Electronic control unit

Abstract

Electronic control unit attached to a vehicle for controlling a predetermined control target, which features: a control unit (22) configured to a control mode is determined from a variety of control modes that specify the control types of the control target, and the steering target is controlled, and a monitoring unit (24) configured to monitor the control unit, where: the monitoring unit features: a determination unit (51) configured to determine whether an abnormality has occurred in the control unit, an estimation unit (52) configured to estimate as one of the estimated control modes the control mode determined by the control unit, and an implementation unit (53) configured to perform a fail-safe control, which is different for each estimated control mode, in response to the determination that the abnormality has occurred in the control unit.

Description

Technical area

[0001] The present invention relates to a technique for monitoring a vehicle abnormality or vehicle irregularity. background

[0002] The following JP 2008 - 226 043 A, for example, discloses a technique which, using a monitoring IC that is different from a microcomputer, detects whether an abnormality has occurred in the microcomputer that monitors a vehicle.

[0003] Furthermore, methods and systems for monitoring a control unit in a vehicle are known from DE 10 2015 221 532 B4 and US 5 980 081 A. DE 10 2015 221 532 B4 discloses, among other things, that the control unit includes a monitoring section with an abnormality detection section and a fail-safe section. US 5 980 081 A discloses that a monitoring process of a subordinate CPU executes a monitoring subroutine based on external data to check whether a main CPU is functioning correctly. Summary

[0004] In the technique described above, the microcomputer is configured to determine a control mode and execute control within that mode. A detailed study by the inventor revealed the following problem: In the described technique, the monitoring IC is unable to assume the control mode if an abnormality occurs in the microcomputer, thus making it difficult to implement fail-safe control according to the selected mode.

[0005] The object of the present invention is to provide a technique for estimating a control mode and for implementing fail-safe control according to the estimated control mode when an abnormality occurs in a microcomputer that controls a vehicle. This object is achieved by the features of the independent claim. Advantageous embodiments of the invention are described in the dependent claims.

[0006] According to an example of the present invention, an electronic control unit mounted on a vehicle is provided for controlling a predetermined control target by comprising a control unit and a monitoring unit. The control unit is configured to determine a control mode from among a plurality of control modes, which specify a type or form of control of the control target, and to control the control target. The monitoring unit is configured to monitor the control unit.The monitoring unit includes a determination unit configured to determine whether an abnormality has occurred in the control unit, an estimation unit configured to estimate the one control mode determined by the control unit, and an implementation unit configured to perform a fail-safe control, which is different for each estimated control mode, in response to the determination that an abnormality has occurred in the control unit.

[0007] With such a configuration, the monitoring unit can estimate the control mode by the control unit using the estimating unit. As a result, the monitoring unit can perform failover control according to the estimated control mode if an abnormality occurs in the control unit. Brief description of the characters

[0008] The above and other objects, features and advantages of the present invention are clarified by the following detailed description, which is made with reference to the accompanying figures. These show: Fig. 1 a block diagram representing a configuration of an ECU according to a first embodiment, Fig. 2 an explanatory diagram illustrating control modes, Fig. 3. An explanatory diagram illustrating operating modes through a monitoring IC, and Fig. 4 a block diagram representing a configuration of an ECU according to a second embodiment. Detailed description

[0009] Exemplary embodiments of the present invention are described below with reference to the figures. In this description, "the same" is not limited to the same in an exact scope and may not represent exactly the same thing, provided the same effect is obtained. [1. First embodiment][1-1. Configuration] <gesamtaufbau>

[0010] An electronic control unit (hereinafter referred to as ECU) according to an embodiment to which the present invention is applied is installed on a vehicle and controls a predetermined control target. The ECU of the present invention serves, for example, to control an engine mounted on a vehicle, as a control target.

[0011] The ECU 10 according to the first embodiment implements a control function for determining control quantities of a multitude of actuators for operating the motor based on status signals that are input, for example, from various sensors and various devices.

[0012] The status signals are signals input into the ECU 10 and are various signals that indicate the vehicle's status. The vehicle's status refers to its operating state. For example, the status signal can include a signal indicating the requested torque and an engine speed signal. The requested torque signal indicates the torque demanded. Requested torque is the torque delivered by the engine in response to a driver demand. The requested torque can be specified, for example, using a predefined map or similar, based on the engine speed and accelerator pedal opening (which indicates the driver's degree of accelerator pedal depressor).

