JP7251469B2 - electronic controller - Google Patents

Description

The present disclosure relates to technology for monitoring vehicle abnormalities.

For example, Patent Literature 1 below discloses a technique of detecting whether or not an abnormality has occurred in a microcomputer that controls a vehicle, using a monitoring IC that is different from the microcomputer.

JP 2008-226043 A

In the technique described above, the microcomputer is configured to determine the control mode and perform control in the determined control mode.
As a result of detailed studies by the inventors, it was found that with the above technology, the monitoring IC may not be able to grasp the control mode when an abnormality occurs in the microcomputer, making it difficult to perform fail-safe control according to the control mode. A problem was found.

One aspect of the present disclosure is to provide a technique of estimating a control mode and performing fail-safe control according to the estimated control mode when an abnormality occurs in a microcomputer that controls a vehicle.

One aspect of the present disclosure is an electronic control device (20) that is mounted on a vehicle and controls a predetermined controlled object, comprising a control section (22) and a monitoring section (24). The control unit is configured to determine one control mode from among a plurality of control modes indicating control modes of the controlled object, and to control the controlled object. The monitor is configured to monitor the controller. Also, the monitoring unit includes a determining unit (51), an estimating unit (52), and a determining unit (53). The determination unit determines whether or not an abnormality has occurred in the control unit. The estimator estimates the control mode determined by the controller. The determination unit performs fail-safe control in a different manner for each estimation mode, which is the control mode estimated by the estimation unit, when it is determined that the control unit has an abnormality.

According to such a configuration, the monitoring section can estimate the control mode by the control section by means of the estimation section. As a result, the monitoring unit can perform fail-safe control according to the estimated control mode when an abnormality occurs in the control unit.

2 is a block diagram showing the configuration of an ECU according to the first embodiment; FIG. FIG. 4 is an explanatory diagram for explaining control modes; It is explanatory drawing explaining the operation|movement by monitoring IC. FIG. 5 is a block diagram showing the configuration of an ECU according to a second embodiment; FIG.

Exemplary embodiments of the present disclosure will now be described with reference to the drawings. In this specification, the term “similar” is not limited to “similar” in a strict sense, and may not be strictly similar as long as similar effects are achieved.
[1. First Embodiment]
[1-1. composition]
<Overall composition>
An electronic control unit (hereinafter referred to as an ECU) of an embodiment to which the present disclosure is applied is mounted on a vehicle and controls a predetermined control target. It should be noted that the ECU of the present embodiment is intended to control an engine mounted on a vehicle, for example.

The ECU 10 of the first embodiment realizes a control function such as determining control amounts for a plurality of actuators for operating the engine, based on state signals input from various sensors and various devices, for example.

The state signal is a signal that is input to the ECU 10 and is various signals that indicate the state of the vehicle. The state of the vehicle refers to the operational state of the vehicle. State signals may include, for example, torque demand signals and engine speed signals.
The requested torque signal is a signal indicating the requested torque. The requested torque is the torque output by the engine in response to the driver's request. The required torque can be specified using a predetermined map or the like, for example, based on the detection results of the accelerator opening and the engine speed, which indicate the amount of operation of the accelerator pedal by the driver.

The engine speed signal is a signal indicating the engine speed. The engine speed can be specified, for example, from the crank angle based on the detection results of a crank angle sensor and a cam angle sensor (not shown).

A device other than the ECU 10 detects the state of the vehicle indicated by these state signals, generates the state signals, and inputs the generated state signals to the ECU 10 . The ECU 10 is connected to these other devices by communication lines. Various sensors for detecting the state of the vehicle indicated by the state signal and the ECU 10 may be connected by a communication line, the state of the vehicle may be detected by the ECU 10, and the state signal may be generated by the ECU 10.

The engine is controlled by a plurality of actuators. A plurality of actuators here includes a first actuator and a second actuator different from the first actuator. In this embodiment, the electronic throttle 31 corresponds to the first actuator, and the injector 32 corresponds to the second actuator.

The electronic throttle 31 is provided in an intake passage to a cylinder (not shown), and adjusts the throttle opening according to the magnitude and polarity of the current supplied to the electronic throttle 31 to adjust the amount of air taken into the cylinder. A current for driving the electronic throttle 31 is output from a first driving device 61, which will be described later. When the energized current is 0, the electronic throttle 31 is maintained at a slight throttle opening of about several degrees (hereinafter referred to as the initial opening), and a small amount of air is sucked into the cylinder. be done.

