stepping on the accelerator pedal.

  Here, the processing operation of the electronic control apparatus 100 will be described with reference to FIG. The electronic control device 100 executes the process shown in the flowchart of FIG. 3 every predetermined time.

  In step S11, it is determined whether or not the shift is reverse. If the electronic control unit 100 determines that the shift is reverse, that is, determines that the automobile is in the reverse drive state, the electronic control unit 100 proceeds to step S21. More specifically, the first selection unit 12c and the second selection unit 21c determine whether or not the shift is reverse. If the first selection unit 12c determines that the shift is reverse, the first selection unit 12c selects the first monitoring unit 12a on the assumption that it is necessary to monitor whether or not the vehicle overruns in the reverse direction. When it is determined that the shift is reverse, the second selection unit 21c selects the first verification unit 21a corresponding to the first monitoring unit 12a.

  On the other hand, if the electronic control unit 100 determines that the shift is not reverse, that is, if it is determined that the automobile is not in the reverse drive state, the electronic control unit 100 proceeds to step S31. If the first selection unit 12c determines that the shift is not reverse, the first selection unit 12c determines that it is necessary to monitor whether or not the vehicle overruns in the forward direction, and selects the second monitoring unit 12b. When it is determined that the shift is not reverse, the second selection unit 21c selects the second verification unit 21b corresponding to the second monitoring unit 12b.

  In step S21, overrun is monitored only in the reverse direction. The first monitoring unit 12a monitors whether or not the vehicle overruns in the backward direction. In step S41, the first monitoring unit is verified. The first verification unit 21a verifies whether or not the first monitoring unit 12a is in a state where monitoring can be performed normally. Thus, when the shift is reverse, the electronic control unit 100 monitors only whether or not an overrun in the backward direction occurs without monitoring an overrun in the forward direction. Therefore, the electronic control device 100 does not need to be verified by the second verification unit 21b, and only the first verification unit 21a needs to perform verification.

  In step S31, overrun is monitored only in the forward direction. The second monitoring unit 12b monitors whether or not the vehicle overruns in the forward direction. In step S51, the second monitoring unit is verified. The second verification unit 21b verifies whether or not the second monitoring unit 12b is in a state where monitoring can be performed normally. Thus, when the shift is not reverse, the electronic control unit 100 monitors only the overrun in the forward direction without monitoring the overrun in the reverse direction. Therefore, the electronic control device 100 does not need to be verified by the first verification unit 21a, and only the second verification unit 21b needs to perform verification. In step S61, since it is the same as that in step S60, the description is omitted.

  The electronic control device 100 according to the first modification can achieve the same effect as that of the above embodiment.

(Modification 2)
The electronic control device 100 according to the second modification has the same configuration as that of the above embodiment, but the processing content is different. For this reason, the description regarding a structure is abbreviate | omitted here using the code | symbol similar to the said embodiment. In the following, the electronic control device 100 of the second modification is also simply referred to as the electronic control device 100.

  The electronic control device 100 is mounted on an automobile including an engine and a motor generator as power sources, and a battery that supplies electric power to the motor generator and can be charged with electric power generated by the motor generator. That is, the automobile is a so-called hybrid automobile.

  In addition, the electronic control device 100 controls, as control targets, an electronic throttle that adjusts the amount of intake air to the engine, an inverter that is a power supply circuit that supplies driving power to the motor generator, and charging of the battery from the motor generator. A battery device. Further, the electronic control unit 100 receives a signal indicating whether or not the engine is starting as an environmental state signal. In other words, the environmental state signal is a signal indicating whether or not the automobile travels using the engine as a power source. This environmental condition signal is turned on when the power source when the vehicle is running becomes an engine, and is turned on when the power source when the vehicle is running becomes a motor generator. An off signal can be adopted. Therefore, the first selection unit 12c determines whether or not the power source when the vehicle travels is an engine based on the ON signal and the OFF signal output from the switch.

  Here, the processing operation of the electronic control apparatus 100 will be described with reference to FIG. The electronic control device 100 executes the process shown in the flowchart of FIG. 4 every predetermined time.

