JP2021105371A - Electronic control unit - Google Patents

Abstract

To provide a technology for estimating a control mode and performing fail-safe control according to the estimated control mode, when an abnormality occurs in a microcomputer performing vehicle control.SOLUTION: An electronic control unit 20 includes a control unit 22 and a monitoring unit 24. The control unit is configured to determine one control mode within a plurality of control modes indicating the control mode of a control subject, and to control the control subject. The monitoring unit includes a determination unit 51, an estimation unit 52, and a decision unit 53. The estimation unit estimates a control mode determined by the control unit. When it is determined that an abnormality occurs in the control unit, the decision unit performs fail-safe control in a mode different for each estimated mode which is an estimated control mode by the estimation unit.SELECTED DRAWING: Figure 1

Description

The present disclosure relates to a technique for monitoring vehicle anomalies.

For example, Patent Document 1 below discloses a technique of detecting whether or not an abnormality has occurred in a microcomputer that controls a vehicle by a monitoring IC different from the microcomputer.

Japanese Unexamined Patent Publication No. 2008-226043

In the above technique, the microcomputer is configured to determine a control mode and perform control in the determined control mode.
As a result of detailed examination by the inventor, in the above-mentioned technology, the monitoring IC may not be able to grasp the control mode when an abnormality occurs in the microcomputer, and it is difficult to perform fail-safe control according to the control mode. The issue of being there was found.

One aspect of the present disclosure is to provide a technique for estimating a control mode and performing fail-safe control according to the estimated control mode when an abnormality occurs in a microcomputer that controls a vehicle.

One aspect of the present disclosure is an electronic control device (20) that is mounted on a vehicle and controls a predetermined control target, and includes a control unit (22) and a monitoring unit (24). The control unit is configured to determine one control mode from a plurality of control modes indicating a control mode of the control target and control the control target. The monitoring unit is configured to monitor the control unit. Further, the monitoring unit includes a determination unit (51), an estimation unit (52), and a determination unit (53). The determination unit determines whether or not an abnormality has occurred in the control unit. The estimation unit estimates the control mode determined by the control unit. When it is determined that an abnormality has occurred in the control unit, the determination unit performs fail-safe control in a different mode for each estimation mode, which is the control mode estimated by the estimation unit.

According to such a configuration, the monitoring unit can estimate the control mode by the control unit by the estimation unit. As a result, the monitoring unit can perform fail-safe control according to the estimated control mode when an abnormality occurs in the control unit.

It is a block diagram which shows the structure of the ECU of 1st Embodiment. It is explanatory drawing explaining the control mode. It is explanatory drawing explaining the operation by a monitoring IC. It is a block diagram which shows the structure of the ECU of 2nd Embodiment.

Hereinafter, exemplary embodiments of the present disclosure will be described with reference to the drawings. In addition, in this specification, "similar" is not limited to the same in a strict sense, and may not be exactly the same as long as it has the same effect.
[1. First Embodiment]
[1-1. Constitution]
<Overall configuration>
The electronic control unit (hereinafter referred to as ECU) of the embodiment to which the present disclosure is applied is mounted on a vehicle and controls a predetermined control target. The ECU of the present embodiment is for controlling the engine, for example, by targeting the engine mounted on the vehicle as a control target.

The ECU 10 of the first embodiment realizes a control function such as determining a control amount of a plurality of actuators for operating an engine based on, for example, state signals input from various sensors and various devices.

The state signal is a signal input to the ECU 10 and is various signals indicating the state of the vehicle. The state of the vehicle means the operating state of the vehicle. The status signal may include, for example, a required torque signal, an engine speed signal, and the like.
The required torque signal is a signal indicating the required torque. The required torque is the torque output by the engine in response to a request from the driver. The required torque can be specified, for example, by using a predetermined map or the like based on the detection results of the accelerator opening degree and the engine speed indicating the amount of operation of the accelerator pedal by the driver.

The engine speed signal is a signal indicating the engine speed. The engine speed can be specified from, for example, a crank angle based on the detection results of a crank angle sensor and a cam angle sensor (not shown).

A device other than the ECU 10 detects the state of the vehicle indicated by these state signals, generates a state signal, and inputs the generated state signal to the ECU 10. The ECU 10 is connected to these other devices by a communication line. In addition, various sensors for detecting the state of the vehicle indicated by the state signal and the ECU 10 may be connected by a communication line, the state of these vehicles may be detected by the ECU 10, and the state signal may be generated by the ECU 10.

The engine is controlled by a plurality of actuators. The plurality of actuators referred to here include a first actuator and a second actuator different from the first actuator. In the present embodiment, the electronic throttle 31 corresponds to the first actuator, and the injector 32 corresponds to the second actuator.