The injector 32 is provided in an intake passage (not shown) closer to the cylinder than the electronic throttle 31, and adjusts the amount of fuel injected into the cylinder according to the magnitude and duration of the current supplied to the injector 32. . A current for driving the injector 32 is output from a second driving device 62, which will be described later. Note that when the energized current is 0, the injector 32 does not operate and no fuel is injected into the cylinder.

<Configuration of ECU 10>
As shown in FIG. 1, the ECU 10 includes an input section 21, a microcomputer 22, an output section 23, and a monitoring IC 24.

The input unit 21 is a circuit to which the state signal described above is input from outside the ECU 10 .
The microcomputer 22 determines at least one control mode from among a plurality of control modes indicating a predetermined control mode of the controlled object (that is, the engine), and controls the controlled object (that is, the engine) in the determined control mode. control. The microcomputer 22 generates a plurality of control signals for controlling an object to be controlled (that is, the engine) according to the control mode. The multiple control modes comprise a first control mode and a second control mode.

The multiple control signals include a first control signal S1 and a second control signal S2. The first control signal S1 is a signal for driving the electronic throttle 31, which is the first actuator. The second control signal S2 is a signal for driving the injector 32, which is the second actuator. The first control signal S1 and the second control signal S2 are output to the output section 23 respectively. Details of the microcomputer 22 will be described later.

The output unit 23 includes a plurality of driving devices. The plurality of drive devices comprises a first drive device 61 and a second drive device 62 . The first drive device 61 provides a drive signal (hereinafter referred to as first drive signal) D1 for driving the electronic throttle 31, which is the first actuator, to the electronic throttle 31 based on the first control signal S1. Specifically, the first drive signal D1 is the current that drives the electronic throttle 31 described above.

Also, the first drive device 61 stops outputting the first drive signal D1 to the electronic throttle 31 according to the first fail-safe signal C1 output from the monitoring IC 24 . For example, the first drive device 61 stops outputting the first drive signal D1 to the electronic throttle 31 according to the first fail-safe signal C1 indicating the high level among the two values of high level and low level.

The second drive device 62 gives a drive signal (hereinafter referred to as a second drive signal) D2 for driving the injector 32, which is the second actuator, to the injector 32, which is the second actuator, based on the second control signal S2. Specifically, the second drive signal D2 refers to the current that drives the injector 32 described above.

Also, the second drive device 62 stops outputting the second drive signal D2 to the injector 32 according to the second fail-safe signal C2 output from the monitoring IC 24 . For example, the second drive device 62 stops outputting the second drive signal D2 to the injector 32 according to the second fail-safe signal C2 indicating the high level among the two values of high level and low level.

A monitoring IC 24 is an IC that monitors the operation of the microcomputer 22 . Details of the monitor IC 24 will be described later.
<Configuration of microcomputer 22>
The microcomputer 22 includes a CPU 101, a ROM, a RAM, and a semiconductor memory (hereinafter referred to as memory) 102 such as a flash memory. The ECU 10 implements each function described later by the CPU 101 executing a program stored in a non-transition tangible recording medium. The memory 102 corresponds to a non-transitional tangible recording medium storing computer programs. Also, execution of this computer program executes a method corresponding to the computer program. The microcomputer 22 implements various functions for controlling the engine.

Specifically, the ECU 10 has the functions of an object control section 41, an inspection section 42, and a management section 43, as shown in FIG.
The target control unit 41 determines one control mode from among a plurality of control modes, and controls the control target in the determined control mode. A control mode indicates a control mode of a controlled object. In this embodiment in which the object to be controlled is the engine, the plurality of control modes are control modes that achieve different air-fuel ratios. Specifically, stoichiometric control and lean burn control correspond to a plurality of control modes. Stoichiometric control corresponds to the first control mode, and lean burn control corresponds to the second control mode.

The target control unit 41 acquires a plurality of state signals, and determines one control mode from among the above-described plurality of control modes by predetermined processing based on the acquired state signals. In this embodiment, the required torque signal and the engine speed signal correspond to a plurality of state signals for determining one control mode.

For example, the memory 102 previously stores a map that associates the required torque indicated by the required torque signal, the engine speed indicated by the engine speed signal, and the control mode as shown in FIG. may The object control unit 41 determines one of the stoichiometric control and the lean burn control as one control mode by the processing using such a map.

Then, the target control unit 41 generates the first control signal S1 and the second control signal S2 so that the control amounts of the electronic throttle 31 and the injector 32 correspond to the determined control modes.

The target control section 41 outputs a first control signal S1 to the first driving device 61 . As a result, the first drive signal D1 based on the first control signal S1 is output to the electronic throttle 31, and the electronic throttle 31 operates according to the control mode. The target control unit 41 outputs a second control signal S2 to the second driving device 62. FIG. Thereby, the second drive signal D2 based on the second control signal S2 is output to the injector 32, and the injector 32 operates according to the control mode.
In this way, the target control unit 41 drives each of the plurality of actuators (that is, the electronic throttle 31 and the injector 32) according to one control mode determined from among a plurality of control modes, which is a drive signal. It controls the output of the signal.