[0013] The engine speed signal is a signal that indicates the engine speed. The engine speed can be specified, for example, by a crankshaft angle based on a measurement from a crankshaft angle sensor and a camshaft angle sensor (not shown).

[0014] The vehicle's state, indicated by the status signal, is detected by a device other than ECU 10. A status signal is generated and input into ECU 10. ECU 10 is connected to the other devices via a communication line. It should be noted that various sensors for detecting the vehicle's state, as indicated by the status signal, can be connected to ECU 10 via a communication line. The vehicle's state can be detected by ECU 10, and the status signal can be generated by ECU 10.

[0015] The motor is controlled by a plurality of actuators. The plurality of actuators comprises a first actuator and a second actuator, which is different from the first actuator. In the present embodiment, the electronic throttle 31 corresponds to a first actuator and the injector 32 corresponds to a second actuator.

[0016] The electronic throttle 31 is provided in an intake tract to a cylinder (not shown). It adjusts the throttle opening degree according to the quantity and polarity of the excitation current supplied to the electronic throttle 31 and controls the amount of air drawn into the cylinder. The excitation current for driving or actuating the electronic throttle 31 is supplied by a first drive device 61, which will be described later. When the excitation current is 0, the electronic throttle 31 maintains the throttle opening degree at a small opening of a few degrees (hereinafter referred to as an initial opening), and a small amount of air is drawn into the cylinder.

[0017] Injector 32 is located in an intake manifold (not shown) closer to the cylinder than the electronic throttle 31. Injector 32 adjusts the amount of fuel injected into the cylinder according to the amount and duration of the excitation current supplied to injector 32. The excitation current for driving injector 32 is supplied by a second drive device 62, which will be described later. When the excitation current is zero, injector 32 does not operate and no fuel is injected into the cylinder. <Konfiguration der ECU 10>

[0018] As in Fig. As shown in Figure 1, the ECU 10 has an input unit 21, a microcomputer 22, an output unit 23 and a monitoring IC 24.

[0019] The input unit 21 is a circuit into which the state signal described above is input from outside the ECU 10. The microcomputer 22 determines at least one control mode from a plurality of control modes, which specify a control method for a given control target (i.e., the motor), and controls the control target (i.e., the motor) in the selected control mode. The microcomputer 22 generates a plurality of control signals for controlling the control target (i.e., the motor) according to the control mode. The plurality of control modes includes a first control mode and a second control mode.

[0020] The multitude of control signals comprises a first control signal S1 and a second control signal S2. The first control signal S1 is a signal to drive the electronic choke 31, which is a first actuator. The second control signal S2 is a signal to drive the injector 32, which is a second actuator. The first control signal S1 and the second control signal S2 are each output by the output unit 23. Details of the microcomputer 22 will be described later.

[0021] The output unit 23 has a plurality of drive devices. The plurality of drive devices includes a first drive device 61 and a second drive device 62. Based on the first control signal S1, the first drive device 61 outputs a drive signal (hereinafter referred to as the first drive signal) D1 to drive the electronic choke 31, which is a first actuator. The first drive signal D1 relates in particular to the excitation current that drives the electronic choke 31, as described above.

[0022] The first drive device 61 further stops the output of the first drive signal D1 to the electronic choke 31 according to a first fail-safe signal C1, which is output by the monitoring IC 24. For example, the first drive device 61 stops the output of the first drive signal D1 to the electronic choke 31 according to the first fail-safe signal C1, which indicates the high level of the two values, high level and low level.

[0023] The second drive device 62 outputs a drive signal (hereinafter referred to as the second drive signal) D2 to drive the injector 32, which is a second actuator, based on the second control signal S2. The second drive signal D2 relates in particular to an excitation current that drives the injector 32 as described above.

[0024] The second drive device 62 further stops the output of the second drive signal D2 to the injector 32 according to a second fail-safe signal C2, which is output by the monitoring IC 24. For example, the second drive device 62 stops the output of the second drive signal D2 to the injector 32 according to the second fail-safe signal C2, which indicates the high level of the two values, high level and low level.