The electronic throttle 31 is provided in an intake passage to a cylinder (not shown), adjusts the throttle opening degree according to the magnitude and polarity of the energizing current to the electronic throttle 31, and adjusts the amount of air sucked into the cylinder. The energizing current that drives the electronic throttle 31 is output from the first drive device 61, which will be described later. When the energizing current is 0, the electronic throttle 31 is maintained with a throttle opening of a few degrees (hereinafter referred to as an initial opening) set in advance, and a small amount of air is sucked into the cylinder. Will be done.

The injector 32 is provided in an intake passage (not shown) closer to the cylinder than the electronic throttle 31, and adjusts the injection amount of fuel sucked into the cylinder according to the magnitude of the energizing current to the injector 32 and the energizing time. .. The energizing current that drives the injector 32 is output from the second drive device 62, which will be described later. When the energizing current is 0, the injector 32 does not operate and fuel is not injected into the cylinder.

<Configuration of ECU 10>
As shown in FIG. 1, the ECU 10 includes an input unit 21, a microcomputer 22, an output unit 23, and a monitoring IC 24.

The input unit 21 is a circuit in which the above-mentioned state signal is input from the outside of the ECU 10.
The microcomputer 22 determines at least one control mode from a plurality of control modes indicating the control mode of the predetermined control target (that is, the engine), and the control target (that is, the engine) is set in the determined control mode. Take control. The microcomputer 22 generates a plurality of control signals for controlling a controlled object (that is, an engine) according to a control mode. The plurality of control modes include a first control mode and a second control mode.

The plurality of control signals include a first control signal S1 and a second control signal S2. The first control signal S1 is a signal for driving the electronic throttle 31 which is the first actuator. The second control signal S2 is a signal for driving the injector 32, which is the second actuator. The first control signal S1 and the second control signal S2 are output to the output unit 23, respectively. The details of the microcomputer 22 will be described later.

The output unit 23 includes a plurality of drive devices. The plurality of drive devices include a first drive device 61 and a second drive device 62. The first drive device 61 gives a drive signal (hereinafter, first drive signal) D1 for driving the electronic throttle 31 to the electronic throttle 31 which is the first actuator based on the first control signal S1. Specifically, the first drive signal D1 refers to the energizing current that drives the electronic throttle 31 described above.

Further, the first drive device 61 stops the output of the first drive signal D1 to the electronic throttle 31 according to the first fail-safe signal C1 output from the monitoring IC 24. For example, the first drive device 61 stops the output of the first drive signal D1 to the electronic throttle 31 according to the first fail-safe signal C1 indicating the high level of the two values of the high level and the low level.

The second drive device 62 gives a drive signal (hereinafter, a second drive signal) D2 for driving the injector 32 to the injector 32, which is a second actuator, based on the second control signal S2. Specifically, the second drive signal D2 refers to the energizing current that drives the injector 32 described above.

Further, the second drive device 62 stops the output of the second drive signal D2 to the injector 32 according to the second fail-safe signal C2 output from the monitoring IC 24. For example, the second drive device 62 stops the output of the second drive signal D2 to the injector 32 according to the second fail-safe signal C2 indicating the high level of the two values of the high level and the low level.

The monitoring IC 24 is an IC that monitors the operation of the microcomputer 22. Details of the monitoring IC 24 will be described later.
<Configuration of microcomputer 22>
The microcomputer 22 includes a CPU 101, a ROM, a RAM, and a semiconductor memory (hereinafter, memory) 102 such as a flash memory. The ECU 10 realizes each function described later by executing a program stored in the non-transition tangible recording medium by the CPU 101. The memory 102 corresponds to a non-transitional tangible recording medium for storing a computer program. Further, by executing this computer program, the method corresponding to the computer program is executed. The microcomputer 22 realizes various functions for controlling the engine.

Specifically, as shown in FIG. 1, the ECU 10 includes the functions of the target control unit 41, the inspection unit 42, and the management unit 43.
The target control unit 41 determines one control mode from the plurality of control modes, and controls the control target in the determined control mode. The control mode indicates a control mode of the controlled object. In the present embodiment in which the control target is an engine, the plurality of control modes are control modes that realize different air-fuel ratios. Specifically, stoichiometric control and lean burn control correspond to a plurality of control modes. Further, the stoichiometric control corresponds to the first control mode, and the lean burn control corresponds to the second control mode.

The target control unit 41 acquires a plurality of state signals, and based on the acquired state signals, determines one control mode from the above-mentioned plurality of control modes by a predetermined process. In the present embodiment, the required torque signal and the engine speed signal correspond to a plurality of state signals for determining one control mode.

For example, in the above-mentioned memory 102, a map in which the required torque indicated by the required torque signal, the engine rotation speed indicated by the engine rotation speed signal, and the control mode are associated with each other as shown in FIG. 2 is stored in advance. You may. The target control unit 41 determines one of the stoichiometric control and the lean burn control as one control mode by processing using such a map.

