Vehicle control devices

Abstract

The present invention aims to achieve a control device with operational continuity in the event of a failure, using less redundancy and thus reducing costs. The vehicle control system of the present invention is characterized by comprising: a transmission unit that transmits energy to drive wheels; a first control unit that controls the transmission unit; a first source that inputs energy into the transmission unit; a second source that inputs energy into the transmission unit; a second control unit that controls the first source; and a third control unit that controls the second source. In the event of a failure in the first control unit, the second control unit or the third control unit controls the transmission unit.

Description

Technical Field

[0001] The present invention relates to a control system, and in particular to a control system which can continue to operate in the event of a failure. Background Art

[0002] Fully automated control, including autonomous driving, eliminates the need for human intervention, reducing the probability of accidents caused by human error and improving safety. Advanced autonomous driving requires a high level of safety, as the system assumes responsibility for vehicle control. One of the safety requirements is fail-safe operation (operational continuity in the event of a failure).

[0003] This refers to a function that maintains minimum performance by using the remaining functionality rather than immediately stopping the vehicle if a component fails. For example, in driving control, even if a failure occurs, the vehicle can be stopped after moving to a safe location, thereby ensuring safety compared to stopping the vehicle immediately.

[0004] The driving control system that implements autonomous driving not only has a higher-level computing unit (hereinafter referred to as the "autonomous driving control unit") that executes driving plans, but also a lower-level computing unit (hereinafter referred to as the "drive system control unit") that controls the engine, battery, power converter (inverter), and other devices that control vehicle motion. To ensure that the vehicle can be moved to a safe location and then stopped even if a failure occurs, both the autonomous driving control unit and the drive system control unit require fault-tolerant operation (fault-resistance).

[0005] Hybrid drive systems, which combine different power (energy) sources such as engines and motors, are also gaining popularity from the perspectives of environmental protection and the sustainability of human activities. In particular, from the perspective of autonomous driving, series hybrid drive systems are expected to be widely used in the future due to their linear characteristics.

[0006] Regarding the operational continuity of these electronic devices that control automobiles in the event of a failure, for example, Patent Document 1 discloses.

[0007] Prior art literature

[0008] Patent Literature

[0009] Patent Document 1: Japanese Patent Application Publication No. 2018-016107 Summary of the Invention

[0010] Problems to be solved by the invention

[0011] According to Patent Document 1, the reliability of operation continuity during a failure can be improved, but this is based on the redundancy of the control device, and the industry expects more consideration of cost reduction.

[0012] Therefore, an object of the present invention is to realize a control device having operational continuity in the event of a failure with less redundancy and thereby reduce costs.

[0013] Technical means to solve the problem

[0014] In order to achieve the above-mentioned purpose, the vehicle control system of the present invention is characterized in that it comprises: a transmission unit, which transmits energy to the drive wheel; a first control unit, which controls the transmission unit; a first source, which inputs energy to the transmission unit; a second source, which inputs energy to the transmission unit; a second control unit, which controls the first source; and a third control unit, which controls the second source, and in the event that a failure occurs in the first control unit, the transmission unit is controlled by the second control unit or the third control unit.

[0015] Effects of the Invention

[0016] By treating the different power (energy) sources equipped in the hybrid drive system as redundant power (energy) sources, there is no need for further redundancy, and the fault operability of the hybrid drive system can be achieved through minimal redundancy, thereby taking into account both the realization of operation continuity in the event of a fault and cost reduction. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 This is a structural diagram of the basic embodiment 1 of the present invention.

[0018] Figure 2 This is an embodiment of a parallel hybrid drive system.

[0019] Figure 3 This is an embodiment of a parallel hybrid drive system.

[0020] Figure 4 This is an embodiment of a parallel hybrid drive system.

[0021] Figure 5 A more detailed embodiment of a parallel hybrid drive system.

[0022] Figure 6 A more detailed embodiment of a parallel hybrid drive system.

[0023] Figure 7 It is an embodiment of a series hybrid drive system and a parallel-parallel hybrid drive system.

[0024] Figure 8 It is an embodiment of a series hybrid drive system and a parallel-parallel hybrid drive system.

[0025] Figure 9 It is an embodiment of a series hybrid drive system and a parallel-parallel hybrid drive system.

[0026] Figure 10 A more detailed embodiment of a series hybrid drive system.

[0027] Figure 11 A more detailed embodiment of a series hybrid drive system.

[0028] Figure 12 A more detailed embodiment of a series-parallel hybrid drive system.

[0029] Figure 13 A more detailed embodiment of a series-parallel hybrid drive system.

[0030] Figure 14 This is an embodiment of integrating ECUs.

[0031] Figure 15 This is an example of signal communication between ECUs.

[0032] Figure 16 For action example.

[0033] Figure 17 This is an example of the operation of a parallel hybrid drive system.

[0034] Figure 18 This is an example of the operation of a parallel hybrid drive system.

[0035] Figure 19 This is an example of the operation of a parallel hybrid drive system.

[0036] Figure 20 This is an example of the operation of a series hybrid drive system.

[0037] Figure 21 This is an example of the operation of a series hybrid drive system.

[0038] Figure 22 This is an example of the operation of a series hybrid drive system.

[0039] Figure 23 This is an embodiment of the operation of the range extender.

[0040] Figure 24 This is an embodiment of the operation of the range extender.

[0041] Figure 25 This is an embodiment of the operation of the range extender.

[0042] Figure 26 This is an embodiment of the operation of the range extender.

[0043] Figure 27 This is the basic embodiment 2 of the present invention.

[0044] Figure 28 This is an embodiment of a parallel hybrid drive system.

[0045] Figure 29 This is an embodiment of a parallel hybrid drive system.

[0046] Figure 30 This is an embodiment of a parallel hybrid drive system.

[0047] Figure 31 A more detailed embodiment of a parallel hybrid drive system.

[0048] Figure 32 A more detailed embodiment of a parallel hybrid drive system.

[0049] Figure 33 It is an embodiment of a series hybrid drive system and a parallel-parallel hybrid drive system.

[0050] Figure 34 It is an embodiment of a series hybrid drive system and a parallel-parallel hybrid drive system.

[0051] Figure 35 It is an embodiment of a series hybrid drive system and a parallel-parallel hybrid drive system.

[0052] Figure 36 It is an embodiment of a series hybrid drive system and a parallel-parallel hybrid drive system.

[0053] Figure 37 A more detailed embodiment of a series hybrid drive system.

[0054] Figure 38 A more detailed embodiment of a series hybrid drive system.

[0055] Figure 39 A more detailed embodiment of a series-parallel hybrid drive system.

[0056] Figure 40 A more detailed embodiment of a series-parallel hybrid drive system.