Further, when receiving a test signal transmitted from an inspection unit 42, which will be described later, the object control unit 41 performs a test according to a question included in the test signal, and uses the result of the test as an answer. A signal is sent to the inspection unit 42 .

The inspection unit 42 transmits the above-described test signal to the target control unit 41 at a predetermined cycle, and receives an answer signal to the question included in the above-described test signal. The questions are set in advance so as to cause the target control section 41 to perform a test corresponding to the questions for verifying the function of the target control section 41 .

The management unit 43 generates a test result signal indicating the answer included in the answer signal, and transmits the generated test result signal to the monitor IC 24 . In this manner, the inspection unit 42 and the management unit 43 transmit to the monitor IC 24 a signal (that is, a test result signal) for determining whether or not the object control unit 41 is abnormal.

By the way, if an abnormality occurs in the target control unit 41, the vehicle is brought into a safe state (that is, a fail-safe state). A fail-safe state is a state in which the safety of the vehicle is maintained even if an abnormality occurs in the vehicle. In this embodiment, if an abnormality occurs in the target control unit 41 (that is, the microcomputer 22), the monitor IC 24, which will be described later, can realize different fail-safe states depending on the control mode. A fail-safe state that can be realized in each control mode will be described below.

Here, in the stoichiometric control, when the microcomputer 22 is normal, the object control unit 41 outputs the first control signal to drive the electronic throttle 31 and the injector 32 so that the air-fuel ratio value becomes, for example, 14-15 A/F. S1 and a second control signal S2 are generated. In the stoichiometric control, the injector 32 injects a relatively large amount of fuel, and the electronic throttle 31 takes in a relatively large amount of air corresponding to the injected fuel amount.

For example, in stoichiometric control, by reducing the amount of air taken in, it becomes difficult to maintain explosion and combustion within the engine in accordance with the amount of fuel injected by injector 32 . As a result, the drive output is limited, and the vehicle can be driven at least while maintaining a safe state in which, for example, vehicle operations unintended by the driver, such as sudden acceleration of the vehicle, are suppressed. A state in which the drive output is limited and the vehicle can be driven as much as possible is called evacuation driving.

In other words, in the stoichiometric control, when an abnormality occurs in the microcomputer 22, a fail-safe state (that is, evacuation running) is realized by reducing the intake air amount. Specifically, as will be described later, the evacuation run is realized by stopping the output of the first drive signal D1.

On the other hand, in the lean burn control, the target control unit 41 outputs the first control signal to drive the electronic throttle 31 and the injector 32 so that the air-fuel ratio value becomes, for example, 18-30 A/F when the microcomputer 22 is normal. S1 and a second control signal S2 are generated. In lean burn control, a relatively small amount of fuel is injected by the injector 32 and a relatively small amount of air corresponding to the injected fuel amount is taken in by the electronic throttle 31 . That is, a relatively small amount of air is controlled to provide detonation and combustion within the engine.

For example, in lean-burn control, even if the amount of air taken in is further reduced, explosion and combustion are maintained in the engine, and there is a risk that the drive output will increase with a small amount of fuel injected. In lean-burn control, the amount of air taken in is reduced and the supply of fuel is stopped to cause an engine stall, thereby stopping the engine. This stops the drive output.

That is, in the lean burn control, when an abnormality occurs in the microcomputer 22, a fail-safe state (that is, engine stall) is realized by reducing the intake air amount and stopping the fuel supply. Specifically, as will be described later, the engine is stalled by stopping the output of both the first drive signal D1 and the second drive signal D2.

<Configuration of monitoring IC 24>
The monitoring IC 24 monitors the operation of the microcomputer 22, estimates the control mode of the microcomputer 22 when it is determined that an abnormality has occurred in the microcomputer 22, and performs fail-safe control according to the control mode of the microcomputer 22. is. Fail-safe control is control for realizing a fail-safe state when an abnormality occurs in the vehicle (for example, the microcomputer 22). Specifically, the monitoring IC 24 has the functions of a determining section 51, an estimating section 52, and a determining section 53, as shown in FIG.

The determination unit 51 receives a test result signal from the microcomputer 22, compares the test result signal with an expected value, determines whether the microcomputer 22 is normal or abnormal, and outputs a determination signal indicating the determination result. 53.