Then, the target control unit 41 generates the first control signal S1 and the second control signal S2 so that the control amounts of the electronic throttle 31 and the injector 32 become the control amounts according to the determined control modes.

The target control unit 41 outputs the first control signal S1 to the first drive device 61. As a result, the first drive signal D1 based on the first control signal S1 is output to the electronic throttle 31, and the electronic throttle 31 operates according to the control mode. The target control unit 41 outputs the second control signal S2 to the second drive device 62. As a result, the second drive signal D2 based on the second control signal S2 is output to the injector 32, and the injector 32 operates according to the control mode.
In this way, the target control unit 41 drives each of the plurality of actuators (that is, the electronic throttle 31 and the injector 32) according to one control mode determined from the plurality of control modes as a drive signal. Control is performed to output a signal.

Further, when the target control unit 41 receives the test signal transmitted from the inspection unit 42, which will be described later, the target control unit 41 performs a test according to the question included in the test signal, uses the execution result as an answer, and includes an answer. The signal is transmitted to the inspection unit 42.

The inspection unit 42 transmits the above-mentioned test signal to the target control unit 41 at a predetermined cycle, and receives an answer signal to a question included in the above-mentioned test signal. The question is set in advance so that the target control unit 41 can perform a test according to the question for verifying the function of the target control unit 41.

The management unit 43 generates a test result signal indicating the answer included in the answer signal, and transmits the generated test result signal to the monitoring IC 24. In this way, the inspection unit 42 and the management unit 43 transmit a signal (that is, a test result signal) for causing the monitoring IC 24 to determine whether or not an abnormality has occurred in the target control unit 41.

By the way, if an abnormality occurs in the target control unit 41, the vehicle is guided to a safe state (that is, a fail-safe state). The fail-safe state is a state in which the safety of the vehicle is maintained even if an abnormality occurs in the vehicle. In the present embodiment, if an abnormality occurs in the target control unit 41 (that is, the microcomputer 22), a fail-safe state different depending on the control mode can be realized by the monitoring IC 24 described later. Hereinafter, the fail-safe states that can be realized in each control mode will be described.

Here, in the stoichiometric control, the target control unit 41 drives the electronic throttle 31 and the injector 32 so that the air-fuel ratio value becomes, for example, 14-15 A / F when the microcomputer 22 is normal, so that the first control signal S1 and the second control signal S2 are generated. In the stoichiometric control, the injector 32 injects a relatively large amount of fuel, and the electronic throttle 31 inhales a relatively large amount of air according to the amount of fuel injected.

For example, in stoichiometric control, reducing the amount of air taken in makes it difficult to maintain explosion and combustion in the engine according to the amount of fuel injected by the injector 32. As a result, the vehicle can be driven at least while maintaining a safe state in which the drive output is limited and the movement of the vehicle that is not intended by the driver, such as sudden acceleration of the vehicle, is suppressed. Such a state in which the drive output is limited and the vehicle can be driven as much as possible is referred to as evacuation travel.

That is, in the stoichiometric control, a fail-safe state (that is, evacuation running) is realized by reducing the amount of air taken in when an abnormality occurs in the microcomputer 22. Specifically, as will be described later, the evacuation run is realized by stopping the output of the first drive signal D1.

On the other hand, in lean burn control, the target control unit 41 drives the electronic throttle 31 and the injector 32 so that the air-fuel ratio value becomes, for example, 18-30 A / F when the microcomputer 22 is normal, so that the first control signal S1 and the second control signal S2 are generated. In the lean burn control, the injector 32 injects a relatively small amount of fuel, and the electronic throttle 31 takes in a relatively small amount of air according to the amount of fuel injected. That is, a relatively small amount of air is controlled to obtain an explosion and combustion in the engine.

For example, in lean burn control, even if the amount of air taken in is further reduced, the explosion and combustion in the engine are maintained, and the drive output may be increased with a small injection amount of fuel. In lean burn control, the engine is stopped by reducing the amount of air taken in and further stopping the supply of fuel to cause an engine stall. As a result, the drive output is stopped.

That is, in the lean burn control, when an abnormality occurs in the microcomputer 22, a fail-safe state (that is, engine stall) is realized by reducing the amount of air taken in and stopping the supply of fuel. Specifically, as will be described later, the engine stall is realized by stopping the outputs of both the first drive signal D1 and the second drive signal D2.

<Configuration of monitoring IC24>
The monitoring IC 24 monitors the operation of the microcomputer 22, estimates the control mode of the microcomputer 22 when it is determined that an abnormality has occurred in the microcomputer 22, and performs fail-safe control according to the control mode of the microcomputer 22. Is. The fail-safe control is a control for realizing a fail-safe state when an abnormality occurs in the vehicle (for example, the microcomputer 22). Specifically, as shown in FIG. 1, the monitoring IC 24 includes functions of a determination unit 51, an estimation unit 52, and a determination unit 53.