[0057] Figure 41 This is an embodiment of integrating ECUs.

[0058] Figure 42 This is a detailed example of ECU integration.

[0059] Figure 43 This is an example of output protection coordination.

[0060] Figure 44This is an example of output protection coordination.

[0061] Figure 45 This is an example of output protection coordination. DETAILED DESCRIPTION

[0062] Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings.

[0063] Example 1

[0064] Figure 1 This is the basic embodiment 1 of the present invention.

[0065] The power (energy) from different power (energy) sources 100 and 200 is input into the hybrid transmission unit (Combiner) 300, in which the power (energy) from the power (energy) sources 100 and 200 is mixed and the power (energy) is transmitted to the drive wheel 400. The hybrid transmission unit 300 is controlled by the first control unit, namely the electronic control unit ECU10-3. The power (energy) source 100 is controlled by the second control unit, namely the electronic control unit ECU10-1, and the power (energy) source 100 is controlled by the third control unit, namely the electronic control unit ECU10-2. Furthermore, the mixing ratio of the (energy) from the power (energy) sources 100 and 200 in the hybrid transmission unit 300 is controlled by the fourth control unit, namely the electronic control unit ECU10-0, which is responsible for the energy management of the hybrid drive system as a whole. The above is the composition of a conventional hybrid drive system.

[0066] Furthermore, in the present invention, ECU 10-3 is configured to be fault-operable (able to continue operating in the event of a fault). Specifically, as shown in the figure, a redundant configuration of ECU 10-3a and ECU 10-3b is considered. Common-cause failure countermeasures are implemented for ECU 10-1 and ECU 10-2, ensuring that neither loses control due to the same fault or cause. Specifically, consideration is given to physically separating ECU 10-1 and ECU 10-2 by differentiating their housings, circuit boards, and semiconductor chips, or electrically isolating them by operating them with different power supplies.

[0067] Furthermore, in the present invention, ECU 10-0 controls the following: if a failure occurs in one power (energy) source (e.g., 100) or its control unit (e.g., ECU 10-1), hybrid transmission unit 300 transmits energy to the drive wheels using power (energy) from another power (energy) source (e.g., 200). This control allows the different power (energy) sources 100 and 200 to be treated as redundant power (energy) sources, allowing continued operation even if one fails.

[0068] According to the present embodiment described above, the redundancy already provided by the hybrid drive system is utilized, thereby making the hybrid drive system fail-operable with even less redundancy.

[0069] Example 2

[0070] Figure 2 The embodiment of the present invention is applied to a parallel hybrid drive system. Figure 1 The power (energy) source 100 in the embodiment has a power (energy) source 210 including a motor as the power (energy) source 200, and a transmission 310 as the hybrid transmission unit 300. In this embodiment, the power (energy) source 210 including a motor is composed of a motor (or electric generator) 211, a power converter 212, and a battery 213. The driving force from the engine 110 and the motor 211 is input to the transmission 310, and the driving force from the engine 110 and the motor 211 is mixed in the transmission 310 at an appropriate reduction ratio through gears, clutches, etc. In most cases, the engine 110, the motor 211, and the output shaft connected to the drive wheel are combined via a transmission, and the driving force of the engine 110, the motor 211, or both is transmitted to the output shaft through a clutch inserted between them. In this embodiment, ECU10-3a and ECU10-3b for controlling the transmission 310 are provided in a redundant manner, and in the case of a vehicle like Figure 3 As shown, when the solenoid 311 driving the hydraulic valve of the transmission 310 is not redundant but is a single system, the solenoid 311 is driven via an OR circuit or a selector circuit 312 based on control signals from the redundant ECUs 10 - 3 a and 10 - 3 b.

[0071] In the image Figure 4 When the solenoids 311a and 311b are redundantly provided as shown, the redundant ECUs 10-3a and 10-3b may drive the solenoids 311a and 311b, respectively.

[0072] In addition, it is ideal that the power converter (inverter) 211 has not only an inverter function but also a four-quadrant conversion function, that is, the power generated by the output side motor acting as a generator during deceleration is converted into direct current and sent back to the battery 213, so that the motor (or electric generator) 211 can not only be responsible for driving but also for regenerative braking.

[0073] Figure 5 A more detailed embodiment of a parallel hybrid drive system.

[0074] The driving force output from the engine 110 is input to the automatic transmission AT via a clutch CL1 and a motor (or motor generator) 211. The automatic transmission AT includes a clutch CL2, which is controlled by a control valve unit CVU. Ideally, the driving force from the automatic transmission AT is supplied to the drive wheels 400. The speed difference (rotational speed difference) between the inner and outer wheels when the vehicle turns a curve is transmitted via a differential gear 410.

[0075] Clutch CL1 is engaged when the engine 110 is driving the drive wheels 400, transmitting the engine 110's driving force to the drive wheels 400. It is disengaged when the motor (or electric generator) 211 is driving the drive wheels 400, preventing the engine 110 from becoming a load on the motor (or electric generator) 211. Clutch CL2 is used to generate electricity using the engine 110's driving force when the battery 213's SoC decreases, allowing the motor (or electric generator) 211 to generate electricity when the vehicle is stopped. The example shown utilizes one of the friction engagement elements built into the automatic transmission AT as clutch CL2. Alternatively, an independent clutch CL2 may be provided between the electric generator MG and the automatic transmission AT, or between the automatic transmission AT and the drive wheels 400.

[0076] In addition, if the operation of generating electricity by the driving force motor (or electric generator) 211 of the engine 110 is not performed when the vehicle is stopped, the vehicle can also be operated as follows. Figure 6 As shown, the clutch CL2 is omitted.

[0077] In this embodiment, the automatic transmission AT, the clutch CL1, ( Figure 5 The clutch CL2 in the embodiment corresponds to the hybrid transmission unit 300, so these elements are controlled by redundant ECUs 10-3a and 10-3b.

[0078] Example 3

[0079] Figure 7 The embodiment of the present invention is applied to a series hybrid drive system or a parallel hybrid drive system. Figure 1 The power (energy) source 100 in the embodiment includes a battery 220 as the power (energy) source 200 and an output-side motor (+ power converter (inverter)) 320 as the hybrid transmission unit 300. The engine-generator 120 is composed of an engine 121, a generator 122, and a power converter 123, while the output-side motor (+ power converter (inverter)) 320 is composed of an output-side motor (or electric generator) 321 and a power converter (inverter) 322.

[0080] In the internal series hybrid drive system of this embodiment, Figure 8 、 Figure 9 As shown, the electric power (DC) from the engine-generator 120 and the battery 220 is input to the power converter (inverter) 322, and the power converter (inverter) 322 outputs three-phase AC synchronized with the magnetic pole of the output side motor 321 to drive the output side motor 321, and the output side motor 321 drives the drive wheel 400.

