JP7333142B2 - Electronic control device for engine and control method for the electronic control device - Google Patents

Description

The present invention relates to an electronic control device for an engine mounted on a vehicle and a control method for the electronic control device.

Conventionally, as an electronic control device for an engine mounted on a vehicle, for example, when a failure occurs in the electronic control device and the failure is detected, the throttle valve is controlled to a closed state and the ignition by the ignition coil is delayed. After that, when the rotational speed of the engine reaches a predetermined value (for example, about 1500 rpm), the vehicle can run, but only at a speed at which evacuation running is possible. There is a configuration in which control is performed in a limp home mode, which is a safe driving state that cannot be generated (see, for example, Patent Document 1).

JP 2018-87499 A

In the electronic control device described in Patent Document 1, when a failure occurs in the electronic control device while the engine speed is low and in an idling state, the engine speed is increased from the speed in the idling state to prevent limp. It takes a relatively long time to reach the rotation speed, which is the condition for shifting to the home mode, and there is a risk that the limp home mode will not be shifted quickly after the failure of the electronic control unit is detected.

SUMMARY OF THE INVENTION It is an object of the present invention to provide an electronic control unit capable of transitioning to limp home control at a transition time corresponding to the rotation speed of the engine when a failure is detected. aim.

An electronic control device according to the present invention is an electronic control device (10) for controlling the operation of an engine (1) of a vehicle. a control unit (11) for controlling the operation of the engine (1) when a failure is detected; and the monitoring unit (12) controls the operation of the engine (1) when the failure is detected. The throttle valve (7) is stopped and controlled to be in a closed state, and when the failure is detected, the control section (11) performs ignition delay control so that the rotation speed (Ne) of the engine (1) increases When the first reference value (ε) is exceeded, limp home control is performed, and the ignition delay control is based on at least the failure detection rotation speed (Ner) of the engine (1) obtained in the failure detection process. At least one of the ignition delay amount (At) and the duration (γ) is set.

According to such a configuration, when a failure in the operation of the electronic control unit (10) is detected, the monitoring unit (12) stops the throttle valve (7) and controls the closed state, and the control unit ( 11) performs ignition delay control, so that it is possible to limit the output torque of the engine. Since at least one of the ignition delay amount (At) and the duration (γ) is set based on, the control unit (11) restarts the engine (1 ) reaches the first reference value (ε) to shift to limp home control.

A control method for an electronic control unit according to the present invention comprises a monitoring step in which the electronic control unit (10) detects a failure in the operation of the electronic control unit (10); ) in which the electronic control unit (10) controls the operation of the engine (1), and in the monitoring step, when the failure is detected, the throttle valve (7) of the engine (1) is stopped. In the control step, ignition delay control is performed when the failure is detected, and when the rotational speed (Ne) of the engine (1) exceeds the first reference value (ε) , limp home control is performed, and in the ignition delay control, an ignition delay amount (At) and a duration are determined based on at least the failure detection rotational speed (Ner) of the engine (1) acquired in the failure detection process At least one of (γ) is set.

According to such a configuration, when a failure in the operation of the electronic control unit (10) is detected, in the monitoring step the throttle valve (7) is stopped and controlled to be closed, and in the control step ignition delay Since the control is performed, it is possible to limit the output torque of the engine, and in the ignition delay control, the ignition delay is based on at least the failure detection rotation speed (Ner) of the engine (1) acquired in the failure detection process. Since at least one of the amount (At) and duration (γ) is set, in the control step, the rotational speed (Ne) of the engine (1) is increased at a predetermined transition time corresponding to the rotational speed (Ner) at the time of failure detection. A first reference value (ε) can be reached to transition to limp home control.

It is a figure for demonstrating the structure of an electronic control unit. It is a figure for demonstrating the structure of the control part of an electronic control unit. It is a figure for demonstrating the structure of the 1st monitoring part of an electronic control unit. It is a figure for demonstrating the structure of the 2nd monitoring part of an electronic control unit. It is a figure for demonstrating the ignition delay control related process which a control part performs. It is a figure for demonstrating the failure determination related process which a 1st monitoring part performs. FIG. 10 is a diagram for explaining transition of an actual torque value when a failure occurs; FIG. 4 is a diagram for explaining the timing at which ignition delay control and limp home control are executed;

An embodiment of an electronic control device for an engine 1 and a method for controlling the engine 1 according to the present invention will be described with reference to the drawings. The configuration, operation, etc. of the embodiment described below are examples, and the present invention is not limited to such configuration, operation, etc., and can be appropriately changed within the scope of the present invention. . In addition, the same or similar descriptions may be simplified or omitted as appropriate below. Further, in each drawing, the same or similar members or parts may be omitted from being given reference numerals or may be given the same reference numerals. Further, the illustration of detailed structures may be simplified or omitted as appropriate.

[About the electronic controller]
A configuration of an electronic control unit 10 (hereinafter sometimes referred to as an ECU (Electrical Control Unit)) of an engine 1 according to the present embodiment will be described with reference to FIGS. 1 to 4. FIG. The ECU 10 is a control device that controls an engine 1 (such as a gasoline engine, not shown) mounted on the vehicle.

As shown in FIG. 1, the ECU 10 includes, for example, a CAN 4 (Controller Area Network) of the vehicle, an accelerator sensor 5 for detecting an operation angle βe of an accelerator pedal (not shown) of the vehicle, and the like via an input circuit (not shown). connected. The ECU 10 can acquire various information such as the rotation speed Ne of the engine 1, the speed (vehicle speed) Ve of the vehicle, and the acceleration αe of the vehicle via the CAN 4, and acquires the operation angle βe of the accelerator pedal based on the output of the accelerator sensor 5. It is possible.

The ECU 10 also includes, for example, a fuel injection device 6 for injecting fuel in the engine 1 of the vehicle, a throttle valve 7 for adjusting the amount of intake air flowing into the combustion chamber of the engine 1, An ignition coil 8 or the like that ignites is connected via an output circuit or the like (not shown). The ECU 10 outputs a control signal to the fuel injection device 6, the throttle valve 7, the ignition coil 8, etc. through an output circuit or the like, thereby controlling the operation of each device.

Sensors for detecting the rotation speed Ne, vehicle speed Ve, vehicle acceleration αe, etc. are connected to the ECU 10, and the ECU 10 acquires various information such as the rotation speed Ne from the sensors. But it's okay. Various devices such as the fuel injection device 6, the throttle valve 7, and the ignition coil 8 are connected via the CAN 4, and the ECU 10 may be configured to indirectly control these devices via the CAN 4. Alternatively, the accelerator sensor 5 may be connected to the CAN 4 and the ECU 10 may acquire the operation angle βe of the accelerator pedal via the CAN 4 .

The ECU 10 is mainly composed of a microcomputer including, for example, a CPU (Central Processing Unit), storage areas (ROM (Read Only Memory), RAM (Random Access Memory), backup RAM), and input/output circuits (not shown). be. The ECU 10 includes a control unit 11 that controls the operation of the engine 1, a first monitoring unit 12 that monitors the operation status of the control unit 11, a second monitoring unit 13 that monitors the operation status of the first monitoring unit 12, a fuel injection It includes an ECU power stage section 14 that controls the operation of the device 6, a throttle power stage section 15 that controls the operations of the throttle valve 7 and the ignition coil 8, and the like.