The determination unit 51 receives the test result signal from the microcomputer 22, compares the test result signal with the expected value, determines whether the microcomputer 22 is normal or abnormal, and determines a determination signal indicating the determination result. Output to 53.

The determination unit 51 may determine that the microcomputer 22 is normal, for example, when the test result signal and the expected value match. The expected value is stored in advance in a memory (not shown) included in the monitoring IC 24. Alternatively, the determination unit 51 may determine that the microcomputer 22 is normal when the test result signal and the expected value do not match.

The determination signal may be a different signal for each determination result. In the present embodiment, the determination unit 51 outputs a signal indicating a low level as a determination signal when the microcomputer 22 is determined to be normal, and determines a signal indicating a high level when it is determined to be abnormal. Output as a signal.

The estimation unit 52 acquires at least one state signal, and is executed by the microcomputer 22 determined by the microcomputer 22 (that is, the target control unit 41) by a predetermined process based on the acquired state signal. Estimate one of the above control modes. In the present embodiment, the estimation unit 52 acquires the same state signal as the microcomputer 22 (that is, the target control unit 41), and based on the acquired state signal, the same processing as the microcomputer 22 (that is, the target control unit 41). Estimates the control mode determined by the microcomputer 22.

Specifically, in the present embodiment, the estimation unit 52 acquires the required torque signal and the engine speed signal. Based on these state signals, the estimation unit 52 controls one of the stoichiometric control and the lean burn control by the processing using the map shown in FIG. 2 described above, and one control determined by the target control unit 41. Estimate as mode. The map is stored in advance in a memory (not shown) included in the monitoring IC 24.

Hereinafter, the control mode estimated by the estimation unit 52 and estimated to be determined by the target control unit 41 (that is, the microcomputer 22) is referred to as an estimation mode. The estimation unit 52 outputs an estimation mode signal indicating the estimation mode to the determination unit 53. The estimation mode signal may be a signal different for each estimation mode. In the present embodiment, the estimation unit 52 outputs a signal indicating a high level as an estimation mode signal when the estimation mode is stoichiometric control, and outputs a signal indicating a low level when the estimation mode is lean burn control in the estimation mode. Output as a signal.

When it is determined that an abnormality has occurred in the microcomputer 22, the determination unit 53 performs fail-safe control in a different mode for each estimation mode estimated by the estimation unit 52.
When it is determined that an abnormality has occurred in the microcomputer 22, the determination unit 53 controls the electronic throttle 31 as a fail-safe control when the estimation mode is the first control mode (that is, stoichiometric control). .. Further, when the determination mode is the second control mode (that is, lean burn control), the determination unit 53 controls both the electronic throttle 31 and the injector 32 as fail-safe control.

Specifically, as shown in FIG. 3, when it is determined that an abnormality has occurred in the microcomputer 22, the determination unit 53 indicates a high level as a fail-safe control when the estimation mode is stoichiometric control. The fail-safe signal C1 of 1 is output to the first drive device 61. Moreover, the second fail-safe signal C2 indicating the low level is output to the second drive device 62. As a result, the output of the first drive signal D1 to the electronic throttle 31 is stopped, and the output of the second drive signal D2 to the injector 32 is not stopped (that is, output).

Further, when it is determined that an abnormality has occurred in the microcomputer 22, the determination unit 53 first sets the first fail-safe signal C1 indicating a high level as the fail-safe control when the estimation mode is lean burn control. Is output to the drive device 61 of. Moreover, the second fail-safe signal C2 indicating the high level is output to the second drive device 62. As a result, the output of the first drive signal D1 to the electronic throttle 31 is stopped, and the output of the second drive signal D2 to the injector 32 is stopped.

[1-2. Operation]
The state of the vehicle based on the monitoring of the monitoring IC 24 configured in this way will be described with reference to FIG.

(Operation 1) When the determination unit 51 determines that the microcomputer 22 is normal, the determination unit 53 sends a first fail-safe signal C1 indicating a low level regardless of the type of estimation mode by the estimation unit 52. Output to the first drive device 61. Moreover, the determination unit 53 outputs the second fail-safe signal C2 indicating the low level to the second drive device 62. That is, the output stop of the first drive device 61 is deactivated, and the output stop of the second drive device 62 is deactivated.

As a result, the electronic throttle 31 and the injector 32 perform normal operation (hereinafter, normal operation) according to the first drive signal D1 and the second drive signal D2 according to the control mode. As a result, in the vehicle, normal traveling according to the control mode (hereinafter, normal traveling) is performed.