[0025] The monitoring IC 24 is an IC that monitors the operation of the microcomputer 22. Details of the monitoring IC 24 will be described later. <Konfiguration des Mikrocomputers 22>

[0026] The microcomputer 22 comprises a CPU 101 and a semiconductor memory (hereinafter referred to as memory) 102, such as RAM, ROM, or flash memory. The ECU 10 implements each function described later through the CPU 101, which executes a program stored in a non-transient physical storage medium. The memory 102 corresponds to a non-transient physical storage medium that stores a computer program. Executing this computer program further executes a procedure according to the computer program. The microcomputer 22 implements various functions for controlling the motor.

[0027] The ECU 10 has in particular the functions of a target control unit 41, an inspection unit 42 and a management unit 43, as shown in Fig. Figure 1 shows the following. The target control unit 41 selects a control mode from the plurality of control modes and controls the target in the selected control mode. The control mode specifies a type of control of the target. In the present embodiment, where the target is an engine, the plurality of control modes are control modes that implement different air-fuel ratios. Stoichiometric control corresponds to a first control mode, and lean-burn control corresponds to a second control mode.

[0028] The target control unit 41 receives a multitude of status signals and, based on these signals, determines a control mode from the multitude of control modes described above through a predefined processing procedure. In this embodiment, the signal for the requested torque and the motor speed signal correspond to a multitude of status signals for determining a control mode.

[0029] Memory 102 can, for example, store a characteristic map in which the requested torque, specified by the requested torque signal, the motor speed, specified by the motor speed signal, and the control mode are combined, as in Fig. 2 shown, linked. The target control unit 41 determines one of the controls, stoichiometric control and lean combustion control, as a control mode through processing that uses such a characteristic map.

[0030] The target control unit 41 then generates the first control signal S1 and the second control signal S2 such that the control quantities of the electronic throttle 31 and the injector 32 become the control quantities according to the specified control mode.

[0031] The target control unit 41 outputs the first control signal S1 to the first actuator 61. As a result, the first actuator signal D1 is output to the electronic throttle 31 based on the first control signal S1, causing the electronic throttle 31 to operate according to the control mode. The target control unit 41 outputs the second control signal S2 to the second actuator 62. As a result, the second actuator signal D2 is output to the injector 32 based on the second control signal S2, causing the injector 32 to operate according to the control mode. In this way, the target control unit 41 controls the output of actuator signals that drive a plurality of actuators (i.e., the electronic throttle 31 and the injector 32) according to the one control mode determined from the plurality of control modes.

[0032] Furthermore, when the target control unit 41 receives a test signal transmitted by the inspection unit 42 described below, the target control unit 41 performs a test according to the question or request contained in the test signal. The target control unit 41 thus transmits a response signal, which represents the result of the execution, to the inspection unit 42.

[0033] The inspection unit 42 transmits the test signal described above to the target control unit 41 in a predefined cycle and receives a response signal to the question contained in the test signal. The question is predetermined to prompt the target control unit 41 to perform a test in accordance with the question to verify the function of the target control unit 41.

[0034] The management unit 43 generates a test result signal indicating the response present in the response signal and transmits the generated test result signal to the monitoring IC 24. In this way, the inspection unit 42 and the management unit 43 transmit a signal (i.e., a test result signal) to the monitoring IC 24 to determine whether the target control unit 41 has an abnormality.

[0035] If an abnormality occurs in the target control unit 41, the vehicle is brought into a safe state (i.e., a failsafe state). The failsafe state is a state in which the vehicle's safety is maintained even if an abnormality occurs in the vehicle. In the present embodiment, if an abnormality occurs in the target control unit 41 (i.e., in the microcomputer 22), the monitoring IC 24, which will be described later, can implement different failsafe states depending on the control modes. The failsafe state that can be implemented in each control mode is described below.

[0036] In stoichiometric control, the target control unit 41 generates the first control signal S1 and the second control signal S2 to drive the electronic throttle 31 and the injector 32 so that the air-fuel ratio becomes, for example, 14-15 A / F when the microcomputer 22 is operating normally. Stoichiometric control is a control system in which a relatively large amount of fuel is injected through the injector 32 and a relatively large amount of air, corresponding to the indicated amount of fuel, is drawn in through the electronic throttle 31.