The ECU 10 executes, for example, each process described later by executing various programs (eg, first level program, second level program, third level program, etc.) stored in a storage device such as a ROM. It is designed so that it can be executed to realize a predetermined function. Further, the ECU 10 can execute the first to third level programs independently of each other by causing the first to third level programs to be executed in mutually independent areas within the storage area. The functions of the control unit 11 are realized by executing the first level program, the functions of the first monitoring unit 12 are realized by executing the second level program, the third level program is executed, and an ASIC (Application Specific Integrated Circuit) to be described later is executed. The function of the second monitoring unit 13 is realized by the operation of .

The ECU 10 of the present embodiment includes a control unit 11 that controls the operation of the engine 1, and a first control unit 11 that controls the operation of the engine 1 together with the control unit 11, monitors the operation status of the control unit 11, and diagnoses failures. The configuration includes a monitoring unit 12 and a second monitoring unit 13 that monitors the operating status of the first monitoring unit 12 and diagnoses failures. In this way, in the configuration in which the operation of the control unit 11 is monitored by the first monitoring unit 12 and the operation of the first monitoring unit 12 is monitored by the second monitoring unit 13, the control unit 11 or the first monitoring unit 12 Even if a control abnormality occurs, the abnormality can be detected by the first monitoring unit 12 or the second monitoring unit 13, and countermeasures can be taken, such as limiting the control of each device by the control unit 11. Therefore, the reliability of the control of the engine 1 by the ECU 10 can be improved. The first monitoring unit 12 is implemented by hardware resources such as the same CPU and various circuits as the control unit 11. are realized by different hardware resources. Even if a failure occurs in the hardware resources or software resources of the control unit 11 and the first monitoring unit 12, the monitoring can be continued by the second monitoring unit 13, so the reliability of the control of the engine 1 by the ECU 10 is improved. can be made

[Regarding the control unit]
The control unit 11 acquires an instruction torque value Wa1 to be output by the engine 1 and outputs the instruction torque value Wa1 to the ECU power stage unit 14 to control the operation of the fuel injection device 6 .

As shown in FIG. 2, the control unit 11 includes a total required torque acquisition unit 11a that acquires a total required torque value Wb that is required in the vehicle by operating an accelerator pedal, etc., and an allowable torque value Wc that is allowed to be output in the vehicle. an allowable torque acquisition unit 11b to be acquired, a limit torque acquisition unit 11c to acquire a limit torque value Wd for limiting the output torque when a failure of the ECU 10 is detected, the total required torque acquisition unit 11a, and an allowable torque acquisition unit 11b and a minimum value selection unit 11k that selects the minimum value of the torque values output by the limit torque acquisition unit 11c and outputs the minimum value to the ECU power stage unit 14 .

The total required torque acquisition unit 11a first acquires the operation angle βe of the accelerator pedal based on the output of the accelerator sensor 5, and the driver of the vehicle uses a predetermined arithmetic expression based on the operation angle βe of the accelerator pedal. A requested driver-requested torque value We is obtained. It should be noted that the total required torque acquisition unit 11a is not limited to the configuration that acquires the driver required torque value We by a predetermined arithmetic expression, and for example, at least one of a predetermined characteristic curve, a predetermined map, and the like. The configuration may be such that the driver requested torque value We is acquired using one of them, or the configuration is possible that these are combined to acquire the driver requested torque value We. Further, the total requested torque acquisition unit 11a may be configured to appropriately refer to and use various information (for example, the rotation speed Ne of the engine 1, the opening of the throttle valve, etc.) when acquiring the driver requested torque value We.

Further, based on a predetermined signal input from the outside of the ECU 10 via the CAN 4, the total requested torque acquisition unit 11a obtains the driver's requested torque value We requested by the driver as well as the driver's requested torque value We from various on-vehicle devices for the engine 1. obtains the externally requested torque value Wf requested by The externally requested torque value Wf is, for example, a value corresponding to the torque requested by a transmission control device, a brake system control device, or the like of a vehicle in which the ECU 10 is mounted. acquires the externally demanded torque value Wf from the CAN 4. Then, the total required torque acquisition unit 11a acquires the sum of the driver required torque value We and the externally required torque value Wf as the total required torque value Wb, and outputs the total required torque value Wb to the minimum value selection unit 11k.

Note that the total required torque acquisition unit 11a uses at least one of a predetermined arithmetic expression, a predetermined characteristic curve, a predetermined map, etc., based on information obtained from each device via the CAN 4. A configuration in which the externally requested torque value Wf is obtained using one or a combination thereof may also be used.

The allowable torque acquisition unit 11b refers to a predetermined storage area of the ECU 10, acquires an allowable torque value Wc acquired by the first monitoring unit 12 and stored in the storage area as will be described later, and selects a minimum value selection unit. 11k.

As shown in FIG. 2, the limit torque acquisition unit 11c includes an ignition delay duration setting unit 11d, a failure determination flag acquisition unit 11e, a matching data table unit 11f, an ignition delay control allowable condition determination unit 11g, and an ignition delay control end determination unit. 11h, a limit torque value acquisition unit 11i, and a limit torque value output unit 11j.

The ignition delay continuation period setting unit 11d refers to a predetermined storage area of the ECU 10, and acquires the rotation speed Ner at the time of failure detection, which is acquired by the first monitoring unit 12 and stored in the storage area as will be described later. Then, based on the rotational speed Ner at the time of failure detection and an ignition delay control period reference value map (to be described later) stored in the adaptive data table section 11f, a reference value γ indicating the length of the period during which the execution of the ignition delay control is continued is set. get. In addition, it initializes (for example, sets 0 as an initial value) a time counter Td that is set in a predetermined storage area of the ECU 10 and measures the duration of the ignition delay, and starts time measurement by the time counter Td. Let

The failure determination flag acquisition unit 11e is a flag that is set by the first monitoring unit 12 as described later. Obtained by referring to a predetermined storage area.

The adaptive data table section 11f is set in a predetermined storage area (for example, ROM) of the ECU 10, and includes the ignition delay control period reference value map described above and the limit torque value map (first limit torque value map, second limit torque value map) described later. torque value map), ignition delay control necessity determination map, ignition delay amount setting map, etc. are stored.

In the ignition delay control period reference value map, a reference value γ, which is a period during which the ignition delay control is executed, is set for each failure detection rotational speed Ner so as to be identifiable. Further, in the first torque limit value map among the torque limit value maps, the first torque limit value ζ1 of the output torque of the engine 1 is set for each rotation speed Ne of the engine 1 so as to be identifiable. Further, in the second torque limit value map among the torque limit value maps, a second torque limit value ζ2 of the output torque of the engine 1 is set for each rotation speed Ne of the engine 1 so as to be identifiable. In the ignition delay control necessity determination map, necessity data that can specify whether or not ignition delay control is to be performed for each abnormal torque amount Qer and rotation speed Ne of the engine 1 is set. Further, in the ignition delay amount setting map, an angle or timing for delaying the ignition timing by the ignition coil 8, and the ignition delay amount At for realizing the second limit torque value ζ2 of the output torque of the engine 1 is It is set every two limit torque values ζ2.