(Operation 2) When the determination unit 51 determines that the microcomputer 22 is abnormal, if the estimation mode by the estimation unit 52 is stoichiometric control, the determination unit 53 determines the first fail-safe signal C1 indicating a high level. Is output to the first drive device 61. Moreover, the determination unit 53 outputs the second fail-safe signal C2 indicating the low level to the second drive device 62. That is, the output stop of the first drive device 61 is activated, and the output stop of the second drive device 62 is deactivated.

As a result, the electronic throttle 31 is maintained at the initial opening degree, and the injector 32 normally operates according to the second drive signal D2 according to the control mode. That is, since the intake air amount is limited in the stoichiometric control, the evacuation running is realized as a fail-safe state in the vehicle.

(Operation 3) When the determination unit 51 determines that the microcomputer 22 is abnormal, if the estimation mode by the estimation unit 52 is lean burn control, the determination unit 53 is the first fail-safe signal indicating a high level. C1 is output to the first drive device 61. In addition, the determination unit 53 outputs a second fail-safe signal C2 indicating a high level to the second drive device 62. That is, the output stop of the first drive device 61 is activated, and the output stop of the second drive device 62 is activated.

As a result, the electronic throttle 31 is maintained at the initial opening degree, and the injector 32 stops supplying fuel. That is, in the lean burn control, the intake air amount is limited and the fuel supply is stopped, so that the engine stall is realized as a fail-safe state in the vehicle.

[1-3. effect]
According to the first embodiment described in detail above, the following effects are obtained.
(1a) In the conventional device, the control mode of the vehicle is determined by, for example, a control device that controls the vehicle, and when an abnormality occurs in the control device, the control mode is specified by a device other than the control device. It was difficult to do. That is, it was difficult to execute fail-safe control according to the control mode.

In the present embodiment, the monitoring IC 24 estimates the control mode executed by the microcomputer 22 even when an abnormality occurs in the microcomputer 22 by the estimation unit 52. As a result, when an abnormality occurs in the microcomputer 22, different modes of fail-safe control can be performed according to the control mode. That is, more subdivided fail control can be executed for each control mode.

(1b) In the monitoring IC 24, the estimation unit 52 estimates the control mode determined by the microcomputer 22 based on the same processing as the microcomputer 22 by using the same state signal as the microcomputer 22. Then, the determination unit 53 performs fail-safe control in a different mode for each estimation mode estimated in this way.

As a result, the estimation accuracy of the estimation mode is improved as compared with the case where the estimation mode is estimated based on the state signal different from that of the microcomputer 22 and the case where the estimation mode is estimated based on the processing different from that of the microcomputer 22. Then, since the fail-safe control based on the improved estimation mode is executed, the fail-safe control capable of maintaining the safety of the vehicle can be executed.

(1c) In the monitoring IC 24, the determination unit 53 fails the control (that is, stop control) for the electronic throttle 31 which is one of the electronic throttle 31 and the injector 32 during the stoichiometric control which is the first control mode. It may be performed as a safe control. Further, the determination unit 53 may perform control (that is, stop control) for both the electronic throttle 31 and the injector 32 as fail-safe control during the lean burn control, which is the second control mode. As a result, different fail-safe controls can be performed depending on the control mode.

(1d) The determination unit 53 controls to stop the output of the first drive signal D1 to the electronic throttle 31 when it is determined that an abnormality has occurred in the microcomputer 22 and the estimation mode is stoichiometric control. It may be performed as a fail-safe control. As a result, it is possible to perform fail-safe control that limits the drive output and realizes evacuation running according to the estimation mode. That is, depending on the estimation mode, it is possible to perform fail-safe control that maintains the safety of the vehicle and makes the vehicle travelable as much as possible to improve the commercial value of the vehicle.

(1e) When it is determined that an abnormality has occurred in the microcomputer 22, the determination unit 53 stops the output of the first drive signal D1 to the electronic throttle 31 when the estimation mode is lean burn control. Moreover, the output of the second drive signal D2 to the injector 32 may be stopped. As a result, fail-safe control for stopping the vehicle can be performed according to the estimation mode. That is, depending on the estimation mode, fail-safe control can be performed with the highest priority given to the transition to the safe state of the vehicle.

[2. Second Embodiment]
[2-1. Constitution]
Since the basic configuration of the second embodiment is the same as that of the first embodiment, the differences will be described below. The same reference numerals as those in the first embodiment indicate the same configurations, and the preceding description will be referred to.

In the first embodiment described above, the monitoring IC 24 includes a determination unit 51, an estimation unit 52, and a determination unit 53. On the other hand, in the second embodiment, as shown in FIG. 4, the monitoring IC 24 is different from the first embodiment in that the special stop portion 54 is further provided.

Further, it differs from the first embodiment in that the state signal input to the ECU 10 further includes an A / F signal. The A / F signal is a signal indicating the actual air-fuel ratio detected by using the A / F sensor provided on the exhaust side of the engine.