For example, the determination unit 51 may determine that the microcomputer 22 is normal when the test result signal and the expected value match. The expected value is stored in advance in a memory (not shown) included in the monitoring IC 24 . Alternatively, the determination unit 51 may determine that the microcomputer 22 is normal when the test result signal and the expected value do not match.

The determination signal may be a signal that differs for each determination result. In this embodiment, when the microcomputer 22 is determined to be normal, the determination unit 51 outputs a signal indicating a low level as a determination signal, and when determined to be abnormal, determines a signal indicating a high level. output as a signal.

The estimating unit 52 acquires at least one state signal, and performs a predetermined process determined by the microcomputer 22 (that is, the target control unit 41) based on the acquired state signal. Assume one control mode as described above. In this embodiment, the estimating unit 52 acquires a state signal similar to that of the microcomputer 22 (that is, the target control unit 41), and performs the same processing as that of the microcomputer 22 (that is, the target control unit 41) based on the acquired state signal. to estimate the control mode determined by the microcomputer 22 .

Specifically, in the present embodiment, the estimator 52 acquires the requested torque signal and the engine speed signal. Based on these state signals, the estimating unit 52 selects one of the stoichiometric control and the lean burn control as one control determined by the target control unit 41 through the process using the map shown in FIG. Estimate as a mode. The map is stored in advance in a memory (not shown) included in the monitor IC 24 .

Hereinafter, the control mode estimated by the estimation unit 52 and determined by the target control unit 41 (that is, the microcomputer 22) is referred to as an estimation mode. Estimation section 52 outputs an estimation mode signal indicating the estimation mode to determination section 53 . The estimation mode signal may be a signal that differs for each estimation mode. In this embodiment, the estimation unit 52 outputs a signal indicating a high level as an estimation mode signal when the estimation mode is stoichiometric control, and outputs a signal indicating a low level as an estimation mode signal when the estimation mode is lean burn control. output as a signal.

When it is determined that the microcomputer 22 has an abnormality, the determination unit 53 performs different forms of fail-safe control for each estimation mode estimated by the estimation unit 52 .
When it is determined that the microcomputer 22 is abnormal and the estimation mode is the first control mode (that is, stoichiometric control), the determination unit 53 controls the electronic throttle 31 as fail-safe control. . Further, when the determination mode is the second control mode (that is, lean burn control), the determination unit 53 controls both the electronic throttle 31 and the injector 32 as fail-safe control.

Specifically, as shown in FIG. 3, when it is determined that the microcomputer 22 is abnormal, the determination unit 53 indicates a high level as the fail-safe control when the estimation mode is the stoichiometric control. 1 fail-safe signal C1 is output to the first drive device 61 . In addition, it outputs a second fail-safe signal C2 indicating a low level to the second driving device 62. FIG. As a result, the output of the first drive signal D1 to the electronic throttle 31 is stopped, and the output of the second drive signal D2 to the injector 32 is not stopped (that is, output).

Further, when it is determined that the microcomputer 22 has an abnormality and the estimation mode is lean burn control, the determination unit 53 outputs the first fail-safe signal C1 indicating a high level as fail-safe control as the first fail-safe control. is output to the driving device 61 of . Also, it outputs the second fail-safe signal C2 indicating a high level to the second driving device 62 . As a result, the output of the first drive signal D1 to the electronic throttle 31 is stopped, and the output of the second drive signal D2 to the injector 32 is stopped.

[1-2. operation]
The state of the vehicle based on the monitoring of the monitoring IC 24 configured in this manner will be described with reference to FIG.

(Operation 1) When the determination unit 51 determines that the microcomputer 22 is normal, regardless of the type of estimation mode by the estimation unit 52, the determination unit 53 outputs the first fail-safe signal C1 indicating a low level. Output to the first driving device 61 . In addition, the determination unit 53 outputs the second fail-safe signal C<b>2 indicating a low level to the second driving device 62 . That is, the output deactivation of the first driving device 61 is deactivated and the output deactivation of the second driving device 62 is deactivated.

As a result, the electronic throttle 31 and the injector 32 perform normal operations (hereinafter referred to as normal operations) in accordance with the first drive signal D1 and the second drive signal D2 corresponding to the control mode. As a result, the vehicle performs normal running (hereinafter referred to as normal running) in accordance with the control mode.

(Operation 2) When the determination unit 51 determines that the microcomputer 22 is abnormal and the estimation mode by the estimation unit 52 is stoichiometric control, the determination unit 53 outputs the first fail-safe signal C1 indicating a high level. is output to the first driving device 61 . In addition, the determination unit 53 outputs the second fail-safe signal C<b>2 indicating a low level to the second driving device 62 . That is, the output deactivation of the first driving device 61 is activated and the output deactivation of the second driving device 62 is deactivated.