[0081] In a parallel-parallel hybrid drive system, in addition to the electric power from the engine-generator 120, the driving force from the engine 121 is also input to the output-side motor 321. Specifically, the rotating shaft of the engine 121 is connected to the rotating shaft of the output-side motor 321, and the driving force generated by the output-side motor 321 is combined with the driving force generated by the engine 121 to drive the drive wheels 400.

[0082] In addition, it is ideal that the power converter (inverter) 322 not only has an inverter function, but also has a four-quadrant conversion function, that is, the power generated by the output side motor (or electric generator) 321 acting as a generator during deceleration is converted into direct current and sent back to the battery 220, so that the output side motor 321 can not only be responsible for driving but also for regenerative braking.

[0083] In this embodiment, the ECU 10-3a and ECU 10-3b for controlling the output side motor (+ power converter (inverter)) 320 are provided in a redundant manner, and Figure 8 When the power converter (inverter) 322 driving the output side motor 321 is not redundant and is a single system as shown, the power converter (inverter) 322 is driven via the OR circuit or the selector circuit 323 according to the control signal from the redundant ECU 10-3a, ECU 10-3b. Figure 9 When power converters (inverters) 322a and 322b are provided in a redundant manner as shown, the redundant ECUs 10-3a and 10-3b drive the power converters (inverters) 322a and 322b, respectively. Furthermore, the windings within the output-side motor 321 (not shown) may also be provided with a redundant structure.

[0084] In addition, there are cases where the power from the engine-generator 120 and the battery 220 is supplied to the power converter (inverter) 321 or the power converters (inverters) 322a, 322b via a diode OR or a circuit (not shown), and cases where the engine-generator 120, the battery 220, and the power converters (inverters) 322a, 322b are connected to a common bus. In the former case, in the embodiment having a plurality of power converters (inverters) 322a, 322b ( Figure 9) , there is also a method where the power from the engine-generator 120 is fixedly sent to the power converter (inverter) 322a, and the power from the battery 220 is fixedly sent to the power converter (inverter) 322b, that is, the combination of the power (energy) source and the power converter (inverter) is fixed. Furthermore, in the latter case, the SoC of the battery 220 is controlled by the output voltage of the engine-generator 120 and the output voltage of the power converters (inverters) 322a and 322b during regeneration. Therefore, ECU 10-2 estimates the SoC of the battery 220, and ECU 10-0 outputs a command value for the output voltage of the engine-generator 120 to ECU 10-1, and outputs a command value for the output voltage of the power converters (inverters) 322a and 322b during regeneration to ECUs 10-3a and 10-3b. Furthermore, if the SoC of the battery 220 is abnormal, ECU 10-2 disconnects the connector (switch) connecting the battery 220 to the busbar to protect the battery 220.

[0085] Figure 10 This is a more detailed embodiment of the present invention for a series hybrid drive system (including a range extender). The drive output shaft of engine 121 is mechanically connected to generator 122. The power terminals of generator 122 are connected to battery 220 and power converters (inverters) 322a and 322b via power converter 123. Power converters (inverters) 322a and 322b convert the power (DC) from power converter 123 and battery 220 into three-phase AC power to drive output-side motor (or motor generator) 321.

[0086] Furthermore, if Figure 11 As shown, the drive output shaft mechanically connected to the engine 121 and the generator 122 can also be mechanically connected to the drive output shaft of the output side motor (or electric generator) 321 via the clutch CL1, thereby directly transmitting the drive output of the engine to the drive wheel 400 under high load, thereby eliminating the conversion loss caused by the temporary conversion into electric power in cooperation with the generator 122, the power converter 123, the power converter (inverter) 322a, 322b, and the output side motor (or electric generator) 321.

[0087] In this embodiment, the output side motor (or electric generator) 321, the power converter (inverter) 322a, 322b, ( Figure 11 The clutch CL1 in the embodiment corresponds to the hybrid transmission unit 300, so these elements are controlled by redundant ECUs 10-3a and 10-3b.

[0088] Figure 12This is a more detailed embodiment of the present invention applied to a series-parallel hybrid drive system. The drive output of engine 121 is mechanically transmitted to generator 122 and hybrid transmission unit 300 via power split mechanism 124. The output of generator 122 is electrically transmitted to battery 220 and power converters 322a and 322b within hybrid transmission unit 300 (320) via power converter 123.

[0089] In the hybrid transmission unit 300 (320), the drive output of the engine 121, transmitted via the power split mechanism 124, is mechanically connected to the output shaft of the output-side motor (or motor generator) 321, which drives the drive wheels 400. Furthermore, power converters 322a and 322b convert the power (DC) supplied from the power converter 123 and the battery 220 into three-phase AC to drive the output-side motor (or motor generator) 321.

[0090] Furthermore, if Figure 13 As shown, the power distribution mechanism 124 and the output shaft of the output side motor (or electric generator) 321 can also be mechanically connected via the clutch CL1, thereby disconnecting the engine 121 through the clutch CL1 when cruising at high speed with light load, thereby preventing the engine 121 from becoming a load and reducing losses.

[0091] Furthermore, there are various methods for implementing the power distribution mechanism 124. For example, the power distribution mechanism 124 shows a method using a differential gear, Japanese Patent Laid-Open No. 9-100853 shows a method using a planetary gear, and WO2008 / 018539 shows a method using a motor with multiple rotors.

[0092] In this embodiment, the output side motor (or electric generator) 321, the power converter (inverter) 322a, 322b, ( Figure 13 The clutch CL1 in the embodiment corresponds to the hybrid transmission unit 300, so these elements are controlled by redundant ECUs 10-3a and 10-3b.

[0093] As described above, according to the present invention, in a parallel hybrid drive system, a series hybrid drive system, and a series-parallel hybrid drive system, it is only necessary to make the ECU that controls the part equivalent to the hybrid transmission unit 300 redundant into ECU10-3a and 10-3b, so that the entire drive system can continue to operate even in the event of a failure.

[0094] Example 4

[0095] Figure 14This embodiment integrates ECUs, including ECUs 10-1 and 10-3a, and ECUs 10-2 and 10-3b, using a common housing, circuit board, and semiconductor chip. This embodiment reduces the risk of common-cause failures between ECUs 10-1 and 10-2, as well as between ECUs 10-2 and 10-3b, using separate housings, circuit boards, and semiconductor chips. Furthermore, the redundant ECUs 10-3a and 10-3b also use separate housings, circuit boards, and chips, further reducing the risk of common-cause failures between them and enhancing the effectiveness of redundancy.