The reference value γ, the first limit torque value ζ1, the second limit torque value ζ2, necessity data, etc. set in each map such as the ignition delay control period reference value map are obtained in advance by experiments or the like and stored in each map. is set. In addition, these reference value γ, first limit torque value ζ1, second limit torque value ζ2, necessity data, etc. are, for example, QM (Quality Management) is preferably set.

The reference value γ, the first torque limit value ζ1, the second torque limit value ζ2, the availability data, the ignition delay amount At, etc. set in each map such as the ignition delay control period reference value map are determined in advance. A configuration that enables specification using at least one or a combination of an arithmetic expression, a predetermined characteristic curve, a predetermined map, and the like may be used.

The ignition delay control allowable state determination unit 11g acquires an ignition delay control allowable state flag set in a predetermined storage area of the ECU 10, and determines whether or not the execution of the ignition delay control is permitted. The ignition delay control permission status flag is a flag appropriately set by the ECU 10 according to the control status, and specifies that the ignition delay control is permitted when execution of the ignition delay control is permitted. While the possible flag is set, when the execution of the ignition delay control is not permitted, a flag is set that can specify that the ignition delay control is not permitted. As a result, the ignition delay control is executed in consideration of the control status of the ECU 10 and the like.

The ignition delay control end determination unit 11h acquires the rotational speed Ne of the engine 1 at predetermined time intervals, and stores the history of the rotational speed Ne in a predetermined storage area of the ECU 10. FIG. Further, the ignition delay control end determination unit 11h refers to a predetermined storage area of the ECU 10 to obtain a reference value ε (for example, 1500 rpm) of the limp home control start condition set in advance in the storage area. A rotation speed Ne of the engine 1 is acquired. Then, the obtained reference value ε and the rotational speed Ne are compared. When the rotation speed Ne exceeds the reference value ε, it is determined that the condition for forced termination of the ignition delay control is satisfied and the condition for starting the limp home control is satisfied, while the rotation speed Ne exceeds the reference value ε. If not, it is determined that the condition for forced termination of ignition delay control is not satisfied and the condition for starting limp home control is not satisfied.

The torque limit value acquisition unit 11i acquires the rotation speed Ne of the engine 1, and acquires the first torque limit value ζ1 based on the rotation speed Ne and the first torque limit value map described above. Further, the limit torque value acquisition unit 11i acquires the total required torque value Wb acquired by the above-described total required torque acquisition unit 11a, and calculates the ratio between the total required torque value Wb and the first limit torque value ζ1. Acquired as an abnormal torque amount Qer. Also, the limit torque value acquisition unit 11i determines whether or not the ignition delay control is to be performed based on the abnormal torque amount Qer, the rotation speed Ne, and the above-described ignition delay control necessity determination map. Further, a second limit torque value ζ2 is acquired based on the rotation speed Ne and the above-described second limit torque value map, and the second limit torque value ζ2 is acquired based on the abnormal torque amount Qer, the rotation speed Ne, and the above-described ignition delay amount setting map. An ignition delay amount At for realizing the torque value ζ2 is acquired.

The limit torque value output unit 11j satisfies a predetermined torque limit condition (when the ignition delay control continuation period in which the time counter Td is operating and when a failure of the ECU 10 is specified based on the failure determination flag, Further, it is specified that the ignition delay control is permitted based on the ignition delay control permission status flag, and the condition for forced termination of the ignition delay control (the termination condition based on the rotation speed Ne) is not satisfied. the second limit torque value ζ2 obtained by the limit torque value obtaining unit 11i and the total requested torque The total required torque value Wb acquired by the acquisition unit 11a is compared, and the smaller value is output to the minimum value selection unit 11k as the limit torque value Wd, and the ignition delay amount At acquired by the limit torque value acquisition unit 11i. is stored in a predetermined storage area of the ECU 10 .

On the other hand, when the above-described torque limit condition is not satisfied, the limit torque value output unit 11j compares the first limit torque value ζ1 acquired by the limit torque value acquisition unit 11i and the total required torque value Wb, and selects the smaller one. The value is output to the minimum value selection unit 11k as the limit torque value Wd, and the ignition delay amount At is set to 0 and stored in a predetermined storage area of the ECU 10.

The minimum value selection unit 11k selects the total required torque value Wb acquired by the total required torque acquisition unit 11a, the allowable torque value Wc acquired by the allowable torque acquisition unit 11b, and the limit torque value Wd acquired by the limit torque acquisition unit 11c. are obtained and compared, and the smallest value is output to the ECU power stage unit 14 as the command torque value Wa1.

The ECU power stage unit 14 acquires the instructed torque value Wa1 output from the control unit 11, and converts the instructed torque value Wa1 to the fuel injection amount Qs based on a fuel injection amount conversion map stored in advance in the storage area of the ECU 10. Convert to Furthermore, based on an energization period conversion map stored in advance in the storage area of the ECU 10, the length of the energization period of the fuel injection device 6 (time for controlling the fuel injection device 6 to the injection state) corresponding to the fuel injection amount Qs The energization period length Tij, which is the length of the energization period, is acquired. Then, the ECU power stage unit 14 outputs a drive signal to the fuel injection device 6 via a drive circuit (not shown) over the acquired energization period length Tij, so that the fuel of the acquired fuel injection amount Qs is output. into the engine 1, the fuel injection device 6 is controlled.

Predetermined data for converting the instructed torque value Wa1 into the fuel injection amount Qs is obtained and set in the fuel injection amount conversion map in advance through experiments or the like. Further, in the energization period conversion map, predetermined data for converting the fuel injection amount Qs into the energization period is obtained in advance through experiments or the like and set.

Further, the ECU power stage unit 14 acquires the ignition delay amount At output from the control unit 11, and at a timing (crank angle of the engine 1) corresponding to the ignition delay amount At, the ECU power stage unit 14 controls the ignition coil 8 to the drive circuit. (not shown) to control the ignition coil 8 so as to ignite the fuel at the timing.

[About the first monitoring unit]
The first monitoring unit 12 determines whether or not there is a failure in the ECU 10, and if it is determined that there is a failure in the ECU 10, a failure determination flag that can specify that the ECU 10 has a failure. is set, and the throttle valve 7 is controlled to be closed, so that the operation of the engine 1 is shifted to a safe state.

As shown in FIG. 3, the first monitoring unit 12 includes an allowable torque acquisition unit 12a that acquires an allowable torque value Wc that allows the output of the vehicle, an actual torque value acquisition unit 12a that acquires an actual actual torque value Wac of the engine 1 It includes a unit 12b, a failure determination unit 12c that determines whether the ECU 10 has a failure, and a failure determination flag setting unit 12d that sets a failure determination flag.

