JP6052114B2 - Driving force control device - Google Patents

Description

  The present invention relates to a driving force control apparatus.

  Conventionally, a technique for monitoring an abnormality of a main microcomputer using a determination IC is known. For example, in Patent Document 1, when the determination IC detects an abnormality of the microcomputer, the output from the main microcomputer is stopped by an instruction from the determination IC, thereby preventing the output of the abnormal value.

JP 2011-127546 A

In Patent Document 1, when the determination IC is abnormal, normal control is continued if there is no abnormality in the main microcomputer. In this case, since the normal control is continued in a state where the abnormality of the main microcomputer is not monitored, if an abnormality occurs in the main microcomputer, there is a possibility that the vehicle cannot be evacuated and stops immediately.
The present invention has been made in view of the above-described problems, and an object of the present invention is to provide a driving force control device that can be appropriately controlled according to an abnormal location.

The present invention is a driving force control apparatus that controls a vehicle including a driving source including a motor generator, and includes a driving force calculation unit, a first monitoring unit, a second monitoring unit, and a driving force arbitration unit. .
The driving force calculation means calculates a target driving force related to the driving force output from the driving source based on the driver operation information.

The first monitoring unit monitors the abnormality of the driving force calculation unit. The second monitoring unit monitors the abnormality of the first monitoring unit.
The driving force arbitration unit limits the driving force output from the driving source according to the abnormality determination result by the first monitoring unit and the second monitoring unit.

In the present invention, the driving force calculation means and the first monitoring means are configured by the first calculation unit. The second monitoring means is constituted by a second calculation unit. The first monitoring means monitors the abnormality of the second monitoring means.
When the abnormality of the first monitoring unit is detected, the driving force arbitration unit sets a driving force output value that is a value that limits the target driving force to a value that is smaller than a maximum value that can be output from the driving source. Below the value. The driving force arbitration unit stops generating the driving force by the driving source when an abnormality of the driving force calculation unit is detected. When an abnormality of the second monitoring unit is detected, the driving force arbitration unit sets the driving force output value to be equal to or less than the second limit value that is equal to or less than the maximum value and greater than the first limit value.

In the present invention, since the second monitoring means is constituted by the second calculation unit provided separately from the first calculation unit including the driving force calculation means and the first monitoring means, the independence of the second monitoring means is ensured. be able to.
In addition, since the driving force arbitration means limits the driving force output from the drive source according to the abnormal location, the driving of the vehicle can be appropriately controlled according to the abnormal location.

It is a mimetic diagram explaining the vehicle control system by a 1st embodiment of the present invention. It is a block diagram explaining ECU by a 1st embodiment of the present invention. It is a flowchart explaining the driving force arbitration process by 1st Embodiment of this invention. It is explanatory drawing explaining the driving force output value by 1st Embodiment of this invention. It is explanatory drawing explaining the driving force output value by 2nd Embodiment of this invention.

Hereinafter, a driving force control apparatus according to the present invention will be described with reference to the drawings.
(First embodiment)
A driving force control apparatus according to a first embodiment of the present invention will be described with reference to FIGS.
As shown in FIG. 1, the vehicle control system 1 according to the present embodiment includes a motor generator (hereinafter referred to as “MG”) 20, an inverter 30, a battery 40 as a power supply source, a relay unit 45, and driving force control. The ECU 50 is a device and is mounted on the vehicle 90.

The MG 20 has a function as an electric motor that generates torque by being supplied with electric power from the battery 40 via the inverter 30 and rotates, and a function as a generator that is driven when the vehicle 90 is braked to generate electric power.
The driving force generated by driving the MG 20 rotates the driving wheel 93 via the gear 91 and the axle 92.

  Inverter 30 is provided between MG 20 and battery 40, converts the power of battery 40 into AC power, and supplies the AC power to MG 20. Further, the electric power generated by the MG 20 is converted into DC power and supplied to the battery 40.