As a result, the electronic throttle 31 is maintained at the initial opening, and the injector 32 operates normally according to the second drive signal D2 corresponding to the control mode. In other words, since the amount of intake air is limited in the stoichiometric control, the vehicle realizes a fail-safe state of the evacuation running.

(Operation 3) When the determination unit 51 determines that the microcomputer 22 is abnormal and the estimation mode by the estimation unit 52 is lean burn control, the determination unit 53 outputs the first fail-safe signal indicating a high level. C1 is output to the first drive device 61 . In addition, the determination unit 53 outputs the second fail-safe signal C<b>2 indicating high level to the second driving device 62 . That is, the output stop of the first driving device 61 is activated, and the output stop of the second driving device 62 is activated.

As a result, the electronic throttle 31 is maintained at the initial opening, and the injector 32 stops supplying fuel. In other words, since the amount of intake air is limited and the supply of fuel is stopped in the lean burn control, the engine stall is realized as a fail-safe state in the vehicle.

[1-3. effect]
According to 1st Embodiment detailed above, there exist the following effects.
(1a) In the conventional device, the control mode of the vehicle is determined by, for example, a control device that controls the vehicle. it was difficult to That is, it was difficult to execute fail-safe control according to the control mode.

In the present embodiment, the estimating unit 52 of the monitoring IC 24 estimates the control mode being executed by the microcomputer 22 even when an abnormality occurs in the microcomputer 22 . As a result, when an abnormality occurs in the microcomputer 22, fail-safe control can be performed in different modes depending on the control mode. That is, more detailed fail control can be executed for each control mode.

(1b) In the monitoring IC 24 , the estimator 52 estimates the control mode determined by the microcomputer 22 using the same state signal as the microcomputer 22 and based on the same processing as the microcomputer 22 . Then, the determining unit 53 performs different forms of fail-safe control for each estimated mode estimated in this way.

As a result, the estimation accuracy of the estimation mode is improved as compared with the case of estimating the estimation mode based on the state signal different from that of the microcomputer 22 and the case of estimating the estimation mode based on the processing different from that of the microcomputer 22 . Since fail-safe control is executed based on the improved estimation mode, fail-safe control that can maintain the safety of the vehicle can be executed.

(1c) In the monitoring IC 24, the determination unit 53 fails control (that is, stop control) of the electronic throttle 31, which is one of the electronic throttle 31 and the injector 32, during stoichiometric control, which is the first control mode. It may be performed as a safe control. Further, the determination unit 53 may perform control (that is, stop control) on both the electronic throttle 31 and the injector 32 as fail-safe control during lean-burn control, which is the second control mode. Thereby, different fail-safe control can be performed according to the control mode.

(1d) When it is determined that the microcomputer 22 is abnormal, the determination unit 53 performs control to stop the output of the first drive signal D1 to the electronic throttle 31 when the estimation mode is stoichiometric control. It may be performed as a fail-safe control. As a result, it is possible to limit the drive output according to the estimation mode and perform fail-safe control that realizes evacuation running. That is, according to the estimation mode, it is possible to perform fail-safe control that improves the marketability of the vehicle by maintaining the safety of the vehicle and allowing the vehicle to travel as much as possible.

(1e) the determination unit 53 stops outputting the first drive signal D1 to the electronic throttle 31 when it is determined that the microcomputer 22 is abnormal and the estimation mode is lean burn control; Also, the output of the second drive signal D2 to the injector 32 may be stopped. Thereby, fail-safe control for stopping the vehicle can be performed according to the estimation mode. In other words, it is possible to perform fail-safe control that places the highest priority on shifting the vehicle to a safe state according to the estimation mode.

[2. Second Embodiment]
[2-1. composition]
Since the basic configuration of the second embodiment is the same as that of the first embodiment, differences will be described below. Note that the same reference numerals as in the first embodiment indicate the same configurations, and refer to the preceding description.

In the first embodiment described above, the monitoring IC 24 includes the determination section 51 , the estimation section 52 and the determination section 53 . On the other hand, in the second embodiment, as shown in FIG. 4, the monitoring IC 24 is different from the first embodiment in that a special stopping unit 54 is further provided.

In addition, the state signal input to the ECU 10 further includes an A/F signal, which is different from the first embodiment. The A/F signal is a signal that indicates the actual air-fuel ratio detected using an A/F sensor provided on the exhaust side of the engine.

The first driving device 61 and the second driving device 62 stop outputting at least when a low-level fail-safe signal is input. That is, even if a plurality of fail-safe signals are input, the first driving device 61 and the second driving device 62 stop outputting when at least one of them is low level.