The allowable torque acquisition unit 12a, like the total required torque acquisition unit 11a of the control unit 11 described above, obtains the driver required torque value We based on the operation angle βe of the accelerator pedal, and the externally required torque value requested to the engine 1. Get Wf. In addition, a torque loss in the engine 1 is calculated by a predetermined arithmetic expression based on control information (for example, the rotation speed Ne of the engine 1, the outside air temperature Tout, etc.) related to the control of the engine 1 acquired via the CAN 4 or the like. A compensating torque value Wg required to compensate for is obtained. Then, the allowable torque acquisition unit 12a acquires the sum of the driver required torque value We, the externally required torque value Wf, and the compensation torque value Wg, stores it as the allowable torque value Wc in a predetermined storage area of the ECU 10, and selects the minimum value. Output to the unit 11k. The allowable torque value Wc set in the predetermined storage area can be referred to by the control section 11 described above. Note that the allowable torque acquisition unit 12a is not limited to the configuration that acquires the compensation torque value Wg by a predetermined arithmetic expression, and for example, at least one of a predetermined characteristic curve, a predetermined map, etc. may be used to acquire the compensating torque value Wg, or may be combined to acquire the compensating torque value Wg.

The actual torque value acquisition unit 12b obtains the fuel injection amount Qs in the fuel injection device 6 controlled by the control unit 11, the energization period length Tij, control information related to the control of the engine 1 (for example, the fuel pressure in the fuel injection device 6 value Pij, air flow rate Qair in the engine 1, etc.), estimates the actual output torque value in the engine 1 based on these data, acquires it as the actual torque value Wac, and outputs it to the failure determination unit 12c. do. Note that the actual torque value acquisition unit 12b is not limited to the configuration that acquires the actual output torque value by a predetermined arithmetic expression, and for example, at least one of a predetermined characteristic curve, a predetermined map, and the like. A configuration in which the actual output torque value is acquired using one of them, or a configuration in which these are combined to acquire the actual output torque value may be used.

Failure determination unit 12c compares allowable torque value Wc and actual torque value Wac, and determines that actual torque value Wac exceeds allowable torque value Wc and that actual torque value Wac exceeds allowable torque value Wc. is greater than a predetermined reference value α during a predetermined period of time (40 ms in this embodiment) (in this embodiment, the integrated value of the amount of change in the rotation speed Ne of the engine 1), the ECU 10 malfunctions. determined to be On the other hand, when the actual torque value Wac is equal to or less than the allowable torque value Wc, and when the amount of failure during the predetermined period does not exceed the reference value α, it is determined that the ECU 10 has no failure. Then, the failure determination section 12c outputs the determination result to the failure determination flag setting section 12d.

Further, when the failure determination unit 12c determines that the ECU 10 has a failure, the failure determination unit 12c outputs a control signal for forcibly closing the throttle valve 7 to the throttle power stage unit 15. Control. On the other hand, when it is determined that the ECU 10 is not malfunctioning, control is performed so that the control signal for forcibly closing the throttle valve 7 is not output to the throttle power stage section 15 .

The failure determination flag setting unit 12d acquires the result of determination by the failure determination unit 12c, and if the failure determination unit 12c determines that the ECU 10 has a failure, specifies that the ECU 10 has a failure. A possible failure determination flag (abnormality) is set in a predetermined storage area of the ECU 10 . On the other hand, if the failure determination unit 12c determines that there is no failure in the ECU 10, a failure determination flag (normal) that can specify that the ECU 10 has no failure is set in a predetermined storage area of the ECU 10. . The failure determination flag (abnormal/normal) set in the predetermined storage area can be referred to by the control unit 11 as described above.

The throttle power stage unit 15 acquires the control signal output from the first monitoring unit 12, and when it is specified that the control signal is for forcibly controlling the throttle valve 7 to the closed state, the throttle power stage unit 15 By outputting a drive signal through a drive circuit (not shown), the throttle valve 7 is forcibly closed. As a result, the throttle power stage unit 15 shifts the operation of the engine 1 to a safe state by controlling the throttle valve 7 to be closed when the ECU 10 is malfunctioning. On the other hand, the throttle power stage unit 15 acquires the control signal output from the first monitoring unit 12, and if it is not specified that the control signal is for forcibly controlling the throttle valve 7 to the closed state, the control unit By outputting a drive signal to the throttle valve 7 via a drive circuit (not shown) in response to a predetermined control signal output from 11 or the like, the throttle valve 7 is controlled to be closed or opened.

[About the second monitoring unit]
The second monitoring unit 13 diagnoses the operation of the first monitoring unit 12 by a third level program independent of the first level program and the second level program executed by the control unit 11 and the first monitoring unit 12. A diagnosis unit 13a and an ASIC 13b (Application Specific Integrated Circuit) configured by hardware resources independent of the control unit 11 and the first monitoring unit 12 are provided.

The diagnosis unit 13a stores the storage area allocated to the first monitoring unit 12, the command of the second level program executed by the first monitoring unit 12, the sequence executed by the second level program, the second level program The operation and the like of the first monitoring unit 12 are diagnosed by determining whether or not there is an abnormality in the data names and the like used by .

The ASIC 13b can control operations of the fuel injection device 6, the throttle valve 7, the ignition coil 8, and the like via the ECU power stage section 14 and the throttle power stage section 15. FIG. The ASIC 13b controls the operation of the fuel injection device 6, the throttle valve 7, and the ignition coil 8 to stop when the diagnosis section 13a diagnoses that the operation of the first monitoring section 12 is abnormal. By configuring the ASIC 13b with hardware resources different from those of the control unit 11 and the first monitoring unit 12, the second monitoring unit 13 can detect failures in the hardware resources and software resources of the control unit 11 and the first monitoring unit 12. The operation of the first monitoring unit 12 can be monitored without being affected by the occurrence of a fault.

[Regarding the control method in the electronic control unit]
An example of control performed by the ECU 10 of this embodiment will be described with reference to FIGS. 5 to 8. FIG.

The ECU 10 can realize a predetermined function by repeatedly executing programs (eg, first to third level programs, etc.) stored in a storage area of the ECU 10 at predetermined time intervals (eg, 10 ms intervals). . The ECU 10 executes, for example, a predetermined program included in the first level program to perform ignition delay control-related processing for executing ignition delay control when a failure of the ECU 10 is detected. By executing a predetermined program, failure determination related processing for performing failure determination of the ECU 10 is performed.

Specifically, as shown in FIG. 5, in the ignition delay control-related process, the ECU 10 first refers to a predetermined storage area of the ECU 10 to acquire a failure determination flag (normal/abnormal), Based on the determination flag, it is determined whether or not the ECU 10 is malfunctioning (step Sa01). The failure determination flag is a flag that can specify whether or not a failure has occurred in the ECU 10 as described above. set in the area.

If it is determined that there is no failure in the CU 10 based on the failure determination flag (normal) in step Sa01 (N), the ignition delay control related processing is terminated without performing the processing related to steps Sa02 to Sa07 described later. . On the other hand, when it is determined that the ECU 10 has a failure based on the failure determination flag (abnormal) in step Sa01 (Y), the processes relating to steps Sa02 to Sa07 are executed.