  The battery 40 is a secondary battery such as nickel metal hydride or lithium ion, and is configured to be chargeable / dischargeable. The battery 40 is charged and discharged so that the SOC (State of charge) is within a predetermined range. Instead of the battery 40, other devices that can be charged and discharged, such as an electric double layer capacitor, may be used.

  The relay unit 45 is a high voltage relay provided between the inverter 30 and the battery 40 and capable of switching between interruption and interruption between the inverter 30 and the battery 40, and is configured by, for example, a contactor. By cutting off the relay unit 45, the connection between the MG 20 and the battery 40 can be cut off.

The ECU 50 is configured by a microcomputer or the like. In the present embodiment, the ECU 50 includes a host ECU 51 as a first control unit that controls driving of the entire vehicle 90 and an MG-ECU 52 as a second control unit that controls driving of the MG 20.
As shown in FIG. 2, the upper EUC 51 includes a CPU 60 as a first calculation unit and a monitoring IC 70 as a second calculation unit.
The CPU 60 includes an input processing unit 61, a driving force calculation unit 62, a driving force arbitration unit 63, a first monitoring unit 65, and a first failsafe unit 69.

The input processing unit 61 acquires driver operation information input from a sensor such as an accelerator sensor (not shown), vehicle speed information related to the traveling speed of the vehicle 90, and outputs the acquired information to the driving force calculation unit 62 and the first monitoring unit 65. .
The driving force calculation unit 62 calculates a target driving force Pa related to the driving force output from the MG 20 based on the driver operation information, the vehicle speed information, and the like.
The driving force arbitration unit 63 limits the target driving force Pa and limits the driving force output from the MG 20 according to an abnormality determination result described later. Specifically, a driving force output value Pb that is a value obtained by limiting the target driving force Pa is output to the MG-ECU 52 according to the abnormality determination result. The MG-ECU 52 controls driving of the MG 20 based on the driving force output value Pb.

The first monitoring unit 65 includes a system diagnosis unit 66 and a function test unit 67.
The system diagnosis unit 66 calculates the monitoring driving force Ps based on the driver operation information and the like, and compares the monitoring driving force Ps with the target driving force Pa calculated by the driving force calculation unit 62, thereby correcting the abnormality of the driving force calculation unit 62. Monitor. The calculation of the monitoring driving force Ps may be the same as the calculation in the driving force calculation unit 62 or may be a simple calculation. Further, when the system diagnosis unit 66 determines that the driving force calculation unit 62 is abnormal, the system diagnosis unit 66 outputs a driving force calculation unit abnormality flag Flg1 to the first failsafe unit 69.

The function test unit 67 is configured to be capable of data communication with a test result evaluation unit 72 described later, and monitors the abnormality of the second monitoring unit 71. When the function test unit 67 detects an abnormality in the second monitoring unit 71, the second monitoring unit abnormality flag Flg 2 is output to the first failsafe unit 69.
When the driving force calculation unit abnormality flag Flg1 is output from the first monitoring unit 65, the first fail safe unit 69 outputs a driving force limit signal C0 indicating that the driving force output value Pb is zero to the driving force arbitration unit 63. While outputting, the interruption | blocking signal Cs to the effect of interrupting | releasing the relay part 45 is output to the relay part 45. FIG.
In addition, the first fail safe unit 69 restricts the upper limit value of the target driving force Pa to the second limit value P2 when the second monitoring unit abnormality flag Flg2 is output from the first monitoring unit 65. The signal C2 is output to the driving force arbitration unit 63. The second limit value P2 is a value not more than the system maximum value Pmax that is the maximum value that can be output from the motor generator 20, and is a value that is greater than a first limit value P1 described later.