The microcomputer 22 of the second embodiment is configured similarly to the microcomputer 22 of the first embodiment. That is, the target control unit 41 determines the control mode as described above, and outputs the first control signal S1 and the second control signal S2 for controlling the electronic throttle 31 and the injector 32 according to the determined control mode. to output The inspection unit 42 and the management unit 43 generate a test result signal as described above and output the test result signal as a monitoring signal to the monitoring IC 24 . A monitoring signal is a signal used to determine whether the microcomputer 22 is normal.

In the monitoring IC 24 of the second embodiment, the determination section 51 determines whether or not the microcomputer 22 is abnormal based on the test result signal, and outputs the determination result to the determination section 53 as described above. The estimation unit 52 identifies the estimation mode as described above. However, the estimation unit 52 outputs an estimation mode signal corresponding to the estimation mode to the determination unit 53 and the special stop unit 54 in this embodiment. The decision unit 53 outputs the first fail-safe signal C1 and the second fail-safe signal C2 as described above.

When the estimated mode and the control mode specified by the air-fuel ratio indicated by the A/F signal do not match, the special stop unit 54 determines that the determination result by the determination unit 51 is incorrect, and performs control to stop the engine. . The state in which the judgment result by the judging section 51 is incorrect includes at least one of the case where the microcomputer 22 is abnormal and the case where the judging section 51 is abnormal. This is because when the microcomputer 22 and the determination unit 51 are normal, the estimation mode and the control mode specified by the air-fuel ratio indicated by the A/F signal substantially match.

Specifically, the special stop unit 54 determines which of the plurality of control modes executed by the microcomputer 22 the air-fuel ratio indicated by the A/F signal is based on a predetermined map, correspondence information, calculation formula, or the like. is realized by the control mode of For example, the monitor IC 24 may store correspondence information that associates the value of the A/F signal with one of stoichiometric control and lean burn control.

The special stop unit 54 uses the correspondence information, for example, to specify which of the stoichiometric control and the lean burn control is used to realize the air-fuel ratio indicated by the A/F signal. In this embodiment, the special stop unit 54 outputs a high-level signal as the real mode signal when the control mode specified by the air-fuel ratio indicated by the A/F signal is stoichiometric control, and outputs a high-level signal as the real mode signal when the control mode is lean burn control. output a low level signal as the real mode signal.

Here, when the estimated mode signal and the actual mode signal match, the special stopping unit 54 outputs the low-level third fail-safe signal C3 to the first driving device 61, and the second driving device 62 to output a low-level fourth fail-safe signal C4. On the other hand, when the estimated mode signal and the actual mode signal do not match, the special stopping section 54 outputs a high level third fail-safe signal C3 to the first driving device 61, and outputs a high level third fail-safe signal C3 to the second driving device 62. A fourth level fail-safe signal C4 is output.

[2-2. operation]
The state of the vehicle based on the monitoring of the monitoring IC 24 configured in this manner will be described below.
(Operation 4) When the estimated mode matches the control mode specified by the air-fuel ratio indicated by the A/F signal, the special stop unit 54 sends the low-level third fail-safe signal C3 to the first drive device 61. to output In addition, it outputs a low-level fail-safe signal C4 to the second driving device 62 . As a result, in the vehicle, when the microcomputer 22 is normal, normal running according to the control mode is performed. Further, when the microcomputer 22 is abnormal, the decision unit 53 performs fail-safe control.

(Operation 5) When the estimated mode and the control mode specified by the air-fuel ratio indicated by the A/F signal do not match, the special stop unit 54 determines that the determination result by the determination unit 51 is incorrect, and performs the first drive operation. Output a high level third fail-safe signal C3 to the device 61; In addition, it outputs a high-level fail-safe signal C4 to the second driving device 62 . As a result, the vehicle realizes a fail-safe state in which the engine stalls and the vehicle stops.

[2-3. effect]
According to the second embodiment described in detail above, the effects (1a) to (1e) of the first embodiment described above are obtained, and the following effects are also obtained.

(2a) In the microcomputer 22, the inspection unit 42 and the management unit 43 generate a monitoring signal (that is, a test result signal) used to determine whether the microcomputer 22 is normal and output it to the monitoring IC 24. do. The special stop unit 54 determines whether the determination result by the determination unit 51 is correct based on the A/F signal. As a result, when it is determined that the determination result is incorrect, it is determined that at least one of the microcomputer 22 and the estimation unit 52 may be abnormal, and fail-safe control can be appropriately performed. .