The first drive device 61 and the second drive device 62 stop their output when at least a low-level fail-safe signal is input. That is, even if a plurality of fail-safe signals are input, the first drive device 61 and the second drive device 62 stop the output if at least one of them is at a low level.

The microcomputer 22 of the second embodiment is configured in the same manner as the microcomputer 22 of the first embodiment. That is, as described above, the target control unit 41 determines the control mode, and the first control signal S1 and the second control signal S2 for controlling the electronic throttle 31 and the injector 32 according to the determined control mode. Is output. As described above, the inspection unit 42 and the management unit 43 generate a test result signal and output the test result signal as a monitoring signal to the monitoring IC 24. The monitoring signal is a signal used to determine whether or not the microcomputer 22 is normal.

In the monitoring IC 24 of the second embodiment, as described above, the determination unit 51 determines whether or not an abnormality has occurred in the microcomputer 22 based on the test result signal, and outputs the determination result to the determination unit 53. The estimation unit 52 specifies the estimation mode as described above. However, in the present embodiment, the estimation unit 52 outputs an estimation mode signal corresponding to the estimation mode to the determination unit 53 and the special stop unit 54. As described above, the determination unit 53 outputs the first fail-safe signal C1 and the second fail-safe signal C2.

When the estimation mode and the control mode specified by the air-fuel ratio indicated by the A / F signal do not match, the special stop unit 54 controls to stop the engine assuming that the determination result by the determination unit 51 is incorrect. .. The state in which the determination result by the determination unit 51 is incorrect includes at least one of the cases where the microcomputer 22 is abnormal and the case where the determination unit 51 is abnormal. This is because when the microcomputer 22 and the determination unit 51 are normal, the estimation mode and the control mode specified by the air-fuel ratio indicated by the A / F signal are substantially the same.

Specifically, in the special stop unit 54, the air-fuel ratio indicated by the A / F signal is any of a plurality of control modes executed by the microcomputer 22 based on a predetermined map, corresponding information, a calculation formula, and the like. Identify what is achieved by the control mode of. For example, correspondence information for associating the value of the A / F signal with one of the stoichiometric control and the lean burn control may be stored in the monitoring IC 24.

The special stop unit 54 specifies, for example, which of the control modes, the stoichiometric control and the lean burn control, realizes the air-fuel ratio indicated by the A / F signal by using the corresponding information. In the present embodiment, the special stop unit 54 outputs a high-level signal as an actual mode signal when the control mode specified by the air-fuel ratio indicated by the A / F signal is stoichiometric control, and is lean burn control. A low level signal is output as a real mode signal.

Here, the special stop unit 54 outputs a low-level third fail-safe signal C3 to the first drive device 61 when the estimated mode signal and the actual mode signal match, and the second drive device 62. Outputs a low-level fourth fail-safe signal C4. On the other hand, when the estimated mode signal and the actual mode signal do not match, the special stop unit 54 outputs a high level third fail-safe signal C3 to the first drive device 61 and high to the second drive device 62. The level 4 fail-safe signal C4 is output.

[2-2. Operation]
The state of the vehicle based on the monitoring of the monitoring IC 24 configured in this way will be described below.
(Operation 4) When the estimation mode and the control mode specified by the air-fuel ratio indicated by the A / F signal match, the special stop portion 54 sends the first drive device 61 to the low-level third fail-safe signal C3. Is output. Moreover, a low-level fail-safe signal C4 is output to the second drive device 62. As a result, in the vehicle, when the microcomputer 22 is normal, the vehicle normally travels according to the control mode. If the microcomputer 22 is abnormal, fail-safe control is performed by the determination unit 53.

(Operation 5) When the estimation mode and the control mode specified by the air-fuel ratio indicated by the A / F signal do not match, the special stop unit 54 considers that the determination result by the determination unit 51 is incorrect and first drives the unit. A high-level third fail-safe signal C3 is output to the device 61. Moreover, a high-level fail-safe signal C4 is output to the second drive device 62. As a result, the vehicle is stalled, and a fail-safe state in which the vehicle stops is realized.

[2-3. effect]
According to the second embodiment described in detail above, the effects (1a)-(1e) of the above-mentioned first embodiment are exhibited, and the following effects are further achieved.

(2a) In the microcomputer 22, the inspection unit 42 and the management unit 43 generate a monitoring signal (that is, a test result signal) used for determining whether or not the microcomputer 22 is normal, and output it to the monitoring IC 24. do. The special stop unit 54 determines whether or not the determination result by the determination unit 51 is correct based on the A / F signal. As a result, when it is determined that the determination result is incorrect, it is possible to appropriately perform fail-safe control assuming that at least one of the microcomputer 22 and the estimation unit 52 may have an abnormality. ..