If it is determined in step Sa01 that the ECU 10 has failed (Y), the rotation speed Ne of the engine 1 and the reference value ε (for example, 1500 rpm) for starting the limp home control are acquired. Then, the acquired rotation speed Ne of the engine 1 is compared with a reference value ε (Sa02), and if the rotation speed Ne exceeds the reference value ε (Y), the conditions for starting the limp home control are satisfied. It is determined that the vehicle is present, the process proceeds to step Sa07, and limp home control is executed (Sa07). In the limp home control, when the rotation speed Ne of the engine 1 exceeds the reference value ε, energization of the fuel injection device 6 and the ignition coil 8 is stopped. It is controlled so that it is stopped (ICO: Injection Cut Off) and the ignition by the ignition coil 8 is stopped. On the other hand, when the rotation speed Ne of the engine 1 is lower than the reference value ε, the fuel injection device 6 and the ignition coil 8 are energized, so that the fuel injection device 6 injects fuel into the engine 1 and ignites. Control is performed so that the coil 8 is ignited. By performing the limp home control, the operation of the engine 1 is maintained in a safe state, and the vehicle is controlled to a state in which the vehicle can run but can only run at a speed that allows evacuation running.

In step Sa02, when the rotation speed Ne is equal to or less than the reference value ε, (N) initializes (for example, sets to 0) the time counter Td if the time counter Td is not in operation, and then starts it. While starting to measure time, a time measuring process is performed to continue measuring time when the time measuring counter Td is in operation (Sa03). The time counter Td is provided, for example, in a predetermined storage area of the ECU 10, and is updated at predetermined time intervals (eg, 10 milliseconds).

After the timing process is performed in step Sa03, an ignition delay control allowable status flag is acquired, and it is determined whether or not the execution of the ignition delay control is allowed (step Sa04). If it is determined in step Sa04 that the execution of the ignition delay control is not permitted (N), the process related to the ignition delay control is terminated without performing the processes related to steps Sa05 and Sa06, which will be described later. On the other hand, if it is determined in step Sa04 that the execution of the ignition delay control is allowed (Y), the predetermined storage area of the ECU 10 is referred to, and the failure determined by the failure determination related process described later. The rotation speed Ner at the time of detection is acquired, and the reference value γ corresponding to the rotation speed Ner at the time of failure detection is acquired based on the rotation speed Ner at the time of failure detection and the ignition delay control period reference value map, and the value of the timer counter Td is obtained. It is compared with the obtained reference value γ (Sa05).

If it is determined in step Sa05 that the value of the time counter Td exceeds the reference value γ and the value of the time counter Td is not equal to or less than the reference value γ (N), the ignition delay control is performed without performing the processing related to step Sa06 described later. Terminate related processing. On the other hand, if it is determined in step Sa05 that the value of the timer Td is equal to or less than the reference value γ (Y), ignition delay control is executed (step Sa06), and then the ignition delay control-related processing is terminated.

In the ignition delay control in step Sa06, the rotation speed Ne of the engine 1 is obtained, and is limited to be smaller than the total required torque value Wb and the allowable torque value Wc based on the rotation speed Ne and the second limit torque value map. A second limit torque value ζ2 is obtained. The second limit torque value ζ2 is output to the minimum value selection section 11k as the limit torque value Wd. Then, the minimum value selection section 11 k selects the second limit torque value ζ2 as the command torque value Wa1 and outputs it to the ECU power stage section 14 . The ECU power stage unit 14 acquires the energization period length Tij for injecting the fuel injection amount Qs based on the command torque value Wa1. By controlling the energization of the fuel injection device 6 over the energization period Tij, the fuel injection device 6 is controlled to inject a fuel injection amount Qs.

In the ignition delay control, the first torque limit value ζ1 of the output torque of the engine 1 is obtained based on the rotational speed Ne and the first torque limit value map, and the first torque limit value ζ1 and the total requested torque value Wb is calculated and set as the abnormal torque amount Qer. Then, based on the abnormal torque amount Qer, the rotation speed Ne, and the ignition delay amount setting map, an ignition delay amount At for realizing the second limit torque value ζ2 is obtained and output to the ECU power stage unit 14. be. In the ECU power stage unit 14, a drive signal is output to the ignition coil 8 through a drive circuit (not shown) at a timing corresponding to the ignition delay amount At, so that the fuel is ignited at the timing. , the ignition coil 8 is controlled.

When the ignition delay control is not performed and it is determined in step Sa01 that the ECU 10 has not failed, the first limit torque value ζ1 is set to a value larger than the total required torque value Wb. By outputting the total requested torque value Wb as the limit torque value Wd to the minimum value selection unit 11k, the smaller value of the total requested torque value Wb and the allowable torque value Wc is selected as the indicated torque value Wa1. and output to the ECU power stage unit 14 . Further, when the ignition delay control is not performed and it is determined in step Sa01 that the ECU 10 has failed, the first limit torque value ζ1 is set to a value smaller than the total required torque value Wb. By outputting the total requested torque value Wb as the limit torque value Wd to the minimum value selection unit 11k, the smallest value among the total requested torque value Wb, the allowable torque value Wc and the limit torque value Wd becomes the command torque. It is selected as the value Wa1 and output to the ECU power stage section 14 . The ECU power stage unit 14 acquires the energization period length Tij for injecting the fuel injection amount Qs based on the command torque value Wa1. By controlling the energization of the fuel injection device 6 over the energization period Tij, the fuel injection device 6 is controlled to inject a fuel injection amount Qs.

When the ignition delay control is not performed, the ignition delay amount At is set to 0 and output to the ECU power stage unit 14 regardless of whether the ECU 10 is malfunctioning or not. In the ECU power stage unit 14, a drive signal is output to the ignition coil 8 through a drive circuit (not shown) at a timing corresponding to the ignition delay amount At(0), so that the fuel is ignited at the timing. The ignition coil 8 is controlled so that the

Next, the failure determination processing for executing the failure determination of the ECU 10 will be described with reference to FIG.

As shown in FIG. 6, in the failure determination related process, the ECU 10 first causes the allowable torque acquisition unit 12a of the first monitoring unit 12 to acquire the driver required torque value We based on the operation angle βe of the accelerator pedal (step Sb01), an externally demanded torque value Wf is obtained via CAN 4 (step Sb02), and a compensation torque value Wg is obtained based on the control information of the engine 1 obtained via CAN 4 (step Sb03). Then, the allowable torque acquisition unit 12a acquires the sum of the driver requested torque value We, the externally requested torque value Wf, and the compensation torque value Wg as the allowable torque value Wc (step Sb04).

Next, the actual torque value acquisition unit 12b obtains the fuel injection amount Qs in the fuel injection device 6, the energization period length Tij, and the control information of the engine 1 (for example, the pressure value Pij of the fuel in the fuel injection device 6) via the CAN 4. , the air flow rate Qair in the engine 1, etc.), and the actual torque value Wac is acquired based on these data (step Sb05).