[0037] If, for example, the amount of supplied air is reduced during stoichiometric control, it becomes difficult to maintain combustion and explosion in the engine according to the amount of fuel injected by injector 32. As a result, the drive output is limited to maintain a safe state in which vehicle operations not intended or desired by the driver, such as sudden acceleration, are suppressed. At the very least, the vehicle can then be driven. The state in which the drive output is limited and the vehicle can drive in this manner as far as possible is called coasting.

[0038] This means that if an abnormality occurs in the microcomputer 22 during stoichiometric control, the fail-safe state (i.e., the retraction) is implemented by reducing the amount of intake air. Specifically, the retraction is achieved, as described below, by stopping the output of the first drive signal D1.

[0039] In lean combustion control, on the other hand, the target control unit 41 generates the first control signal S1 and the second control signal S2 to drive the electronic throttle 31 and the injector 32 so that the air-fuel ratio becomes 18-30 A / F when the microcomputer 22 is operating normally. In lean combustion control, a relatively small amount of fuel is injected through the injector 32, and a relatively small amount of air, corresponding to the indicated amount of fuel, is drawn in through the electronic throttle 31. That is, the control is carried out in such a way that explosion and combustion within the engine can be achieved with a relatively small amount of air.

[0040] Even if, for example, the amount of intake air is further reduced in lean-burn control, combustion can still occur in the engine, and power output can increase with a small amount of injected fuel. In lean-burn control, the engine is stopped by reducing the amount of intake air and then further stopped by cutting off the fuel supply, causing the engine to stall. As a result, power output is cut off.

[0041] This means that if an abnormality occurs in microcomputer 22 during lean combustion control, the amount of intake air is reduced and the fuel supply is stopped, thus bringing about the failsafe condition (i.e., engine shutdown). Specifically, engine shutdown is achieved, as described below, by stopping the output of both signals: the first drive signal D1 and the second drive signal D2. <Konfiguration des Überwachungs-IC 24>

[0042] The monitoring IC 24 monitors the operation of the microcomputer 22, estimates the control mode of the microcomputer 22 when an abnormality is detected in the microcomputer 22, and performs failover control according to the control mode of the microcomputer 22. The failover control is a control mechanism for implementing the failover state when an abnormality occurs in the vehicle (for example, in the microcomputer 22). The monitoring IC 24 specifically includes the functions of a determination unit 51, an estimation unit 52, and an implementation unit 53, as described in Fig. 1 shown, on.

[0043] The determination unit 51 receives the test result signal from the microcomputer 22 and compares the test result signal with the expected value. This determines whether the microcomputer 22 is normal or abnormal, and a determination signal indicating the determination result is output by the implementation unit 53.

[0044] The determination unit 51 can, for example, determine that the microcomputer 22 is functioning normally if the test result signal and the expected value match. The expected value is pre-stored in a memory (not shown) located in the monitoring IC 24. Alternatively, the determination unit 51 can determine that the microcomputer 22 is functioning normally if the test result signal and the expected value do not match.

[0045] The determination signal can be a signal that differs for each determination result. In the present embodiment, the determination unit 51 outputs a signal indicating a low level as a determination signal when it is determined that the micrometer 22 is normal, while a signal indicating a high level is output as a determination signal when it is determined that the microcomputer 22 is abnormal.

[0046] The estimating unit 52 acquires at least one state signal and estimates the control mode described above, which is executed by the microcomputer 22 (i.e., the target control unit 41), using the predefined processing based on the acquired state signal. In the present embodiment, the estimating unit 52 acquires the same state signal as that of the microcomputer 22 (i.e., the target control unit 41) and performs the same processing as that of the microcomputer 22 (i.e., the target control unit 41) based on the acquired state signal in order to estimate the control mode determined by the microcomputer 22.

[0047] In this embodiment, the estimation unit 52 receives, in particular, the signal via the requested torque and the engine speed signal. Based on these state signals, the estimation unit 52 estimates one of the control systems, stoichiometric control and lean combustion control, by processing the data contained in Fig. The characteristic map shown is used as a control mode determined by the target control unit 41. The characteristic map is pre-stored in a memory (not shown) located in the monitoring IC 24.

[0048] Hereinafter, the control mode estimated by the estimating unit 52, and estimated to be determined by the target control unit 41 (i.e., the microcomputers 22), is referred to as an estimated control mode. The estimating unit 52 outputs a signal indicating the estimated control mode to the implementation unit 53. The signal indicating the estimated control mode can be different for each estimated control mode. In the present embodiment, the estimating unit 52 outputs a signal indicating a high level as an estimated control mode signal when the estimated control mode is stoichiometric control, and outputs a signal indicating a low level as an estimated control mode signal when the estimated control mode is lean combustion control.