The monitoring IC 70 includes a second monitoring unit 71 and a second fail safe unit 79.
The second monitoring unit 71 includes a test result evaluation unit 72.
The test result evaluation unit 72 is configured to be able to perform data communication with the function test unit 67 and monitors the CPU 60 and the first monitoring unit 65 for abnormalities. When the test result evaluation unit 72 determines that the CPU 60 is abnormal, the test result evaluation unit 72 outputs the CPU abnormality flag Flg3 to the second failsafe unit 79. When the test result evaluation unit 72 determines that the first monitoring unit 65 is abnormal, the test result evaluation unit 72 transmits a first monitoring unit abnormality flag Flg4 to the second failsafe unit 79.

When the CPU abnormality flag Flg3 is output from the second monitoring unit 71, the second fail safe unit 79 outputs a driving force limit signal C0 indicating that the driving force output value Pb is zero to the driving force arbitration unit 63. Then, a cut-off signal Cs to cut off the relay unit 45 is output to the relay unit 45.
Further, when the first monitoring unit abnormality flag Flg4 is output from the second monitoring unit 71, the second fail safe unit 79 sets the upper limit value of the target driving force Pa to the first limit value P1 smaller than the second limit value P2. A driving force limit signal C1 indicating that the operation is to be performed is output to the driving force adjusting unit 63. The first limit value P1 is a value smaller than the system maximum value Pmax and the second limit value P2, and corresponds to a driving force that allows retreat travel.

In the present embodiment, the function test unit 67 and the test result evaluation unit 72 constitute a system diagnosis monitoring unit 80 and performs abnormality monitoring by mutual monitoring.
Here, mutual monitoring by the function test unit 67 and the test result evaluation unit 72 will be described.
First, the function test unit 67 transmits preset determination data to the test result evaluation unit 72. The test result evaluation unit 72 determines whether or not the received determination data is appropriate. When the received determination data is not appropriate, it is determined that the first monitoring unit 65 is abnormal, and the first monitoring unit abnormality flag Flg4 is output to the second failsafe unit 79. When the determination data is appropriate, it is determined that the first monitoring unit 65 is normal, and response data corresponding to the received determination data is transmitted to the function test unit 67.

The function test unit 67 determines whether the received answer data matches the transmitted determination data. When the received answer data does not match the determination data, the second monitoring unit 71 determines that there is an abnormality, and outputs the second monitoring unit abnormality flag Flg2 to the first fail safe unit 69. When the received answer data matches the determination data, the normal determination is made.
Note that when the determination data is not transmitted, the test result evaluation unit 72 determines that the CPU 60 is abnormal and outputs the CPU abnormality flag Flg3 to the second failsafe unit 79.

Here, the driving force arbitration process corresponding to the abnormal part will be described based on the flowchart shown in FIG.
In the first step S101 (hereinafter, “step” is omitted and simply indicated by the symbol “S”), the driving force calculation unit 62 calculates the target driving force Pa based on the driver operation information and the like.

  In S102, the second monitoring unit 71 determines whether an abnormality of the CPU 60 has been detected. When abnormality of CPU60 is not detected (S102: NO), it transfers to S104. When abnormality of CPU60 is detected (S102: YES), CPU abnormality flag Flg3 is output to the 2nd fail safe part 79, and it transfers to S103.

  In S103, the second fail safe unit 79 outputs a driving force limiting signal C0 indicating that the driving force output value Pb is limited to zero to the driving force arbitrating unit 63. The driving force arbitration unit 63 sets the driving force output value Pb to 0 and outputs it to the MG-ECU 52. Further, the second fail safe unit 79 outputs a blocking signal Cs for blocking the relay unit 45 to the relay unit 45 to block the relay unit 45. Thereby, the generation of the driving force by the MG 20 is stopped.

  In S104, when the abnormality of the CPU 60 is not detected (S102: NO), the first monitoring unit 65 determines whether an abnormality of the second monitoring unit 71 is detected. When abnormality of the 2nd monitoring part 71 is not detected (S104: NO), it transfers to S106. When the abnormality of the second monitoring unit 71 is detected (S104: YES), the second monitoring unit abnormality flag Flg2 is output to the first failsafe unit 69, and the process proceeds to S105.