[0096] Example 5

[0097] Figure 15 The energy management ECU 10 - 0 outputs control commands 13 - 1 , 13 - 2 , 13 - 3 a , and 13 - 3 b to the ECUs 10 - 1 , 10 - 2 , 10 - 3 a , and 10 - 3 b based on the required torque 11 from the automatic driving control unit 1 .

[0098] A characteristic of the present invention is that energy management ECU 10-0 outputs control commands 13-1, 13-2, 13-3a, and 13-3b based on diagnostic results (OK / NG) 12-1, 12-2, 12-3a, and 12-3b from ECUs 10-1, 10-2, 10-3a, and 10-3b. Specifically, ECU 10-0 controls the system so that, when a power (energy) source (e.g., 100) or its control unit (e.g., ECU 10-1) fails (e.g., when diagnostic result 12-1 indicates NG), hybrid transmission unit 300 transmits energy to the drive wheels using power (energy) from another power (energy) source (e.g., 200).

[0099] ECU10-1, 10-2, 10-3a, 10-3b have diagnostic functions, which are used to determine the normality / abnormality of ECU10-1, 10-2, 10-3a, 10-3b, the normality / abnormality of the power (energy) source 100, 200 and the hybrid transmission unit 300 as the control object, and send the diagnostic results (OK / NG) 12-1, 12-2, 12-3a, 12-3b to the energy management ECU10-0.

[0100] In addition, when the energy management ECU 10-0 fails, the diagnosis result (OK / NG) 12-0 of the energy management ECU is sent to each ECU 10-1, 10-2, 10-3a, 10-3b, and each ECU 10-1, 10-2, 10-3a, 10-3b performs the operation according to the required torque 11 from the automatic driving control unit 1. Figures 17 to 26 The operation is similar to that of the embodiment shown.

[0101] Next, the actions in each case are shown in Figure 16 .

[0102] In case 0, when the diagnostic results 12-1, 12-2, 12-3a, and 12-3b are all OK, let ECU10-1 and 10-2 perform optimal control of the power (energy) sources 100 and 200 respectively through energy management, and let ECU10-3a and ECU10-3b control the operation of the hybrid transmission unit 300 through the output of the power (energy) sources 100 and 200.

[0103] In case 1, when only diagnostic result 12-1 is NG and the others are OK, ECU 10-1 stops the operation of power (energy) source 100 due to a lack of control, and instructs ECU 10-2 to control power (energy) source 200 based on required torque 11. Furthermore, ECUs 10-3a and 10-3b control the operation of hybrid transmission unit 300 using the output of power (energy) source 200.

[0104] In case 4, when the diagnosis results 12 - 1 and 12 - 2 are NG, the ECUs 10 - 1 and 10 - 2 stop the operation of the power (energy) sources 100 and 200 due to failure in control, and the ECUs 10 - 3 a and 10 - 3 b stop the operation of the hybrid transmission unit 300 .

[0105] In case 5, when only the diagnostic result 12-3a is NG and the others are OK, ECU10-1 and 10-2 respectively perform optimal control on the power (energy) sources 100 and 200 through energy management, and ECU10-3b controls the hybrid transmission unit 300 through the output of the power (energy) sources 100 and 200.

[0106] Figures 17-19 This is an example of the operation of the parallel hybrid drive system. Figure 17 As shown, control is performed to optimally distribute the output torques of the engine 110 and the motor 210 based on the required torque 11 and in combination with the SoC of the battery 213 and the like, and to deliver the output torque from the hybrid transmission unit 300 .

[0107] When the motor 210 or ECU 10-2 fails, Figure 18 As shown, control is performed such that the engine 110 delivers output torque from the hybrid transmission unit 300 according to the required torque 11. In this case, regenerative braking by the motor 210 is not possible, so during braking, braking torque is generated by mechanical braking or engine braking using the engine 110. For safety reasons, braking using a simple mechanical brake is ideal.

[0108] Then, when the engine 110 or the ECU 10-1 fails, Figure 19 As shown, control is performed such that the output torque is sent from the hybrid transmission unit 300 via the motor 210 in accordance with the required torque 11 .

[0109] In this case, regenerative braking can be performed by the motor 210. Therefore, during braking, the regenerative braking of the motor 210 and the mechanical brake are coordinated to generate a braking torque. In addition, for safety reasons, braking under a simple mechanical brake is more ideal.

[0110] In addition, when ECU10-0 fails, ECU10-1, ECU10-2, ECU10-3a, and ECU10-3b each make a judgment based on the required torque indicated by the automatic driving control unit 1 in an automatic driving vehicle and based on the required torque indicated by the driver's accelerator pedal opening in a conventional manual driving vehicle. Figure 18 、 Figure 19 Any one of the actions will do.

[0111] Figures 20-22 This is an example of the operation of a series hybrid drive system or a parallel-parallel hybrid drive system. Figure 20 As shown, control is performed to optimally distribute the electric energy from the engine-generator 120 and the battery 220 based on the required torque 11 and in combination with the SoC of the battery 220, and output energy (torque) is sent from the hybrid transmission unit 300.

[0112] When the battery 220 or ECU 10-2 fails, Figure 21 As shown, control is performed such that output energy (torque) is delivered from hybrid transmission unit 300 using the electric energy from engine-generator 120 in accordance with required torque 11. In this case, battery 220 cannot absorb regenerative power, so during braking, energy is absorbed through mechanical braking or engine braking using engine 121. To absorb energy through engine braking, methods are conceivable, such as engaging clutch CL1 to rotate engine 121 or using regenerative power generated by motor 321 to operate generator 122 as a motor via power converter 123 to rotate engine 121. Furthermore, for safety reasons, braking using simple mechanical braking is ideal.

[0113] When the engine-generator 120 or the ECU 10-1 fails, Figure 22As shown, control is performed such that output energy (torque) is delivered from hybrid transmission unit 300 using the electrical energy from battery 220 in accordance with the required torque 11. In this case, battery 220 can absorb regenerative power, so during braking, regenerative braking by motor 321 and mechanical braking work in coordination to generate braking torque. For safety reasons, simple mechanical braking is ideal.

[0114] In addition, when ECU10-0 fails, ECU10-1, ECU10-2, ECU10-3a, and ECU10-3b each make a judgment based on the required torque indicated by the automatic driving control unit 1 in an automatic driving vehicle and based on the required torque indicated by the driver's accelerator pedal opening in a conventional manual driving vehicle. Figure 21 、 Figure 22 Any one of the actions will do.