(2b) The special stop unit 54 may control to stop the engine to be controlled when the estimation mode and the control mode specified by the air-fuel ratio indicated by the A / F signal do not match. As a result, even if the determination unit 51 determines that the microcomputer 22 is normal, if the estimation mode and the control mode specified by the air-fuel ratio indicated by the A / F signal do not match, The vehicle can be stopped and the safety of the vehicle can be maintained more reliably.

In the above-described embodiment, the ECU 10 corresponds to the electronic control device, the microcomputer 22 and the target control unit 41 correspond to the control unit, and the monitoring IC 24 corresponds to the monitoring unit. Further, the actuator corresponds to the drive mechanism, the first actuator and the electronic throttle 31 correspond to the first drive mechanism, and the second actuator and the injector 32 correspond to the second drive mechanism. The inspection unit 42 and the management unit 43 correspond to the monitoring signal unit. Stoiki control corresponds to the first control mode, and lean burn control corresponds to the second control mode. The A / F signal corresponds to the air-fuel ratio signal, and the test result signal corresponds to the monitoring signal.

[3. Other embodiments]
Although the embodiments of the present disclosure have been described above, the present disclosure is not limited to the above-described embodiments, and can be implemented in various modifications.

(3a) In the above-described embodiment, the target control unit 41 determines the control mode based on the required torque signal and the engine speed signal. However, the present disclosure is not limited to this. The target control unit 41 is configured to use a signal similar to the required torque signal instead of the required torque signal and determine the control mode based on the signal similar to the required torque signal and the engine speed signal. May be done. A signal similar to the required torque signal may include a signal indicating an engine intake air amount, a signal indicating an engine intake pipe pressure, a signal indicating a fuel injection amount, a signal indicating an ignition timing, and the like. The engine intake air amount, engine intake pipe pressure, fuel injection amount, ignition timing, etc. can all be detected by various sensors.

(3b) In the above-described embodiment, the determination unit 51 sets the control mode based on the required torque signal and the engine speed signal by using the map as in the target control unit 41, as in the target control unit 41. I was estimating. However, the present disclosure is not limited to this. The determination unit 51 may be configured to estimate the control mode by a process different from that of the target control unit 41 by using a state signal different from that of the target control unit 41.

(3c) In the above-described embodiment, the test result signal is used as the monitoring result signal, but in the present disclosure, the monitoring result signal is not limited to the test result signal. For example, a so-called watchdog (hereinafter, WDG) signal may be used as a monitoring signal. In this case, the inspection unit 42 may be a WDG circuit that generates a WDG signal, and the management unit 43 may be a circuit that outputs the WDG signal to the monitoring IC 24. In the monitoring IC 24, the determination unit 51 is configured to compare the reception cycle of the WDG signal with a predetermined cycle as an expected value, and if they match, determine that the microcomputer 22 is normal. May be good. With this, the above-mentioned effect can be obtained in the same manner. Further, the inspection unit 42, the management unit 43, and the determination unit 51, which are configured to determine the abnormality of the microcomputer 22, can be simply configured.

(3d) In the above-described embodiment, the control target is an engine, and the microcomputer 22 as a control unit determines one control mode from a plurality of control modes, stoichiometric control and lean burn control, and controls the control target. An example of performing However, the present disclosure is not limited to this.

For example, the controlled object may be various devices for controlling the vehicle. For example, the target control unit 41 is a control device that controls various devices of the drive system such as the above-mentioned engine, various devices that operate the steering system according to the amount of steering operation, various devices of the braking system such as a brake, and the like. possible.

Further, the plurality of control modes of the controlled objects may include various control modes for these controlled objects.
(3e) In the above-described embodiment, an example in which the engine to be controlled is driven by the electronic throttle 31 which is the first drive mechanism and the injector 32 which is the second drive mechanism has been described. It is not limited to this. The plurality of drive mechanisms that drive the control object, such as the first drive mechanism and the second drive mechanism, may include various actuators, electronic control devices, and the like according to the control object.

(3f) In the above-described embodiment, the microcomputer 22 as a control unit controls the engine to be controlled in a plurality of control modes, and the plurality of control modes are the first control mode, the stoichiometric control and the second control. An example of lean burn control, which is a mode, has been described. However, the present disclosure is not limited to this. For example, the control mode of the control target executed by the microcomputer 22 which is a control unit may further include one or a plurality of control modes in addition to the first control mode and the second control mode. The monitoring IC 24 may be configured such that different fail-safe controls are performed for each of these plurality of control modes (that is, three or more control modes).