In S <b> 105, the first fail safe unit 69 outputs a driving force limit signal C <b> 2 for limiting the driving force output value Pb to the second limit value P <b> 2 or less to the driving force arbitration unit 63. When the target driving force Pa is larger than the second limit value P2, the driving force arbitration unit 63 sets the driving force output value Pb as the second limit value P2 and outputs it to the MG-ECU 52. Further, when the target driving force Pa is equal to or smaller than the second limit value P2, the driving force arbitration unit 63 sets the target driving force Pa as the driving force output value Pb and outputs it to the MG-ECU 52.
As a result, the driving force output value Pb is limited to the second limit value P2 or less.
Here, although an abnormality has occurred in the second monitoring unit 71, the CPU 60 is normal, and the first monitoring unit 65 can monitor the abnormality of the driving force calculation unit 62, so that the driving force output from the MG 20 is output. Is controlled to be equal to or less than the second limit value P2.

  In S106, the process proceeds to a case where an abnormality of the second monitoring unit 71 is not detected (S104: NO), the second monitoring unit 71 determines whether an abnormality of the first monitoring unit 65 is detected. When abnormality of the 1st monitoring part 65 is not detected (S106: NO), it transfers to S108. When an abnormality of the first monitoring unit 65 is detected (S106: YES), the first monitoring unit abnormality flag Flg4 is output to the second failsafe unit 79, and the process proceeds to S107.

In S107, the second fail safe unit 79 outputs a driving force limit signal C1 for limiting the driving force output value Pb to the first limiting value P1 or less to the driving force arbitration unit 63. When the target driving force Pa is larger than the first limit value P1, the driving force arbitration unit 63 sets the driving force output value Pb as the first limit value P1 and outputs it to the MG-ECU 52. Further, when the target driving force Pa is equal to or less than the first limit value P1, the driving force arbitration unit 63 sets the target driving force Pa as the driving force output value Pb and outputs it to the MG-ECU 52.
Here, although the driving force calculation unit 62 is normal, an abnormality has occurred in the first monitoring unit 65 and the driving force calculation unit 62 cannot be monitored, so the driving force output from the MG 20 is saved. The MG 20 is controlled so as to be equal to or less than the first limit value P1, which is a value capable of traveling.

  In S108, when the abnormality of the first monitoring unit 65 is not detected (S106: NO), the first monitoring unit 65 determines whether an abnormality of the driving force calculation unit 62 is detected. When the abnormality of the driving force calculation unit 62 is not detected (S108: NO), the target driving force Pa calculated by the driving force calculation unit 62 is not limited, and the target driving force Pa is directly used as the driving force output value Pb. And output to the MG-ECU 52. When an abnormality of the driving force calculation unit 62 is detected (S108: YES), the driving force calculation unit abnormality flag Flg1 is output to the first failsafe unit 69, and the process proceeds to S109.

  In S109, the first fail safe unit 69 outputs a driving force limit signal C0 indicating that the driving force output value Pb is limited to zero to the driving force arbitration unit 63. The driving force arbitration unit 63 sets the driving force output value Pb to 0 and outputs it to the MG-ECU 52. In addition, the first fail safe unit 69 outputs a blocking signal Cs for blocking the relay unit 45 to the relay unit 45 to block the relay unit 45. Thereby, the generation of the driving force by the MG 20 is stopped.

Here, the relationship between the upper limit value of the driving force output value Pb and the abnormality flag will be described with reference to FIG. 4A shows the upper limit value of the driving force output value Pb, FIG. 4B shows the second monitoring unit abnormality flag Flg2, FIG. 4C shows the first monitoring unit abnormality flag Flg4, and FIG. 4D shows the driving force calculation unit abnormality flag Flg1. , (E) shows the connection state of the relay unit 45. In FIG. 4, a state where Flg 1, 2 and 4 are set is indicated by “1”, and a state where Flg 1, 2 and 4 are not set is indicated by “0”.
FIG. 4 illustrates the relationship between the set state of each abnormality flag and the upper limit value of the driving force output value Pb, and does not mean a change with time. That is, in FIG. 4, for example, regarding the second monitoring unit abnormality flag Flg2, it does not mean that the flag once set is reset as time elapses. The same applies to the first monitoring unit abnormality flag Flg4.