[0049] If the microcomputer 22 is determined to have an abnormality, the implementation unit 53 performs a different failover control for each estimated control mode estimated by the estimating unit 52. In cases where the microcomputer 22 is determined to have an abnormality, the implementation unit 53 performs the following controls. That is, if the estimated control mode is the first control mode (i.e., stoichiometric control), the electronic throttle 31 is controlled by a failover control. Conversely, if the determined mode is the second control mode (i.e., lean combustion control), both units, electronic throttle 31 and injector 32, are controlled by a failover control.

[0050] In cases where, as in Fig. As shown in Figure 3, and in particular as determined that the microcomputer 22 is anomalous, the implementation unit 53 operates as follows. That is, if the estimated control mode is stoichiometric control, the first failover signal C1, indicating a high level, is output to the first drive device 61 as a failover control signal. Furthermore, the second failover signal C2, indicating a low level, is output to the second drive device 62. As a result, the output of the first drive signal D1 to the electronic throttle 31 is stopped, and the output of the second drive signal D2 to the injector 32 is not stopped (i.e., it continues to be output).

[0051] If, furthermore, it is determined that the microcomputer 22 is malfunctioning, the implementation unit 53 operates as follows. That is, if the estimated control mode is lean combustion control, the first failover signal C1, indicating a high level, is output to the first drive unit 61 as a failover control signal. Additionally, the second failover signal C2, also indicating a high level, is output to the second drive unit 62. As a result, the output of the first drive signal D1 to the electronic throttle 31 is stopped, and the output of the second drive signal D2 to the injector 32 is stopped. [1-2. Operation]

[0052] The vehicle's condition, based on the monitoring of the configured monitoring IC 24, is determined with reference to Fig. 3 described. (Plant 1)

[0053] If the determining unit 51 determines that the microcomputer 22 is functioning normally, regardless of the type of control mode estimated by the estimating unit 52, the implementation unit 53 outputs the first fail-safe signal C1, indicating a low level, to the first drive unit 61. Additionally, the implementation unit 53 outputs the second fail-safe signal C2, also indicating a low level, to the second drive unit 62. That is, the output stop of the first drive unit 61 is deactivated, and the output stop of the second drive unit 62 is deactivated.

[0054] Accordingly, the electronic throttle 31 and the injector 32 perform normal operation (hereinafter referred to as normal operation) according to the first drive signal D1 and the second drive signal D2 according to the control mode.

[0055] As a result, the vehicle drives normally according to the control mode (hereinafter referred to as normal driving). (Plant 2)

[0056] If the determination unit 51 determines that the microcomputer 22 is malfunctioning, the implementation unit 53 operates as follows. That is, if the control mode estimated by the estimation unit 52 is stoichiometric control, the implementation unit 53 outputs the first fail-safe signal C1, indicating a high level, to the first drive unit 61. Furthermore, the implementation unit 53 outputs the second fail-safe signal C2, also indicating a high level, to the second drive unit 62. This activates the output stop of the first drive unit 61 and deactivates the output stop of the second drive unit 62.

[0057] As a result, the electronic throttle 31 is held in the initial opening position, and the injector 32 operates normally according to the second drive signal D2 in the control mode. This means that, since the specified air volume is limited in the stoichiometric control, the vehicle's emergency shutdown is implemented. (Plant 3)

[0058] If the determining unit 51 determines that the microcomputer 22 is abnormal, the implementation unit 53 operates as follows. If the control mode estimated by the estimating unit 52 is lean combustion control, the implementation unit 53 outputs the first fail-safe signal C1, indicating a high level, to the first drive unit 61. Furthermore, the implementation unit 53 outputs the second fail-safe signal C2, also indicating a high level, to the second drive unit 62. That is, the output stop of the first drive unit 61 is activated, and the output stop of the second drive unit 62 is activated.