[0115] Figures 23-26 This is an example of the operation of the range extender. Under normal circumstances, the following control is performed: when the SoC of the battery 220 is low, such as Figure 23 As shown, the engine-generator 120 is used to generate electricity, and when the SoC is high, as shown in FIG. Figure 24 As shown, output energy (torque) is sent from the hybrid transmission unit 300 using electric energy from the battery 220 .

[0116] When the battery 220 or ECU 10-2 fails, Figure 25 As shown, control is performed such that output energy (torque) is delivered from hybrid transmission unit 300 using the electric energy from engine-generator 120 in accordance with required torque 11. In this case, battery 220 cannot absorb regenerative power, so during braking, energy is absorbed through mechanical braking or engine braking using engine 121. For safety reasons, braking using simple mechanical braking is ideal.

[0117] When the engine-generator 120 or the ECU 10-1 fails, Figure 26 As shown, control is performed such that output energy (torque) is delivered from hybrid transmission unit 300 using the electrical energy from battery 220 in accordance with the required torque 11. In this case, battery 220 can absorb regenerative power, so during braking, regenerative braking by motor 321 and mechanical braking work in coordination to generate braking torque. For safety reasons, simple mechanical braking is ideal.

[0118] In addition, when ECU10-0 fails, ECU10-1, ECU10-2, ECU10-3a, and ECU10-3b each make a judgment based on the required torque indicated by the automatic driving control unit 1 in an automatic driving vehicle and based on the required torque indicated by the driver's accelerator pedal opening in a conventional manual driving vehicle. Figure 25 、 Figure 26 Any one of the actions will do.

[0119] Example 6

[0120] use Figure 27 , Example 6 of the present invention will be described. The description of the same configurations as in Examples 1-5 will be omitted.

[0121] In the aforementioned embodiment 1, the ECU10-3 that controls the hybrid transmission unit 300 is set to a redundant structure of ECU10-3a and ECU10-3b. In contrast, this embodiment differs in the following aspects, namely, the ECU10-3 that controls the hybrid transmission unit 300 is not redundant. When ECU10-3 fails, the hybrid transmission unit 300 is controlled by ECU10-1 that previously controlled the power (energy) source 100 or ECU10-2 that previously controlled the power (energy) source 200, thereby achieving fault operability.

[0122] like Figure 27 As shown, in this embodiment, fail-safe operation (continuation of operation in the event of a failure) is achieved without redundant ECU 10-3. Specifically, as shown in the figure, in addition to ECU 10-3, which originally controls the hybrid transmission unit 300, a path is provided for ECU 10-2, which originally controls the power (energy) source 200, to control the hybrid transmission unit 300. In the event of a failure of ECU 10-3, the connection destination of ECU 10-2 is switched via SW1, allowing ECU 10-2, which previously controlled the power (energy) source 200, to control the hybrid transmission unit 300.

[0123] If ECU 10 - 3 fails, ECU 10 - 2 switches its function to implement the function of ECU 10 - 3 ECU 10 - 0 sends a control command to ECU 10 - 1 and ECU 10 - 2 so that the driving wheels 400 are controlled by the power of the power (energy) source 100 .

[0124] This embodiment focuses on redundancy in the hybrid system, which allows the vehicle to be driven as long as either power source 100 or power source 200 is still operative. In the event of a failure in ECU 10-3, which controls hybrid transmission unit 300, either ECU 10-1 or ECU 10-2 is used to control hybrid transmission unit 300. This allows for failover operation without redundantly implementing ECU 10-3, the control device that controls hybrid transmission unit 300. This embodiment achieves failover operation while reducing system cost.

[0125] As a further preferred example, ECU 10-4, a control unit that controls the energy input from power source 100 and power source 200 to hybrid transmission unit 300, is provided. If ECU 10-3 fails, ECU 10-4 controls hybrid transmission unit 300 to shut off energy transmission to the drive wheels. During a function switchover, where ECU 10-1 or ECU 10-2 serves as an alternative to ECU 10-3, there is a risk of sudden braking from power source 100 or 200, potentially causing driver discomfort. By controlling hybrid transmission unit 300 to shut off energy transmission via ECU 10-4, such sudden braking can be suppressed from being transmitted to the drive wheels, resulting in a smoother switching process, which is even more desirable.

[0126] Furthermore, a detailed embodiment of the control of the motor-driven relay, clutch, and solenoid valve for preventing unnecessary sudden braking and protecting coordination is shown in Example 11.

[0127] Example 7

[0128] use Figures 28 to 32 The seventh embodiment of the present invention will be described. The seventh embodiment is an embodiment in which the invention described in the sixth embodiment is applied to a parallel hybrid drive system. Explanations of the same configurations as in the second and sixth embodiments will be omitted.

[0129] like Figure 28 As shown, the vehicle control system in this embodiment has an engine 110 as a power (energy) source 100 , a power (energy) source 210 including a motor as a power (energy) source 200 , and a transmission 310 as a hybrid transmission unit 300 .

[0130] Connected to the transmission 310, serving as the hybrid transmission unit 300, is an ECU 10-2 that controls the power (energy) source 200, namely the motor 210, in addition to the ECU 10-3 that normally controls the transmission 310. ECU 10-2 includes a path for controlling the transmission 310 in addition to the path for controlling the motor 210. The connection destination can be changed using SW1. In the event of a failure in ECU 10-3, ECU 10-2 controls the transmission 310. Furthermore, the method for changing the control destination is not limited to SW1; various methods, such as changing the transmission address, are also possible.

[0131] Furthermore, in the case of a parallel hybrid, it is not possible to determine which of the ECUs 10 - 1 and 10 - 2 should take over the function of the ECU 10 - 3 that normally controls the transmission 310 when the ECU 10 - 3 fails.

[0132] As one method, a method of determining based on the battery's SoC (State of Charge) or the remaining fuel level is considered. If the battery's SoC (State of Charge) is sufficiently high and the remaining fuel level is low when ECU 10-3 fails, ECU 10-1, which controls engine 100 (110), can replace the function of ECU 10-3. If the battery's SoC (State of Charge) is low and the remaining fuel level is sufficient, ECU 10-2, which controls motor 200 (210), can replace the function of ECU 10-3. However, this method requires additional switching switches, wiring (network), execution program files, and memory so that both ECUs 10-1 and 10-2 can replace the function of ECU 10-3, resulting in increased costs.

[0133] Generally speaking, the remaining fuel level is often greater than the battery SoC (State of Charge). Therefore, as another method, when ECU 10 - 3 fails, ECU 10 - 2 that controls the motor 200 ( 210 ) can always replace the function of ECU 10 - 3.

[0134] According to this method, it is sufficient for ECU 10 - 2 to replace the function of ECU 10 - 3 , so compared with the previous method, it is possible to reduce switching switches, wiring (network), and program files to be executed, and also reduce costs.