As shown in FIG. 4A, when no abnormality flag is set, the upper limit value of the driving force output value Pb is the system maximum value Pmax.
When the second monitoring unit abnormality flag Flg2 is set, the upper limit value of the driving force output value Pb is limited to a second limit value P2 that is a value equal to or less than the system maximum value Pmax.
When the first monitoring unit abnormality flag Flg4 is set, the upper limit value of the driving force output value Pb is limited to the first limit value P1 that is smaller than the second limit value P2.

  When the driving force calculation unit abnormality flag Flg1 is set, the upper limit value of the driving force output value Pb is limited to zero. That is, the driving force output value Pb is zero. Further, as shown in FIG. 4E, the relay unit 45 is shut off. In FIG. 4, the CPU abnormality flag Flg3 is not mentioned, but when the CPU abnormality flag Flg3 is set, the driving force output value Pb is set to zero as in the case where the driving force calculation unit abnormality flag Flg1 is set. And the relay unit 45 is shut off.

  In the present embodiment, the first monitoring unit 65 that monitors the abnormality of the driving force calculation unit 62 is mounted in the same CPU 60 as the driving force calculation unit 62. For this reason, a monitoring IC 70 that can be monitored from outside the CPU 60 is provided to ensure the independence of monitoring as hardware. The monitoring IC 70 according to the present embodiment includes a test result evaluation unit 72 that communicates with the first monitoring unit 65 and determines abnormality of the first monitoring unit 65, and calculates a driving force like the system diagnosis unit 66. It does not have the configuration. Thereby, compared with CPU60, monitoring IC70 is realizable with a simple apparatus.

Moreover, in this embodiment, since the abnormal location can be specified by mutual monitoring between the first monitoring unit 65 and the second monitoring unit 71, appropriate output restriction can be performed according to the abnormal location.
That is, when the CPU 60 or the driving force calculation unit 62 is abnormal, it is not known what output is required, so the driving force output value Pb is set to zero and the relay unit 45 is shut off. As a result, the output from the MG 20 is limited to zero.

Further, when the first monitoring unit 65 is abnormal, the driving force calculating unit 62 cannot determine the abnormality, so the upper limit value of the driving force output value Pb is set to the first limit value P1, which is a value that allows retreat travel. . Thereby, evacuation traveling is enabled.
Furthermore, when the second monitoring unit 71 is abnormal, there is no abnormality in the monitoring system in the CPU 60, so the output from the MG 20 is continued within the range of the second limit value P2 or less. As a result, the driving of the vehicle 90 can be appropriately controlled without restricting excessive driving force. However, since redundancy as hardware is lost, it is desirable to notify the driver that an abnormality has occurred, for example, by a warning lamp.

As described above in detail, the ECU 50 according to the present embodiment controls the vehicle 90 including the drive source including the MG 20, and includes the drive force calculation unit 62, the first monitoring unit 65, and the second monitoring unit 71. And comprising.
The driving force calculation unit 62 calculates a target driving force Pa related to the driving force output from the driving source based on the driver operation information (S101 in FIG. 3).

The first monitoring unit 65 monitors the abnormality of the driving force calculation unit 62 (S108).
The second monitoring unit 71 monitors the abnormality of the first monitoring unit 65 (S106).
The driving force arbitration unit 63 limits the driving force output from the MG 20 according to the abnormality determination result by the first monitoring unit 65 and the second monitoring unit 71 (S105, S107, S109).