(2b) The special stop unit 54 may perform control to stop the engine that is the object of control when the estimated mode does not match the control mode specified by the air-fuel ratio indicated by the A/F signal. As a result, even if the determination unit 51 determines that the microcomputer 22 is normal, if the estimated mode and the control mode specified by the air-fuel ratio indicated by the A/F signal do not match, The vehicle can be stopped and the safety of the vehicle can be maintained more reliably.

In the above-described embodiment, the ECU 10 corresponds to the electronic control device, the microcomputer 22 and the target control section 41 correspond to the control section, and the monitoring IC 24 corresponds to the monitoring section. Further, the actuator corresponds to the drive mechanism, the first actuator, the electronic throttle 31, corresponds to the first drive mechanism, and the second actuator, the injector 32, corresponds to the second drive mechanism. The inspection unit 42 and the management unit 43 correspond to the monitoring signal unit. Stoichiometric control corresponds to the first control mode, and lean burn control corresponds to the second control mode. The A/F signal corresponds to the air-fuel ratio signal, and the test result signal corresponds to the monitoring signal.

[3. Other embodiments]
Although the embodiments of the present disclosure have been described above, the present disclosure is not limited to the above-described embodiments, and various modifications can be made.

(3a) In the above embodiment, the target control section 41 determines the control mode based on the required torque signal and the engine speed signal. However, the present disclosure is not limited to this. The target control unit 41 is configured to use a signal similar to the required torque signal instead of the required torque signal, and to determine the control mode based on the signal similar to the required torque signal and the engine speed signal. may be Signals similar to the torque demand signal may include a signal indicative of engine intake air amount, a signal indicative of engine intake manifold pressure, a signal indicative of fuel injection amount, a signal indicative of ignition timing, and the like. These engine intake air amount, engine intake pipe pressure, fuel injection amount, ignition timing, etc. can all be detected by various sensors.

(3b) In the above-described embodiment, the determination unit 51 selects the control mode based on the required torque signal and the engine speed signal, using a map similar to the object control unit 41. I was guessing. However, the present disclosure is not limited to this. The determination unit 51 may be configured to estimate the control mode by a process different from that of the target control unit 41 using a state signal different from that of the target control unit 41 .

(3c) In the above embodiments, the test result signal was used as the monitoring signal, but in the present disclosure, the monitoring signal is not limited to the test result signal. For example, a so-called watchdog (hereinafter referred to as WDG) signal may be used as a monitoring signal. In this case, the inspection unit 42 may be a WDG circuit that generates a WDG signal, and the management unit 43 may be a circuit that outputs the WDG signal to the monitor IC 24 . In the monitoring IC 24, the determination unit 51 compares the reception cycle of the WDG signal with a predetermined cycle as an expected value, and determines that the microcomputer 22 is normal when they match. good too. Also by this, the above effect can be similarly obtained. Moreover, the inspection unit 42, the management unit 43, and the determination unit 51, which are configured to determine whether the microcomputer 22 is abnormal, can be configured simply.

(3d) In the above embodiment, the object to be controlled is the engine, and the microcomputer 22, which is the control unit, determines one control mode from among a plurality of control modes, stoichiometric control and lean burn control, and controls the object to be controlled. I explained an example of doing However, the present disclosure is not limited to this.

For example, the controlled object may be various devices for controlling a vehicle. For example, the target control unit 41 is a control device that controls various devices of the driving system such as the engine, various devices that operate the steering system according to the operation amount of the steering, and various devices of the braking system such as the brake. could be.

Also, the plurality of control modes for controlled objects may include various control modes for these controlled objects.
(3e) In the above-described embodiment, an example in which the engine to be controlled is driven by the electronic throttle 31, which is the first drive mechanism, and the injector 32, which is the second drive mechanism, has been described. It is not limited to this. A plurality of drive mechanisms, such as the first drive mechanism and the second drive mechanism, that drive the controlled object may include various actuators, electronic control devices, and the like according to the controlled object.

(3f) In the above-described embodiment, the microcomputer 22, which is the control unit, controls the engine, which is the object of control, in a plurality of control modes, and the plurality of control modes are the stoichiometric control and the second control, which are the first control mode. An example of lean-burn control, which is a mode, has been described. However, the present disclosure is not limited to this. For example, the control mode of the controlled object executed by the microcomputer 22, which is the control unit, may include one or more control modes in addition to the first control mode and the second control mode. The monitoring IC 24 may be configured to perform different fail-safe controls for each of these multiple control modes (that is, three or more control modes).