After that, the failure determination unit 12c compares the allowable torque value Wc and the actual torque value Wac to determine whether or not the actual torque value Wac exceeds the allowable torque value Wc (step Sb06). When it is determined in step Sb06 that the actual torque value Wac exceeds the allowable torque value Wc (Y), a detection process for detecting a failure of the ECU 10 is started, and the failure determination unit 12c determines that the actual torque value Wac exceeds the allowable torque. The rotational speed Ne of the engine 1 at the time when it is determined to exceed the value Wc is acquired, and the rotational speed Ne is set in a predetermined storage area of the ECU 10 as the rotational speed Ner at the time of failure detection, and the rotational speed at the time of failure detection. A reference value α corresponding to Ner is obtained (step Sb07). In addition, a timer counter Tm for measuring time provided in a predetermined storage area of the ECU 10 is started (step Sb08).

The rotation speed Ner upon failure detection may be obtained at any timing during the failure detection process.

During the period from when the time counter Tm is started in step Sb08 to when it is specified based on the time counter Tm that a predetermined reference time τ (for example, 40 milliseconds) has elapsed, failure determination is performed. The unit 12c acquires the actual torque value Wac from the actual torque value acquisition unit 12b at predetermined time intervals (for example, 10 ms intervals), and based on the actual torque value Wac, the amount of change over time of the actual torque value Wac. Calculate ΔWac. Then, an integrated value (initial value is, for example, 0) of the time change amount ΔWac calculated at each time interval is obtained as an abnormal torque amount ΣΔW (steps Sb09 to S10).

After that, the failure determination unit 12c determines whether or not the reference time τ has elapsed based on the time counter Tm (step Sb10). When it is determined that the reference time τ has not elapsed (N), Step Sb09 is repeated at predetermined time intervals until it is determined that the reference time τ has passed. On the other hand, if it is determined that the reference time τ has passed (Y), the process proceeds to step Sb11, which will be described later. When the value of the time counter Tm first exceeds the reference value Tmv corresponding to the predetermined reference time τ, the failure determination unit 12c determines that the reference time τ has elapsed based on the time counter Tm. It is designed to judge.

If it is determined in step Sb10 that the reference time τ has elapsed based on the time counter Tm (Y), the reference value α obtained in step Sb07 is compared with the abnormal torque amount ΣΔW obtained in step Sb09. Then, it is determined whether or not the abnormal torque amount ΣΔW exceeds the reference value α (step Sb11).

Then, when it is determined in step Sb11 that the abnormal torque amount ΣΔW exceeds the reference value α (Y), the failure determination section 12c outputs to the failure determination flag setting section 12d that there is a failure in the ECU 10. Then, a failure determination flag (abnormality) that can specify that the ECU 10 has a failure is set in a predetermined storage area of the ECU 10 by the failure determination flag setting unit 12d (step Sb12). The detection process is terminated by setting the failure determination flag (abnormal). After that, the throttle shut-off control for outputting a closing control signal for forcibly closing the throttle valve 7 to the throttle power stage unit 15 is started (step Sb13), and the failure determination related processing is terminated. . In the throttle shut-off control, the control of outputting the closing control signal to the throttle power stage unit 15 is continuously performed in a state where a failure determination flag (abnormal) is set in a predetermined storage area of the ECU 10 .

If it is determined in step Sb06 that the actual torque value Wac does not exceed the allowable torque value Wc (N), and if it is determined in step Sb11 that the abnormal torque amount ΣΔW does not exceed the reference value α (N) , the failure determination unit 12c outputs to the failure determination flag setting unit 12d that there is no failure in the ECU 10, and the failure determination flag (normal) that can specify that there is no failure in the ECU 10 is set in the ECU 10. is set by the failure determination flag setting unit 12d (step Sb14). The detection process is terminated by setting the failure determination flag (normal). After that, the failure determination related processing is terminated.

As described above, the ECU 10 performs the ignition delay control-related processing and the failure determination-related processing, so that, for example, as shown in FIG. The output torque of the engine 1 is controlled based on the total required torque value Wb acquired by the control section 11 . Also, the allowable torque value Wc is calculated by the first monitoring unit 12 . After that, when a failure occurs in the ECU 10 (t1), the actual torque value Wac of the engine 1 increases, and when the actual torque value Wac exceeds the allowable torque value Wc (t2), the first monitoring unit 12 detects the failure. A detection process (t2 to t3) is started. After the failure of the ECU 10 is detected in the detection process (t3), ignition delay control is executed for a predetermined period (t3-t4). After that, when the rotation speed Ne of the engine 1 satisfies the conditions for starting the limp home control, the limp home control is executed (from t4).

Next, when a failure occurs in the ECU 10 while the engine 1 is in an idling state, and the ECU 10 executes the above-described ignition delay control-related processing and failure determination-related processing, the rotation speed Ne of the engine 1 and the speed Ve of the vehicle , abnormal torque amount .SIGMA..DELTA.W, throttle shut-off control TSC, ignition delay control IRC, and limp home control ICO will be described with reference to FIG.

As shown in FIG. 8, for example, at time t0, the rotation speed (Ne) of the engine 1 is the rotation speed in the idling state (eg, 400 rpm, which is lower than a predetermined reference value (eg, 500 rpm)), and the vehicle speed Ve is 5 km, the abnormal torque amount ΣΔW is 0, and throttle shut-off control TSC, ignition delay control IRC, and limp home control ICO are not being performed. In such a state (time t0), when a failure occurs in the ECU 10, the rotation speed Ne of the engine 1 and the actual torque value Wac increase, and the speed Ve of the vehicle increases as shown in FIG. Thus, at time t1 when the actual torque value Wac exceeds the allowable torque value Wc, an abnormality in the ECU 10 is detected (step Sb06).

When an abnormality in the ECU 10 is detected at time t1, the rotation speed Ne of the engine 1 at time t1 is set as the failure detection rotation speed Ner, and a reference value α corresponding to the failure detection rotation speed Ner is set. is acquired (step Sb07). In addition, time measurement by the time counter Tm is started (step Sb08). Further, the process of acquiring the time change amount ΔWac of the actual torque value Wac at predetermined time intervals and integrating it as the abnormal torque amount ΣΔW is started (step Sb09).

Then, at time t2 (step Sb10) after a time corresponding to a predetermined reference time τ (40 ms in this embodiment) has elapsed from time t1, the abnormal torque amount ΣΔW is compared with the reference value α (step Sb11 ), it is determined that the ECU 10 has a failure when the abnormal torque amount ΣΔW exceeds the reference value α.

At time t2, it is determined that the ECU 10 has failed (step Sb11: Y), and throttle shut-off control is started (step Sb13). Further, the engine 1Ne is equal to or less than the reference value ε (step Sa02: N), the ignition delay control is permitted (step Sa04: Y), and the ignition delay control is in the continuation period (step Sa05: Y). In this case, ignition delay control (IRC) is started (step Sa06). Then, after the ignition delay control (IRC) is started at time t2, the ignition delay control is terminated at time t3 when a time (for example, 1 to 2 seconds) corresponding to the reference value γ has passed (Sa07). .