In the present embodiment, the driving force calculation unit 62 and the first monitoring unit 65 are configured by the CPU 60. The second monitoring unit 71 includes a monitoring IC 70.
When the abnormality of the first monitoring unit 65 is detected (S106: YES), the driving force arbitration unit 63 sets the driving force output value Pb, which is a value limiting the target driving force Pa, to the maximum value that can be output from the MG 20. The first limit value P1 that is smaller than a certain system maximum value Pmax is set to be equal to or less than the first limit value P1 (S107).
When the abnormality of the driving force calculation unit 62 is detected (S108: YES), the driving force arbitration unit 63 stops the generation of the driving force by the MG 20 (S109).

In the present embodiment, since the second monitoring unit 71 is configured by a monitoring IC 70 provided separately from the CPU 60 including the driving force calculation unit 62 and the first monitoring unit 65, the second monitoring unit 71 is independent as hardware. Sex can be secured.
Further, the driving force arbitration unit 63 limits the driving force output from the MG 20 according to the abnormal location. Specifically, when the first monitoring unit 65 is abnormal, the monitoring of the driving force calculation unit 62 cannot be continued, so that the driving force output from the MG 20 is limited to a level that allows retreat travel, for example. Further, when the driving force calculation unit 62 is abnormal, it is not known what kind of output is requested, so that the driving force is not output from the MG 20. Thereby, the drive of the vehicle 90 can be appropriately controlled according to the abnormal part.

The first monitoring unit 65 monitors the abnormality of the second monitoring unit 71.
When the abnormality of the second monitoring unit 71 is detected (S104: YES), the driving force arbitration unit 63 sets the driving force output value Pb to be equal to or less than the system maximum value Pmax and greater than the first limit value P1. Below the second limit value.

  That is, in the present embodiment, the first monitoring unit 65 and the second monitoring unit 71 perform mutual monitoring. Even if an abnormality of the second monitoring unit 71 is detected, if the first monitoring unit 65 is normal, the monitoring of the driving force calculation unit 62 can be continued, so the first monitoring unit 65 is abnormal. The limit is weaker than the case. Thereby, the drive of the vehicle 90 can be continued appropriately according to an abnormal location, without adding excessive drive force restriction | limiting.

The first limit value P1 is set to a value that allows retreat travel. In other words, when an abnormality is detected in the first monitoring unit 65, the abnormality determination of the driving force calculation unit 62 cannot be performed. Therefore, by setting the first limit value P1 to a relatively small value that allows retreat travel, The MG 20 can be appropriately controlled and the vehicle 90 can be retreated.
The driving force arbitration unit 63 is configured by the CPU 60. Thereby, the driving force output value Pb limited according to the abnormal part is output from the CPU 60, and the driving of the MG 20 can be appropriately controlled.

The second monitoring unit 71 monitors the abnormality of the CPU 60 (S102).
When the abnormality of the CPU 60 is detected (S102: YES), the driving force arbitration unit 63 stops the generation of the driving force by the MG 20 (S103).
As a result, when the CPU 60 is abnormal, it is not known what output is requested, so that the driving force is not output from the MG 20 and the driving of the vehicle 90 can be appropriately controlled.

In the present embodiment, the first failsafe unit 69 and the second failsafe unit 79 block the relay unit 45 provided between the battery 40 and the MG 20.
When an abnormality is detected in the driving force calculation unit 62 or the CPU 60 (S102: YES or S108: YES), the driving force arbitration unit 63 sets the driving force output value Pb to zero.
When abnormality of the driving force calculating part 62 is detected (S108: YES), the 1st fail safe part 69 interrupts | blocks the relay part 45 (S108: YES). Moreover, when abnormality of CPU60 is detected (S102: YES), the 2nd fail safe part 79 interrupts | blocks the relay part 45 (S103).
As a result, when an abnormality occurs in the driving force calculation unit 62 or the CPU 60, the driving force output value Pb is set to zero, and the power supply from the battery 40 to the MG 20 is interrupted, thereby reliably stopping the output from the MG 20 can do.