(3g) The ECU 10 and its method described in the present disclosure are provided by a dedicated computer provided by configuring a processor and memory programmed to perform one or more functions embodied by a computer program. , May be realized. Alternatively, the ECU 10 and its method described in the present disclosure may be realized by a dedicated computer provided by configuring the processor with one or more dedicated hardware logic circuits. Alternatively, the ECU 10 and its method described in the present disclosure are configured by a combination of a processor and memory programmed to perform one or more functions and a processor composed of one or more hardware logic circuits. It may be realized by one or more dedicated computers. The computer program may also be stored on a computer-readable non-transitional tangible recording medium as an instruction executed by the computer. The method for realizing the functions of each part included in the ECU 10 does not necessarily include software, and all the functions may be realized by using one or a plurality of hardware.

(3h) Even if a plurality of functions possessed by one component in the above-described embodiment are realized by a plurality of components, or one function possessed by one component is realized by a plurality of components. good. Further, a plurality of functions possessed by the plurality of components may be realized by one component, or one function realized by the plurality of components may be realized by one component. Further, a part of the configuration of the above-described embodiment may be omitted. In addition, at least a part of the configuration of the above-described embodiment may be added or replaced with the configuration of another above-mentioned embodiment.

(3i) In addition to the above-mentioned ECU 10, the monitoring IC 24, the system including the monitoring IC 24 and the ECU 10 as components, the computer having the function of the monitoring IC 24, the program for operating the ECU 10, the program for realizing the function of the monitoring IC 24, this program. It is also possible to realize the present disclosure in various forms such as a non-transitional actual recording medium such as a semiconductor memory in which the program is recorded, and a monitoring method.

10 ECU, 22 microcomputer, 23 output unit, 24 monitoring IC, 51 judgment unit, 52 estimation unit, 53 determination unit, 141 target control unit.

Claims (8)

An electronic control device (20) mounted on a vehicle and controlling a predetermined control target.
A control unit (22) configured to determine one of the control modes indicating a control mode of the control target and control the control target.
A monitoring unit (24) configured to monitor the control unit, and
With
The monitoring unit
A determination unit (51) for determining whether or not an abnormality has occurred in the control unit, and
An estimation unit (52) that estimates the control mode determined by the control unit, and
A determination unit (53) that performs fail-safe control in a different mode for each estimation mode, which is the control mode estimated by the estimation unit, when it is determined that an abnormality has occurred in the control unit.
Electronic control device equipped with. The electronic control device according to claim 1.
The control unit acquires at least one state signal representing the state of the vehicle, determines the one control mode by a predetermined process based on the acquired state signal, and determines the one control mode.
In the monitoring unit
The estimation unit is an electronic control device that acquires at least one state signal and estimates the determined control mode based on the acquired state signal. The electronic control device according to claim 2.
The estimation unit acquires the same state signal as the control unit, and based on the acquired state signal, the electronic control device estimates the determined control mode by the same processing as the control unit. .. The electronic control device according to any one of claims 1 to 3.
The control target is controlled by a plurality of drive mechanisms driven according to the drive signal, and the control unit is the drive signal and is set to one control mode determined from the plurality of control modes. Control is performed to output the drive signal that drives each of the plurality of drive mechanisms accordingly.
The plurality of control modes include a first control mode and a second control mode.
The plurality of drive mechanisms include a first drive mechanism and a second drive mechanism.
In the monitoring unit
The estimation unit estimates one of the first control mode and the second control mode as the determined control mode.
When it is determined that an abnormality has occurred in the control unit, the determination unit controls the first drive mechanism as the fail-safe control when the estimation mode is the first control mode. An electronic control device that controls both the first drive mechanism and the second drive mechanism as the fail-safe control when the estimation mode is the second control mode. The electronic control device according to claim 4.
When it is determined that an abnormality has occurred in the control unit, the determination unit controls to stop the drive signal to the first drive mechanism when the estimation mode is the first control mode. An electronic control device that performs the above-mentioned fail-safe control. The electronic control device according to claim 4 or 5.
When it is determined that an abnormality has occurred in the control unit, the determination unit stops the drive signal to the first drive mechanism when the estimation mode is the second control mode. An electronic control device that controls the stop of the drive signal to the second drive mechanism as the fail-safe control. The electronic control device according to any one of claims 1 to 5.
The controlled object is an engine.
The plurality of control modes are the control modes that realize different air-fuel ratios.
The control unit includes monitoring signal units (42, 43) configured to generate a monitoring signal used for determining whether or not the control unit is normal and output the monitoring signal to the monitoring unit. Further prepare
In the monitoring unit
The determination unit determines whether or not an abnormality has occurred in the control unit based on the monitoring signal output from the control unit.
An electronic control device further comprising a special stop unit (54) for determining whether or not the determination result by the determination unit is correct based on the air-fuel ratio signal indicating the air-fuel ratio. The electronic control device according to claim 7.
The special stop is
An electronic control device that controls to stop the controlled object when the estimated mode and the control mode specified by the air-fuel ratio indicated by the air-fuel ratio signal do not match.

Images