  In step S12, it is determined whether or not the engine is being started. When the electronic control unit 100 determines that the engine is being started, that is, when it is determined that the automobile is traveling using the engine as a power source, the process proceeds to step S22. More specifically, the first selection unit 12c and the second selection unit 21c determine whether or not the engine is being started. If the first selection unit 12c determines that the engine is being started, the first selection unit 12c selects the first monitoring unit 12a on the assumption that it is necessary to monitor vehicle overrun and battery abnormality caused by the engine. When it is determined that the engine is being started, the second selection unit 21c selects the first verification unit 21a corresponding to the first monitoring unit 12a.

  On the other hand, when it is determined that the engine is not being started, that is, when it is determined that the power source when the automobile is traveling is the motor generator, the electronic control unit 100 proceeds to step S32. When it is determined that the engine is not being started, the first selection unit 12c determines that it is necessary to monitor the vehicle overrun and battery abnormality caused by the motor generator, and selects the second monitoring unit 12b. When it is determined that the engine is not being started, the second selection unit 21c selects the second verification unit 21b corresponding to the second monitoring unit 12b. The battery abnormality is, for example, overcharge or fire hazard.

  In step S22, the vehicle overrun and battery abnormality caused by the engine are monitored. The first monitoring unit 12a monitors whether or not the vehicle overruns due to the engine, and monitors whether or not an abnormality occurs in the battery due to the engine. In step S42, the first monitoring unit is verified. The first verification unit 21a verifies whether or not the first monitoring unit 12a is in a state where monitoring can be performed normally. As described above, when the engine is being started, the electronic control device 100 does not monitor the vehicle overrun and battery abnormality caused by the motor generator, but causes the vehicle overrun and battery abnormality caused by the engine. Only monitor whether or not. Therefore, the electronic control device 100 does not need to be verified by the second verification unit 21b, and only the first verification unit 21a needs to perform verification.

  In step S32, the vehicle overrun and battery abnormality caused by the motor generator are monitored. The second monitoring unit 12b monitors whether or not the vehicle overruns due to the motor generator, and monitors whether or not an abnormality occurs in the battery due to the motor generator. In step S52, the second monitoring unit is verified. The second verification unit 21b verifies whether or not the second monitoring unit 12b is in a state where monitoring can be performed normally.

  As described above, when the engine is not started, the electronic control unit 100 does not monitor the vehicle overrun and battery abnormality caused by the engine, and causes the vehicle overrun and battery abnormality caused by the motor generator. Only monitor whether or not. Therefore, the electronic control device 100 does not need to be verified by the first verification unit 21a, and only the second verification unit 21b needs to perform verification. In step S62, since it is the same as that of step S60, description is abbreviate | omitted.

  In addition, it can be said that the 2nd monitoring part 12b monitors whether the motor vehicle overruns as a monitoring object, in order to determine generation | occurrence | production of the abnormality which needs to stop operation | movement of an inverter. Moreover, the operation stop of the inverter is to stop the power supply to the motor generator by the inverter. Therefore, if the second monitoring unit 12b determines that the vehicle overruns due to the motor generator, the second monitoring unit 12b stops the operation of the inverter and prevents the motor generator from overrunning.

  The electronic control device 100 according to Modification 2 can achieve the same effects as those of the above embodiment.

(Other)
Note that the environmental state signal is not limited to the signal described in the above embodiment and the modification. The environmental state signal can be adopted as various sensor signals such as an accelerator sensor or various switch signals such as an ignition switch.

  The electronic control device 100 can also be applied to a brake controller, a shift position controller, a transmission controller, and the like. These controllers control a control object that is preferably forcibly stopped when an abnormality occurs. For example, it is preferable that the shift position controller forcibly stop the switching when the abnormality occurs and the parking range is unintentionally switched. Moreover, the electronic control apparatus 100 is not limited to what is mounted in a motor vehicle.