In the present embodiment, the driving force calculation unit 62 constitutes “driving force calculation means”, the first monitoring unit 65 constitutes “first monitoring means”, and the second monitoring unit 71 designates “second monitoring means”. The driving force arbitration unit 63 constitutes a “driving force arbitration unit”, and the first failsafe unit 69 and the second failsafe unit 79 constitute a “shut-off unit”.
Further, S101 in FIG. 3 corresponds to the processing as the function of the “driving force calculating means”, S104 and S108 correspond to the processing as the function of the “first monitoring means”, and S102 and S106 are the “second monitoring”. Corresponds to the processing as the function of “means”, S103, S105, S107, and S109 correspond to the processing as the function of “driving force arbitration means”, and S103 and S109 correspond to the processing as the function of “blocking means”. .

(Second Embodiment)
A driving force control apparatus according to a second embodiment of the present invention will be described with reference to FIG.
In the present embodiment, since the driving force output value Pb is different from that of the first embodiment, this point will be mainly described.

In the above embodiment, the upper limit value of the driving force output value Pb is limited according to the abnormality determination result.
In the present embodiment, in addition to limiting the upper limit value, the gradient of the driving force output value Pb is limited.
In FIG. 5, the driving force output value Pb when no abnormality is detected is a solid line L0, the driving force output value Pb when an abnormality of the first monitoring unit 65 is detected is a solid line L1, and the second monitoring unit 71. The driving force output value Pb when the abnormality is detected is indicated by a solid line L3. The slope of the solid line L0 is A0, the slope of the solid line L1 is A1, and the slope of the solid line L2 is A2.

In the present embodiment, when an abnormality of the second monitoring unit 71 is detected (S104 in FIG. 3: YES), the second limit value P2 that is the upper limit value of the driving force output value Pb is set as the system maximum value Pmax. Further, the gradient A2 of the driving force output value Pb is set to be equal to or less than the gradient A0 when no abnormality is detected.
When an abnormality of the first monitoring unit 65 is detected (S106 in FIG. 3: YES), the inclination A1 of the driving force output value Pb is equal to or less than the inclination A2 when the abnormality of the second monitoring unit 71 is detected. And

  Note that the slope A2 of the driving force output value Pb when the abnormality of the second monitoring unit 71 is detected may be equal to the slope A0 when no abnormality is detected. Similarly, the gradient A1 of the driving force output value Pb when the abnormality of the first monitoring unit 65 is detected is equal to the gradient A2 of the driving force output value Pb when the abnormality of the second monitoring unit 71 is detected. May be. Furthermore, A0 = A1 = A2 may be sufficient.

In the present embodiment, the second limit value P2 is the system maximum value Pmax. Even if the second monitoring unit 71 is abnormal, since the abnormality monitoring system in the CPU 60 is normal, it may be controlled within the range of the system maximum value Pmax. As a result, the control of the vehicle 90 can be appropriately continued without excessively limiting the driving force.
In the present embodiment, the gradient of the driving force output value Pb is limited according to the abnormality determination result. Thereby, when abnormality is detected, drive control of the vehicle 90 can be continued on the safer side.
In addition, the same effects as those of the above embodiment can be obtained.

(Other embodiments)
(A) In the above embodiment, the driving force arbitration unit 63 is configured by the CPU 60. In another embodiment, the driving force arbitration unit 63 may be configured by the MG-ECU 52. That is, the ECU 50 that is a driving force control device includes an MG-ECU 52 that controls driving of the MG 20 separately from the host ECU 51 including the CPU 60 and the monitoring IC 70, and the driving force arbitration unit 63 is configured by the MG-ECU 52. In this case, the host ECU 51 corresponds to the “first control unit”, and the MG-ECU 52 corresponds to the “second control unit”. The driving force output value Pb is output internally within the MG-ECU 52. By restricting the driving force according to the abnormal part in the MG-ECU 52, it is not necessary to make the output from the CPU 60 multifunctional, and the configuration of the CPU 60 can be simplified.