(3g) The ECU 10 and techniques thereof described in this disclosure may be performed by a dedicated computer provided by configuring a processor and memory programmed to perform one or more functions embodied by a computer program. , may be implemented. Alternatively, the ECU 10 and techniques described in this disclosure may be implemented by a dedicated computer provided by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the ECU 10 and techniques thereof described in this disclosure may comprise a combination of a processor and memory programmed to perform one or more functions and a processor configured by one or more hardware logic circuits. may be implemented by one or more dedicated computers configured as Computer programs may also be stored as computer-executable instructions on a computer-readable non-transitional tangible recording medium. The method of realizing the function of each part included in the ECU 10 does not necessarily include software, and all the functions may be realized using one or more pieces of hardware.

(3h) Even if a plurality of functions possessed by one component in the above-described embodiments are realized by a plurality of components, or a function possessed by one component is realized by a plurality of components good. Also, a plurality of functions possessed by a plurality of components may be realized by a single component, or a function realized by a plurality of components may be realized by a single component. Also, part of the configuration of the above-described embodiment may be omitted. Also, at least part of the configurations of the above-described embodiments may be added or replaced with respect to the configurations of other above-described embodiments.

(3i) In addition to the above-described ECU 10, the monitoring IC 24, a system having the monitoring IC 24 and the ECU 10 as components, a computer having the functions of the monitoring IC 24, a program for causing the ECU 10 to function, a program for realizing the functions of the monitoring IC 24, and this program The present disclosure can also be realized in various forms such as a non-transitional substantive recording medium such as a semiconductor memory in which is recorded, a monitoring method, and the like.

10 ECU, 22 microcomputer, 23 output unit, 24 monitoring IC, 51 determination unit, 52 estimation unit, 53 determination unit, 141 target control unit.

Claims (8)

An electronic control device (20) mounted on a vehicle for controlling a predetermined controlled object,
a control unit (22) configured to determine one control mode from among a plurality of control modes indicating a control mode of the controlled object and to control the controlled object;
a monitoring unit (24) configured to monitor the control unit;
with
The monitoring unit
a determination unit (51) for determining whether or not an abnormality has occurred in the control unit;
an estimation unit (52) for estimating the control mode determined by the control unit;
a determination unit (53) that performs different forms of fail-safe control for each estimation mode, which is the control mode estimated by the estimation unit, when it is determined that the control unit has an abnormality;
Electronic control unit with. The electronic control device according to claim 1,
The control unit acquires at least one state signal representing a state of the vehicle, determines the one control mode by a predetermined process based on the acquired state signal,
In the monitoring unit,
The estimator acquires at least one of the state signals and estimates the determined control mode based on the acquired state signal. The electronic control device according to claim 2,
The estimating unit acquires the same state signal as that of the control unit, and estimates the determined control mode based on the acquired state signal by the same processing as that of the control unit. Electronic control device . The electronic control device according to any one of claims 1 to 3,
The controlled object is controlled by a plurality of drive mechanisms that are driven according to the drive signal, and the control unit selects one of the control modes determined by the drive signal from among the plurality of control modes. perform control for outputting the drive signal for driving each of the plurality of drive mechanisms in response,
The plurality of control modes comprises a first control mode and a second control mode,
The plurality of drive mechanisms comprise a first drive mechanism and a second drive mechanism,
In the monitoring unit,
The estimating unit estimates one of the first control mode and the second control mode as the determined one control mode,
When it is determined that an abnormality has occurred in the control unit, the determination unit performs control of the first drive mechanism as the fail-safe control when the estimation mode is the first control mode. , an electronic control device that controls both the first drive mechanism and the second drive mechanism as the fail-safe control when the estimation mode is the second control mode. The electronic control device according to claim 4,
The determination unit controls to stop the drive signal to the first drive mechanism when it is determined that the control unit is abnormal and the estimation mode is the first control mode. as the fail-safe control. The electronic control device according to claim 4 or claim 5,
the determination unit, when it is determined that the control unit is abnormal and the estimation mode is the second control mode, stopping the drive signal to the first drive mechanism; and an electronic control device that performs control for stopping the drive signal to the second drive mechanism as the fail-safe control. The electronic control device according to any one of claims 1 to 5,
the controlled object is an engine,
the plurality of control modes are control modes that achieve different air-fuel ratios;
The control unit includes a monitoring signal unit (42, 43) configured to generate a monitoring signal used for determining whether the control unit is normal and to output the monitoring signal to the monitoring unit. further prepared,
In the monitoring unit,
The determination unit determines whether an abnormality has occurred in the control unit based on the monitoring signal output from the control unit,
An electronic control device further comprising a special stop section (54) for determining whether or not the determination result by the determination section is correct based on an air-fuel ratio signal indicating the air-fuel ratio. The electronic control device according to claim 7,
The special stop is
An electronic control unit that performs control to stop the controlled object when the estimated mode and the control mode specified by the air-fuel ratio indicated by the air-fuel ratio signal do not match.

Images