By executing the ignition delay control and limiting the output torque (actual torque value Wac) of the engine 1 as shown in FIG. The rate of increase of the speed Ne and the rate of increase of the vehicle speed Ve are kept lower than the rate of increase during the period before ignition delay control is started (period from time t0 to time t2).

After the ignition delay control is started, the rotational speed Ne of the engine 1 decreases once and then gradually increases. Then, at time t4 when the rotation speed Ne of the engine 1 exceeds a preset reference value ε (for example, 1500 rpm), the limp home control ICO is started. After the limp home control ICO is started, when the rotation speed Ne of the engine 1 exceeds the reference value ε, the energization of the fuel injection device 6 and the ignition coil 8 is stopped, while the rotation speed Ne of the engine 1 is less than the reference value ε, the fuel injection device 6 and the ignition coil 8 are controlled to be energized, thereby limiting increases in the engine speed Ne and the vehicle speed Ve. A predetermined rotational speed Ne (1500 rpm in this embodiment) and a predetermined predetermined speed Ve (15 km in this embodiment) are maintained.

For example, the larger the ignition delay amount At is set, or the larger the reference value γ is set and the longer the duration of the ignition delay control is set, the more the rotational speed Nev of the engine 1 (the dashed-dotted line in the figure) increases. As a result, the time required for the rotation speed Nev of the engine 1 to reach the reference value ε to start the limp home control tends to become longer after the ignition delay control is started. On the other hand, in the ECU 10 according to the present embodiment, the ignition delay amount At is set according to the abnormal torque amount Qer and the rotation speed Ne, and the ignition delay amount At is set according to the failure detection time rotation speed Ner when the abnormality of the ECU 10 is detected. Since the reference value γ indicating the length of the period during which the ignition delay control is executed is set, it is possible to relatively shorten the time required after the ignition delay control is started until the limp home control is started. can.

[About actions and effects]
The ECU 10 of the present embodiment is configured to transition to a safe driving state in which limp home control is executed when the rotation speed Ne of the engine 1 reaches the reference value ε after the failure of the ECU 10 is detected. During the transition period from the detection of the failure of the engine to the transition to the limp home control, the throttle shut-off control is performed to close the throttle valve 7, but only the throttle shut-off control is performed during the transition period. Then, when the rotation speed Ne of the engine 1 is in a relatively low state (for example, idling state) when the failure of the ECU 10 is detected, the reference value of the rotation speed Ne, which is the condition for starting the limp home control, is The difference between ε and the actual rotation speed Ne is large, and it takes a relatively long time for the rotation speed Ne to reach the reference value ε. There is a risk that the transition to the state in which the limp home control is executed when the reference value ε is exceeded may not be made quickly. That is, the timing at which the limp home control is started may be delayed due to the waiting time until the rotation speed Ne reaches the reference value ε. Further, during the transition period, only closing the throttle valve 7 may cause dangerous acceleration of the vehicle.

On the other hand, the ECU 10 of the present embodiment performs ignition delay control for delaying the timing of ignition by the ignition coil for a predetermined period while performing throttle shut-off control after the failure of the ECU 10 is detected. By executing the ignition delay control for a predetermined time, while limiting the actual output torque of the engine 1, the rotation speed Ne of the engine 1 is relatively quickly increased to reach the reference value ε, and the limp home control is executed. It is possible to quickly shift to the safe driving state that is required.

The ECU 10 of this embodiment is an electronic control unit 10 that controls the operation of the engine 1 of the vehicle. When the failure is detected, the first monitoring unit 12 stops the throttle valve 7 of the engine 1 and controls the closed state (step Sb13), and the control unit 11 When the failure is detected, at least the ignition delay amount At and the reference value of the duration based on the failure detection rotational speed Ner of the engine 1 acquired at the start of the failure detection process in the failure detection process At least one of γ is set to perform ignition delay control (step Sa07), and limp home control is performed (step Sa07) when the rotation speed Ne of the engine 1 exceeds a first reference value (reference value ε). be.

With such a configuration, when a failure of the ECU 10 is detected, the first monitoring unit 12 executes throttle shut-off control to stop the throttle valve 7 and close it, and the control unit 11 controls the ignition coil Since the ignition delay control is performed by 8 to delay the ignition timing, the output torque of the engine 1 can be limited. The ignition delay control is executed by setting at least one of the ignition delay amount At and the reference value γ of the duration based on the rotation speed Ner at failure detection of the engine 1, so that the ignition delay control is executed according to the rotation speed Ner at failure detection. The rotational speed (Ne) of the engine (1) can be made to reach a first reference value (reference value ε) (for example, 1500 rpm, etc.) in the predetermined transition time, and transition to limp home control can be performed.

The ECU 10 of the present embodiment is configured to perform ignition delay control by setting at least one of the ignition delay amount At and the reference value γ of the duration based on the rotation speed Ner at failure detection, and the rotation speed Ner at failure detection is , is the configuration obtained when the detection process is started.

In such a configuration, by acquiring the rotational speed Ne of the engine 1 at the earliest timing during the period of the detection process, the rotational speed Ne before the increase due to the failure of the ECU 10 is set as the rotational speed Ner at the time of failure detection. When a failure occurs, ignition delay control can be performed based on the rotational speed Ner at failure detection, which is a relatively close value.

The control unit 11 of the ECU 10 of this embodiment sets at least one of the ignition delay amount At and the reference value γ of the duration based on the rotation speed Ner at the time of failure detection and the abnormal torque amount ΣΔW of the engine 1 acquired in the detection process. It is a configuration that

In such a configuration, at least one of the ignition delay amount At and the reference value γ of the duration is set based on the failure detection time rotation speed Ner and the abnormal torque amount ΣΔW acquired in the detection process. Compared to the configuration in which the ignition delay amount At and the reference value γ of the duration are set based only on Ner, the operating state of the engine 1 in the detection process can be better reflected in the ignition delay control.

The control unit 11 of the ECU 10 of the present embodiment is configured to perform ignition delay control at least when the rotation speed Ner at the time of failure detection is the rotation speed Ne in the idling state.

In such a configuration, when the engine 1 is in an idling state and the difference between the rotational speed Ne of the engine 1 and the reference value ε which is the condition for starting the limp home control is large, the ECU 10 malfunctions. In this case, the ignition delay control is executed. Therefore, while limiting the actual output torque of the engine 1, the rotation speed Ne of the engine 1 is increased relatively quickly to reach the reference value ε, and the limp home control is executed. It is possible to shift to a safe driving state quickly.

The control unit 11 of the ECU 10 of the present embodiment is configured to set the ignition delay amount At and the reference value γ of the duration using an ignition delay amount setting map and an ignition delay control period reference value map as maps predetermined by experiments. is.

In such a configuration, since the ignition delay amount At and the reference value γ of the duration are set using the map, the ignition delay amount At and the reference value of the duration corresponding to the rotation speed Ner at the time of failure detection and the abnormal torque amount ΣΔW γ can be freely set, and design work and adaptation work of the ECU 10 can be facilitated.