[0135] In the image Figure 29 As shown, when the solenoid 311 driving the hydraulic valve of the transmission 310 is not redundant but is a single system, the solenoid 311 is driven via the OR circuit or the selector circuit SW2 based on control signals from the ECU 10 - 3 and ECU 10 - 2 .

[0136] On the other hand, in Figure 30 Even if solenoids 311a and 311b are provided redundantly as shown, ECU 10-3 can drive solenoid 311b, while ECU 10-2 can drive solenoid 311a. Alternatively, a selector circuit can be formed by the hydraulic circuit within transmission 310 (not shown). If ECU 10-3, which controls transmission 310, fails and ECU 10-2, which controls power source 200, controls transmission unit 300, even if the control objects are provided redundantly, the control objects controlled by ECU 10-1 or ECU 10-2 will not operate when ECU 10-3 is functioning normally, and the control objects controlled by ECU 10-3 will also not operate when ECU 10-3 fails, potentially reducing operational performance. Therefore, ideally, if ECU 10-3 and ECU 10-2 drive the redundantly provided control objects (solenoids 311a and 311b) via selector circuit SW2, both reliability and operational performance can be improved.

[0137] Figure 31 yes Figure 5 In the parallel hybrid drive system shown, the ECU that controls the control valve unit CVU is not made redundant but is replaced by another ECU.

[0138] In this embodiment, when the ECU 10-3 that originally controls the control valve unit CVU is normal, the ECU 10-3 controls the control valve unit CVU, and the ECU 10-2 controls the power converter 212. When a fault occurs in the ECU 10-3, the ECU 10-2 that originally controls the power converter 212 stops controlling the power converter 212 and controls the control valve unit CVU. As described above, according to this embodiment, the ECU that controls the control valve unit CVU is not made redundant but is replaced by another ECU, thereby allowing the automatic transmission AT to be controlled via the control valve unit CVU. As a result, even if the ECU 10-2 stops controlling the power converter 212 and stops driving the motor (or electric generator) 211, the drive wheel 400 can be driven by the driving force of the engine 100 (110) via the clutch CL1 and the automatic transmission AT. In addition, if the action of generating electricity by the motor (or electric generator) 211 using the driving force of the engine 110 is not performed when the vehicle is parked, it is also possible to Figure 32 As shown, the clutch CL2 is omitted.

[0139] Example 8

[0140] use Figures 33 to 40, the eighth embodiment of the present invention will be described. Furthermore, descriptions of the same configurations as in the third and sixth embodiments will be omitted. This embodiment applies the invention described in the sixth embodiment to a series hybrid drive system or a parallel-parallel hybrid drive system.

[0141] In this embodiment, an engine-generator 120 serves as a power (energy) source 100, a battery 220 serves as a power (energy) source 200, and an output-side motor (plus a power converter (inverter)) 320 serves as a hybrid transmission unit 300. The engine-generator 120 comprises an engine 121, a generator 122, and a power converter 123, while the output-side motor (plus a power converter (inverter)) 320 comprises an output-side motor (or electric generator) 321 and a power converter (inverter) 322.

[0142] In the image Figure 34 As shown, when the power converter (inverter) 322 driving the output-side motor 321 is not redundant but is a single system, the power converter (inverter) 322 is driven via the OR circuit or SW2 according to the control signal from ECU10-3 and ECU10-2.

[0143] On the other hand, in Figure 35 When the hybrid transmission unit 300 includes power converters (inverters) 322a and 322b in a redundant manner as shown, the ECU 10-3 and ECU 10-2 drive the power converters (inverters) 322a and 322b, respectively. Furthermore, the windings within the output-side motor 321 (not shown) may also be configured as redundant.

[0144] right Figure 34 and Figure 35 For comparison with the embodiment, Figure 35 In the embodiment of , the power converters (inverters) 322a and 322b are also redundant, so there is an advantage that they can continue to operate even when the power converter (inverter) fails. However, the power converter (inverter) 322a is only used when ECU10-3 is normal, and the power converter (inverter) 322b is only used when ECU10-3 is abnormal and ECU10-2 replaces its function, so the utilization efficiency of the power converter (inverter) is poor. In contrast, in Figure 34 In the embodiment of the present invention, the ECU to be controlled is switched by switching the switch SW2, so the power converter (inverter) 322 is always used when the ECU 10-3 is normal or abnormal, so the utilization efficiency of the power converter (inverter) is high. Figure 9In the embodiment shown, under normal circumstances, the ECUs 10-3a and 10-3b simultaneously control the power converters (inverters) 322a and 322b to achieve parallel operation of the outputs of the two units, so the utilization efficiency of the power converters (inverters) does not deteriorate.

[0145] Figure 36 This is an embodiment in which the ECU 10 - 1 and the ECU 10 - 3 respectively control the power converters (inverters) 322 a and 322 b to drive the output-side motor 321 .

[0146] ECU10-1 and ECU10-3 respectively control the power converter (inverter) 322a and 322b to drive the output side motor 321. When ECU10-3 is normal, ECU10-3 controls the power converter (inverter) 322b. When ECU10-3 fails, ECU10-1 controls the power converter (inverter) 322a to drive the output side motor 321.

[0147] In a series hybrid system or a parallel-parallel hybrid system, as an advantage of controlling the hybrid transmission unit 300 by the control device that controls the first power source 100, i.e., ECU10-1, when a failure occurs in ECU10-3, the shortening of the switching time can be cited. The reason for this is that the control of the power converter 123 of the first power source 100, i.e., the engine-generator 120, is very similar to the control of the power converter (inverter) 322a included in the hybrid transmission unit 300, so there is no need for a large function switch of ECU10-1, and the power converter (inverter) 322a can be controlled by ECU10-1 that originally controls the power converter 123 when a failure occurs in ECU10-3. Furthermore, in a case like Figure 34 When the power converter 322 is a single system as shown, the same effect as the redundant power converter 322 described above can be achieved by setting the power converter 322 of the hybrid transmission unit 300 to be controlled by ECU 10-1 when ECU 10-3 fails.

[0148] Figure 37 This is a more detailed embodiment of the present invention for a series hybrid drive system (including a range extender). The drive output shaft of engine 121 is mechanically connected to generator 122. The power terminals of generator 122 are connected to battery 220 and power converter (inverter) 322 via power converter 123. Power converter (inverter) 322 converts the power (DC) from power converter 123 and battery 220 into three-phase AC power to drive output-side motor (or motor generator) 321.