(A) In the above embodiment, a drive source is constituted by one MG. In another embodiment, the drive source may be configured by a plurality of MGs. In addition to MG, the drive source may be configured by an engine. That is, the vehicle to which the driving force control device is applied may be a so-called hybrid vehicle.
(C) In the above embodiment, the driving force control device is composed of the host ECU and the MG-ECU. In another embodiment, when an engine is included as a drive source, an engine ECU may be further included. In this case, you may comprise a 2nd control part from engine ECU and MG-ECU. Further, the driving force control device may be configured by a single control unit.

(D) In the above embodiment, the second calculation unit is configured by the monitoring IC 70 having a simpler configuration than the CPU 60. In another embodiment, the second calculation unit may be configured by a CPU similar to the first calculation unit. When the second calculation unit is configured by a CPU similar to that of the first embodiment, the second calculation unit may be configured to have a configuration capable of torque calculation, for example, like the system diagnosis unit.
(E) In the above embodiment, the driving force calculation unit, the system diagnosis unit, and the function test unit are configured by the CPU, and the test result evaluation unit is configured by the monitoring IC. In another embodiment, the function test unit may be configured by a monitoring IC.
As mentioned above, this invention is not limited to the said embodiment at all, In the range which does not deviate from the meaning of invention, it can implement with a various form.

20 ... motor generator 40 ... battery (power supply source)
50 ... ECU (driving force control device)
60... CPU (first arithmetic unit)
62... Driving force calculating section (driving force calculating means)
63: Driving force arbitration unit (driving force arbitration means)
65 ... 1st monitoring part (1st monitoring means)
69 ・ ・ ・ Fail safe part (blocking means)
70 ... Monitoring IC (second arithmetic unit)
71 ... 2nd monitoring part (2nd monitoring means)

Claims (7)

A driving force control device (50) for controlling a vehicle (90) including a driving source including a motor generator (20),
Driving force calculation means (62) for calculating a target driving force related to the driving force output from the driving source based on the driver operation information;
First monitoring means (65) for monitoring an abnormality of the driving force calculating means;
Second monitoring means (71) for monitoring an abnormality of the first monitoring means;
Driving force arbitration means (63) for limiting the driving force output from the driving source in accordance with the abnormality determination result by the first monitoring means and the second monitoring means;
With
The driving force calculation means and the first monitoring means are configured by a first calculation unit (60),
The second monitoring means includes a second calculation unit (70),
The first monitoring means monitors the abnormality of the second monitoring means;
The driving force arbitration means includes
When an abnormality of the first monitoring means is detected, a driving force output value that is a value that limits the target driving force is set to be equal to or less than a first limiting value that is a value smaller than a maximum value that can be output from the driving source,
When abnormality of the driving force calculating means is detected, the generation of driving force by the driving source is stopped ,
When an abnormality of the second monitoring unit is detected, the driving force output value is set to be equal to or less than a second limit value that is equal to or less than the maximum value and greater than the first limit value. Force control device. The driving force control apparatus according to claim 1 , wherein the second limit value is the maximum value. The first limit value, the driving force control apparatus according to claim 1 or 2, characterized in that it is set to evacuation travel possible values. The driving force arbitrating means, driving force control apparatus according to any one of claims 1 to 3, characterized in that it is constituted by the first calculation unit. In addition to the first control unit (51) including the first calculation unit and the second calculation unit, a second control unit (52) for controlling driving of the drive source is included.
The driving force control device according to any one of claims 1 to 3 , wherein the driving force arbitration unit is configured by the second control unit. The second monitoring means monitors the abnormality of the first calculation unit,
The driving force arbitrating means, when an abnormality of the first operation unit is detected, the drive according to any one of claims 1 to 5, characterized in that stops generating the driving force by the drive source Force control device. Further provided is a blocking means (69, 79) for blocking a relay section (45) provided between the power supply source (40) and the motor generator,
When an abnormality of the driving force calculation means or the first calculation unit is detected,
The driving force arbitration means sets the driving force output value to zero,
It said interrupting means, the driving force control apparatus according to any one of claims 1 to 6, characterized in that blocking the relay unit.

Images