The first monitoring unit 12 of the ECU 10 of the present embodiment acquires the allowable torque value Wc of the engine 1 that is permitted according to the operating conditions of the vehicle and the actual torque value Wac that is actually output from the engine 1, It is configured to start the detection process when the actual torque value Wac is greater than the allowable torque value Wc.

With such a configuration, when there is an abnormality in which the actual torque value Wac of the engine 1 is greater than the allowable torque value Wc, the failure detection process of the ECU 10 can be started.

The first monitoring unit 12 of the ECU 10 of the present embodiment acquires the abnormal torque amount ΣΔW calculated by integrating the time change amount ΔW of the output torque of the engine 1 in the failure detection process of the ECU 10, and acquires the abnormal torque amount ΣΔW. exceeds a second reference value (reference value α), a failure of the ECU 10 is detected.

With such a configuration, the first monitoring unit 12 detects when the abnormal torque amount ΣΔW calculated by integrating the time change amount ΔW of the output torque of the engine 1 in the detection process exceeds the second reference value (reference value α). Since the ECU 10 is detected to be malfunctioning, for example, the actual torque value Wac temporarily exceeds the allowable torque value Wc due to noise or the like even though the ECU 10 is not malfunctioning, and the detection process is started. It is possible to avoid erroneous detection of a failure of the ECU 10 in the event of a failure.

The control unit 11 of the ECU 10 of the present embodiment acquires an ignition delay control allowable state flag that can specify whether or not execution of ignition delay control is permitted (step Sa04), and determines whether the ignition delay control allowable state Execution of ignition delay control is permitted when execution of ignition delay control is permitted based on the flag, and execution of ignition delay control is not permitted based on the ignition delay control permitted state flag. This is a configuration that does not permit the execution of the ignition delay control in the case of such a situation.

With such a configuration, it is possible to perform control so that the ignition delay control is not performed when the situation does not permit the execution of the ignition delay control.

The control method of the ECU 10 of the present embodiment includes monitoring steps (Sb01 to Sb12) in which the electronic control unit 10 detects a failure of the electronic control unit 10, and the ECU 10 controls the operation of the engine 1 when the failure is detected. and control steps (Sa01 to Sa07), and in the monitoring steps (Sb01 to Sb12), when a failure is detected (Sb11: Y), the throttle valve 7 of the engine 1 is stopped and controlled to be closed ( Sb13) In the control steps (Sa01 to Sa07), when a failure is detected, at least based on the rotation speed Ner at failure detection of the engine 1 obtained at the start of the failure detection process in the failure detection process. Ignition delay control is performed by setting at least one of the ignition delay amount At and the reference value γ of the duration (Sa07), and when the rotation speed Ne of the engine 1 exceeds the reference value ε (Sa02: Y), limp home control is performed (Sa07).

In such a configuration, when a failure of the ECU 10 is detected, throttle shut-off control is executed to stop the throttle valve 7 and control it to a closed state in the monitoring step, and ignition timing by the ignition coil 8 is delayed in the control step. Since the ignition delay control is performed, the output torque of the engine 1 can be limited. Since the ignition delay control is executed by setting at least one of the ignition delay amount At and the reference value γ of the duration based on the rotation speed Ner at the time of detection, the engine 1 can be operated in a predetermined transition time corresponding to the rotation speed Ner at the time of failure detection. reaches a reference value ε (for example, 1500 rpm) to shift to limp home control.

Although an example of an embodiment of the present invention has been described above, the present invention is not limited to this example of embodiment. It goes without saying that it is included.

1 engine 1
4 CAN
5 accelerator sensor 6 fuel injector 7 throttle valve 8 ignition coil 10 electronic control unit (ECU)
11 control unit 12 first monitoring unit (monitoring unit)
13 second monitoring unit 14 ECU power stage unit 15 throttle power stage unit

Claims (9)

In an electronic control unit (10) for controlling the operation of a vehicle engine (1),
a monitoring unit (12) for detecting an operation failure of the electronic control unit (10);
A control unit (11) that controls the operation of the engine (1) when the failure is detected,
The monitoring unit (12)
when the failure is detected, the throttle valve (7) of the engine (1) is stopped and controlled to be closed;
The control unit (11)
When the failure is detected, perform ignition delay control,
performing limp home control when the rotational speed (Ne) of the engine (1) exceeds a first reference value (ε);
In the ignition delay control,
At least one of an ignition delay amount (At) and a continuation period (γ) is set based on at least a failure detection rotational speed (Ner) of the engine (1) obtained in the failure detection process. electronic control unit (10). The electronic control unit (10) according to claim 1, wherein the rotation speed at failure detection (Ner) is obtained when the detection process is started. The control unit (11)
At least one of the ignition delay amount (At) and the duration (γ) is determined based on the rotational speed (Ner) at the time of failure detection and the abnormal torque amount (ΣΔW) of the engine (1) acquired in the detection process. 3. Electronic control unit (10) according to claim 1 or 2, characterized in that: The control unit (11)
4. The electronic control device according to any one of claims 1 to 3, wherein the ignition delay control is performed at least when the rotational speed at failure detection (Ner) is the rotational speed in an idling state. 10). The control unit (11)
The electronic control unit (10) according to any one of claims 1 to 4, wherein the ignition delay amount (At) and the duration (γ) are set using a predetermined map. The failure is a failure in which the actual torque value (Wac) actually output from the engine (1) exceeds a reference value,
The monitoring unit (12)
Acquiring an allowable torque value (Wc) of the engine (1) that is permitted according to the operating condition of the vehicle and an actual torque value (Wac) that is actually output from the engine (1);
The electronic control device (10 ). The failure is a failure in which the actual torque value (Wac) actually output from the engine (1) exceeds a reference value,
The monitoring unit (12)
When an abnormal torque amount (ΣΔW) is acquired based on the time variation (ΔW) of the output torque of the engine (1) in the detection process, and the abnormal torque amount (ΣΔW) exceeds the second reference value (α) The electronic control unit (10) according to any one of claims 1 to 6, characterized in that the failure is also detected. The control unit (11)
A propriety determination unit that determines whether or not the execution of the ignition delay control is permitted,
permitting execution of the ignition delay control when execution of the ignition delay control is permissible;
8. The electronic control device according to any one of claims 1 to 7, wherein the execution of the ignition delay control is not permitted when execution of the ignition delay control is not permitted. 10). A control method for an electronic control unit (10) for controlling the operation of a vehicle engine (1), comprising:
a monitoring step in which the electronic control unit (10) detects a failure in the operation of the electronic control unit (10);
a control step in which the electronic control unit (10) controls the operation of the engine (1) when the failure is detected;
In the monitoring step,
when the failure is detected, the throttle valve (7) of the engine (1) is stopped and controlled to a closed state;
In the control step,
When the failure is detected, ignition delay control is performed,
limp home control is performed when the rotation speed (Ne) of the engine (1) exceeds a first reference value (ε),
In the ignition delay control,
At least one of an ignition delay amount (At) and a continuation period (γ) is set based on at least a failure detection rotational speed (Ner) of the engine (1) obtained in the failure detection process. A method of controlling an electronic control device (10) to

Images