[0149] In this embodiment, ECU10-1 and ECU10-3 control the power converter (inverter) 322 via the switching switch SW2 to drive the output side motor 321. When ECU10-3 is normal, ECU10-3 controls the power converter (inverter) 322. When ECU10-3 fails, ECU10-1 controls the power converter (inverter) 322 to drive the output side motor 321.

[0150] Furthermore, if Figure 38 As shown, the drive output shaft mechanically connected to engine 121 and generator 122 can also be mechanically connected to the drive output shaft of output-side motor (or motor generator) 321 via clutch CL1. In this way, during high load conditions, the engine's drive output can be directly transmitted to drive wheels 400, thereby eliminating conversion losses caused by temporary conversion to electric power in cooperation with generator 122, power converter 123, power converter (inverter) 322, and output-side motor (or motor generator) 321. Furthermore, in this case, clutch CL1 is also controlled by ECUs 10-1 and 10-3 via switch SW2.

[0151] Figure 39 A more detailed embodiment of the present invention is provided for a series-parallel hybrid drive system. In this embodiment, ECU 10-1 and ECU 10-3 control a power converter (inverter) 322 via switch SW2 to drive an output-side motor 321. When ECU 10-3 is functioning normally, ECU 10-3 controls power converter (inverter) 322. When ECU 10-3 fails, ECU 10-1 controls power converter (inverter) 322 to drive output-side motor 321.

[0152] Furthermore, if Figure 40 As shown, the power split mechanism 124 and the output shaft of the output-side motor (or motor generator) 321 can also be mechanically connected via clutch CL1. This allows the engine 121 to be disconnected via clutch CL1 during high-speed, light-load cruising, thereby preventing the engine 121 from becoming a load and reducing losses. Furthermore, in this case, clutch CL1 is also controlled by ECUs 10-1 and 10-3 via switch SW2.

[0153] Example 9

[0154] use Figure 41 , Example 9 of the present invention is described.

[0155] Figure 41This embodiment integrates ECUs, using a common housing, circuit board, semiconductor chip, and other components for ECU 10-1 and ECU 10-3. This embodiment reduces common-cause failures between ECU 10-1 and ECU 10-2, as they are constructed using separate housings, circuit boards, and semiconductor chips. Furthermore, ECU 10-3 and ECU 10-2, which replaces ECU 10-2 in the event of a failure, also use separate housings, circuit boards, and chips, further reducing common-cause failures and enhancing redundancy.

[0156] Example 10

[0157] use Figure 42 , Example 10 of the present invention is described. Figure 42 This is an embodiment in which the ECUs 10 - 1 to 10 - 3 for controlling a series hybrid are integrated into an integrated ECU 10 - all.

[0158] When microcomputer core 10-3, which constitutes ECU 10-3, is functioning normally, microcomputer cores 10-1-1 and 10-1-2 constitute ECU 10-1, controlling power (energy) source 100. Specifically, microcomputer core 10-1-1 controls engine 121, while microcomputer core 10-1-2 controls generator 122. Similarly, microcomputer core 10-2 constitutes ECU 10-2, controlling power (energy) source 200, namely battery 210. Furthermore, microcomputer core 10-3 constitutes ECU 10-3, controlling transmission unit 300, namely output-side motor 321.

[0159] When the microcomputer core 10 - 3 fails, the microcomputer core 10 - 1 - 2 stops controlling the generator 122 and controls the transmission unit 300 , ie, the output-side motor 321 , instead of the microcomputer core 10 - 3 .

[0160] Ideally, ECUs 10-1, 10-2, and 10-3 are connected to the sensors and actuators connected to the controlled objects, namely, engine 121, generator 122, battery 210, and transmission unit 300, via an interface (I / F) via a network. Without networking, each line connected to the controlled objects, namely, engine 121, generator 122, battery 210, and transmission unit 300, requires a switch SW2. However, by connecting them via a network, as shown in the figure, the number of lines switched by SW2 can be significantly reduced.

[0161] In addition, as an installation method for the microcomputer cores constituting ECU10-1, 10-2, and 10-3, the microcomputer cores 10-1-1 and 10-1-2 constituting ECU10-1 can be constituted by the same chip, but from the perspective of the same fault countermeasures, the microcomputer core constituting ECU10-1 and the microcomputer core constituting ECU10-3 are preferably set as different chips. Similarly, the microcomputer core constituting ECU10-1 and the microcomputer core constituting ECU10-2 are preferably set as different chips.

[0162] Example 11

[0163] Figure 43 、 Figure 44 This embodiment of motor control is used to prevent unnecessary sudden braking and coordinate control output protection. In addition to control outputs 11-1, 11-2, and 11-3, the microcomputers constituting ECUs 10-1, 10-2, and 10-3 output control mode signals CNTL 12-1, 12-2, and 12-3, and the abnormality detection unit outputs abnormality detection results OK / NG 13-1, 13-2, and 13-3.

[0164] When ECU10-3 is normal and in motor control mode ( Figure 44 In S1), the microcomputer constituting the ECU 10-3 controls the transmission unit 300 (motor 321) while outputting the motor control mode (H) in the form of the control mode signal CNTL 12-3, and the abnormality detection unit outputs OK (H) in the form of the abnormality detection result OK / NG 13-3. In the event of a fault in the ECU 10-3 ( Figure 44 In S2), when the microcomputer can detect a fault, the non-motor control mode (L) is output as a control mode signal CNTL12-3. Even when the microcomputer cannot detect a fault, the abnormality detection unit outputs NG (L) as an abnormality detection result OK / NG13-3.

[0165] The microcomputer constituting the ECU 10-1 or 10-2 always monitors the control mode signal CNTL 12-3 and the abnormality detection result OK / NG 13-3. When the control mode signal CNTL 12-3 is the motor control mode (H) and the abnormality detection result OK / NG 13-3 is OK (H), the originally allocated power (energy) source 100 or power (energy) source 200 is controlled ( Figure 44 S1 in ECU10-3. Figure 44When the control mode signal CNTL12-3 changes to the non-motor control mode (L) or the abnormality detection result OK / NG13-3 changes to NG (L), the control of the originally allocated power (energy) source 100 or power (energy) source 200 is stopped, and the preparation for the control of the transmission unit 300 (motor 321) (specifically, downloading the program, initialization, etc.) is started ( Figure 44 S3 in ).

[0166] After the preparation for controlling the transmission unit 300 (motor 321) is completed, the ECU 10-1 or 10-2 starts controlling the transmission unit 300 (motor 321) and changes the control mode signal CNTL 12-1 or 12-2 from the non-motor control mode (L) to the motor control mode (H). When the ECU 10-1 or 10-2 is normal, the abnormality detection function outputs OK (H) in the form of abnormality detection results OK / NG 13-1 or 13-2. Figure 44 S4 in ).