  DESCRIPTION OF SYMBOLS 10 1st process part, 11 Vehicle control part, 12 Emergency stop determination part, 12a 1st monitoring part, 12b 2nd monitoring part, 12c 1st selection part, 20 2nd processing part, 21 Function verification part, 21a 1st verification Part, 21b second verification part, 21c second selection part, 100 electronic control unit, 200 control object

Claims (7)

A control means (11) for controlling the operation of the controlled object, and a means for monitoring a plurality of monitored objects for determining the occurrence of an abnormality that requires the operation of the controlled object to be stopped, corresponding to each of the monitored objects A plurality of monitoring means (12a, 12b) provided;
It is means for verifying whether or not each monitoring means can be normally monitored, and comprises a plurality of verification means (21a, 21b) provided corresponding to each of the monitoring means. ,
Each monitoring means determines the occurrence of an abnormality, and when it is determined that an abnormality occurs, the operation of the control target is forcibly stopped,
Each of the verification means is an electronic control device that forcibly stops the operation of the control object when it is determined that it is not in a state where monitoring can be normally performed,
First selecting means (12c) for determining one of the plurality of monitoring targets that needs monitoring and selecting one of the plurality of monitoring means corresponding to the monitoring target determined to be monitored ,
A second selection means (21c) for selecting one of the plurality of verification means corresponding to the monitoring means selected by the first selection means;
Only the monitoring unit selected by the first selection unit among the plurality of monitoring units executes monitoring, and only the verification unit selected by the second selection unit among the plurality of verification units. An electronic control device that performs verification. The first selection unit acquires a switching signal indicating switching of the monitoring target, and determines one of the plurality of monitoring targets that needs monitoring based on the acquired switching signal,
The apparatus further comprises second verification means (S60 to S62) for verifying whether or not the first selection means is in a state in which selection can be performed normally regardless of the switching signal. The electronic control device according to 1.   The second selection unit acquires the switching signal, and selects one of the plurality of verification units corresponding to the monitoring unit selected by the first selection unit based on the acquired switching signal. The electronic control device according to claim 2. A first processing unit (10) and a second processing unit (20) different from the first processing unit,
The control means, the plurality of monitoring means, and the first selection means are provided in the first processing unit,
4. The electronic control device according to claim 1, wherein the verification unit and the second selection unit are provided in the second processing unit. 5. It is equipped with an engine and a motor as a power source, and a battery that supplies electric power to the motor, and is mounted on an automobile that can be charged to the battery via a charging plug that can be attached and detached. Yes,
The first monitoring means (12a), which is one of the plurality of monitoring means, monitors the vehicle overrun as one of the plurality of monitoring objects,
The second monitoring means (12b), which is one of the plurality of monitoring means, monitors an abnormality at the time of charging the battery via the charging plug as one of the plurality of monitoring objects,
The first selection means determines that the vehicle overrun needs to be monitored when the charging plug is in a disconnected state, selects the first monitoring means, and the charging plug is in a connected state. 5. The electronic control according to claim 1, wherein it is determined that it is necessary to monitor abnormality during charging of the battery via the charging plug, and the second monitoring unit is selected. 6. apparatus. It is mounted on a car that can move forward and backward with an engine as a power source,
The first monitoring means (12a) which is one of the plurality of monitoring means monitors an overrun in the reverse direction of the automobile as one of the plurality of monitoring objects,
The second monitoring means (12b), which is one of the plurality of monitoring means, monitors overrun in the forward direction of the vehicle as one of the plurality of monitoring objects,
The first selection means determines that it is necessary to monitor overrun in the reverse direction of the automobile when the automobile is in a reverse drive state, selects the first monitoring means, and when the automobile is not in a reverse drive state. 5. The electronic control device according to claim 1, wherein it is determined that monitoring of overrun in the forward direction of the automobile is necessary, and the second monitoring unit is selected. 6. It is mounted on an automobile including an engine and a motor generator as a power source, and a battery that supplies electric power to the motor generator and can be charged with electric power generated by the motor generator,
The first monitoring means (12a), which is one of the plurality of monitoring means, monitors the vehicle overrun caused by the engine and the overcharge to the battery as the plurality of monitoring targets,
The second monitoring means (12b), which is one of the plurality of monitoring means, monitors, as the plurality of monitoring targets, overruns of the automobile caused by the motor generator and overcharging of the battery. And
The first selection means selects the first monitoring means (12a) by determining that it is necessary to monitor the vehicle overrun and the battery abnormality caused by the engine when the engine is being started. The second monitoring means is selected when it is determined that it is necessary to monitor an overrun of the automobile caused by the motor generator and an abnormality in the battery when the engine is not started. 5. The electronic control device according to any one of 4.

Images