[0167] SW2, which selects the control input to converter 322, is controlled by the control mode signal CNTL12-3 and the abnormality detection result OK / NG13-3 or the control mode signal CNTL12-1, 12-2 and the abnormality detection results OK / NG13-1, 13-2, and operates by selecting the output of the ECU where any one of the items is H. Figure 43 In the example, the control mode signal CNTL 12-3 and the abnormality detection result OK / NG 13-3 are both H, and the control output 11-3 is selected to operate.

[0168] SW3, which switches the phase output of inverter 322, and SW4, which controls the power supply to inverter 322, are turned on when both control mode signal CNTL 12-3 and abnormality detection result OK / NG 13-3 are high, or when both control mode signals CNTL 12-1, 12-2 and abnormality detection results OK / NG 13-1, 13-2 are high, enabling inverter 322 to drive output-side motor 321. With the above-described embodiment, inverter 322 can drive output-side motor 321 only when either ECU 10-3 or ECUs 10-1, 10-2 is in motor control mode, meaning it is capable of driving output-side motor 321, and the abnormality detection result is on, meaning it is normal. This prevents a situation where an abnormal ECU or an ECU that has not yet completed motor control preparations controls inverter 322 and drives output-side motor 321.

[0169] The above describes the embodiment of the protection coordination of the control output of the output side motor 321 of the series hybrid or parallel hybrid drive system, and the parallel hybrid drive system is also controlled in the same way. Figure 45 As shown, the power converter 322 may be replaced by the solenoid driver 320 , and the output-side motor 321 may be replaced by the transmission 310 and the clutches CL1 and CL2 .

[0170] As described above, according to the present invention, the control unit of the transmission unit that mixes the power (energy) from different power (energy) sources equipped in the hybrid drive system and transmits the energy to the drive wheels is set to a redundant structure, thereby, even if a certain control unit constituting the hybrid drive system fails, the system as a whole can continue to operate. For example, even when a power (energy) source or the control unit of the power (energy) source fails, the operation can be continued by controlling the transmission unit in a manner that the transmission unit transmits energy to the drive wheels with the help of power (energy) from another power (energy) source. In addition, by making the control unit of the transmission unit, which is a single failure point of the system as a whole, have the function of continuing operation in the event of a failure, the control of the transmission unit can continue even if the control unit of the transmission unit fails, so that the system as a whole can continue to operate, that is, achieve failure operability.

[0171] By treating the different power (energy) sources equipped in the hybrid drive system as redundant power (energy) sources, there is no need for further redundancy, and the fault operability of the hybrid drive system can be achieved with minimal redundancy, thereby achieving both the realization of operation continuity in the event of a fault and cost reduction.

[0172] Explanation of symbols

[0173] 100, 200…power (energy) source, 300…hybrid transmission unit, 400…drive wheels, 10…electronic control unit ECU.

Claims

1. A vehicle control system, characterized in that: have: a transmission portion that transmits energy to the drive wheels; a first control unit configured to control the transmission unit; a first source for inputting energy into the transmission portion; a second source for inputting energy into the transmission portion; a second control unit that controls the first source; and a third control unit that controls the second source, When the first control unit fails, the second control unit or the third control unit controls the transmission unit. further comprising a fourth control unit configured to control energy input from the first source and the second source to the transmission unit, When the first control unit fails, the fourth control unit sends a command to the transmission unit to shut down the transmission of energy to the drive wheels while the second control unit or the third control unit is switching functions.

2. The vehicle control system according to claim 1, characterized in that: The fourth control unit controls to input only the energy from the second source to the transmission unit when the first source or the second control unit fails. When the second source or the third control unit fails, control is performed such that only the energy from the first source is input to the transmission unit.

3. The vehicle control system according to any one of claims 1 to 2, characterized in that: The invention relates to a series hybrid vehicle in which the transmission unit includes a motor and an inverter, the first source includes an engine and a generator, and the second source is a battery.

4. The vehicle control system according to claim 3, characterized in that: When the first control unit fails, the second control unit controls the transmission unit. The transmission unit shuts off the energy transmission to the drive wheels by turning off a relay.

5. The vehicle control system according to claim 4, characterized in that: The first control unit is implemented by a first microcomputer, the second control unit is implemented by a second microcomputer that controls the engine and a third microcomputer that controls the generator, and the vehicle control system includes a control device having the first microcomputer, the second microcomputer, and the third microcomputer. When the first microcomputer fails, the third microcomputer controls the transmission unit.

6. The vehicle control system according to claim 5, characterized in that: The first microcomputer and the third microcomputer are driven by different power supply ICs to implement countermeasures against common cause failures.

7. The vehicle control system according to any one of claims 1 to 2, characterized in that: The parallel hybrid vehicle is as follows: the transmission unit is a transmission, the first source is an engine, and the second source includes a battery and a motor.

8. The vehicle control system according to claim 7, characterized in that: When the first control unit fails, the third control unit controls the transmission unit. The transmission unit shuts off the energy transmission to the drive wheels by disengaging a clutch.

9. The vehicle control system according to any one of claims 1 to 2, characterized in that: The invention is a series-parallel hybrid power system in which the transmission unit is a motor, the first source includes an engine and a generator, and the second source is a battery.

10. A vehicle control device, mounted in a vehicle, comprising: a transmission unit that transmits energy to a drive wheel; a first control unit that controls the transmission unit; a first source that inputs energy to the transmission unit; a second source that inputs energy to the transmission unit; a second control unit that controls the first source; and a third control unit that controls the second source, wherein the vehicle control device is characterized in that: When the first control unit fails, a command is sent to the second control unit or the third control unit to control the transmission unit. further comprising a fourth control unit configured to control energy input from the first source and the second source to the transmission unit, When the first control unit fails, the fourth control unit sends a command to the transmission unit to shut down the transmission of energy to the drive wheels while the second control unit or the third control unit is switching functions.

11. The vehicle control device according to claim 10, characterized in that: When the first source is installed in a series hybrid or parallel hybrid vehicle including an engine and a generator, When a failure occurs in the first control unit, a command for controlling the transmission unit is sent to the second control unit.

12. The vehicle control device according to claim 10, characterized in that: When the transmission unit is a transmission, the first source is an engine, and the second source includes a battery and a motor, the vehicle is mounted on a parallel hybrid vehicle. When a failure occurs in the first control unit, a command for controlling the transmission unit is sent to the third control unit.

13. The vehicle control device according to any one of claims 10 to 12, characterized in that: controlling energy input from the first source and the second source to the transmission unit, When the first control unit fails, control is performed so that energy is input to the transmission unit only by the second source.

Images