[0059] As a result, the electronic throttle 31 is held in its initial opening position and the injector 32 stops the fuel supply. This means that, since the air volume is limited and the fuel supply is stopped in lean combustion mode, the engine is shut down in the failsafe state. [1-3. Effects]

[0060] According to the first embodiment described in detail above, the following effects can be obtained. (1a) In a known device, the control mode of the vehicle is determined, for example, by a control device that controls the vehicle. If an abnormality occurs in the control device, it is difficult to specify the control mode in a device other than the control device. That is, it is difficult to implement fail-safe control according to the control mode.

[0061] In the present embodiment, the estimation unit 52 in the monitoring IC 24 estimates the control mode executed by the microcomputer 22, even if the microcomputer 22 exhibits an anomaly. If an anomaly occurs in the microcomputer 22, this makes it possible to implement different failover controls depending on the control modes. That is, it is possible to implement more detailed failover controls for each control mode.

[0062] (1b) In the monitoring IC 24, the estimating unit 52 estimates the control mode determined by the microcomputer 22 based on the same processing as that performed by the microcomputer 22, using the same state signal as that of the microcomputer 22. The implementation unit 53 then performs the failover control in a different mode for each estimated control mode estimated in this way.

[0063] As a result, the estimation accuracy of the estimated control mode is improved compared to the case where the estimated control mode is estimated based on the state signal, which differs from that of microcomputer 22, and where the estimated control mode is estimated based on the processing, which differs from that of microcomputer 22. Since the failover control is then executed based on the improved estimated control mode, the failover control can be executed in a way that maintains the safety of the vehicle.

[0064] (1c) In the monitoring IC 24, the implementation unit 53 can perform the control (i.e., the stop control) for the electronic throttle 31, which is one of the units, electronic throttle 31 and injector 32, as a fail-safe control during stoichiometric control, i.e., the first control mode. The implementation unit 53 can further perform a control (i.e., a stop control) for both units, electronic throttle 31 and injector 32, as a fail-safe control during lean combustion control, which is the second control mode. As a result, the different fail-safe controls can be performed depending on the respective control modes.

[0065] (1d) If it is determined that the microcomputer 22 is abnormal, the implementation unit 53 can operate as follows. If the estimated control mode is stoichiometric control, the control can be implemented as a failsafe to stop the output of the first drive signal D1 to the electronic throttle 31. As a result, it is possible to implement failsafe control to limit the drive output and to implement the reverse travel according to the estimated control mode. That is, it is possible to implement failsafe control that maintains the safety of the vehicle and allows the vehicle to travel as far as possible according to the estimated control mode, thus improving the commercialization of the vehicle.

[0066] (1e) If it is determined that the microcomputer 22 is abnormal, the implementation unit 53 can operate as follows. If the estimated control mode is lean combustion control, the output of the first drive signal D1 to the electric choke 31 and the output of the second drive signal D2 to the injector 32 can be stopped. This allows failover control to stop the vehicle according to the estimated control mode. That is, it is possible to perform failover control where switching to a safe state of the vehicle is assigned the highest priority according to the estimated control mode. [2. Second embodiment][2-1. Configuration]

[0067] Since the basic configuration of a second embodiment is the same as that of the first embodiment, differences are described below. The same reference numerals are assigned to the same elements as in the first embodiment, and reference is made to the preceding description.

[0068] In the first embodiment described above, the monitoring IC 24 comprises the determination unit 51, the estimation unit 52, and the implementation unit 53. In the second embodiment, on the other hand, the monitoring IC 24 differs, as shown in Fig. 4 shown, from the first embodiment in that the monitoring IC 24 further comprises a special stop unit 54.

[0069] Furthermore, unlike the first embodiment, the status signal input to the ECU 10 includes an A / F signal. The A / F signal indicates the actual air-fuel ratio, measured using an A / F sensor located on the engine's exhaust side.

[0070] The first drive device 61 and the second drive device 62 stop their output when at least one low-level failover signal is input. That is, even if a multitude of failover signals are input, the first drive device 61 and the second drive device 62 will stop output if at least one of them is at a low level.

[0071] The microcomputer 22 according to the second embodiment has the same configuration as the microcomputer 22 according to the first embodiment. That is, the target control unit 41 determines the control mode as described above and outputs the first control signal S1 and the second control signal S2 to control the electronic throttle 31 and the injector 32 according to the determined control mode. The inspection unit 42 and the management unit 43 generate the test result signal as described above and output the test result signal as a monitoring signal to the monitoring IC 24. The monitoring signal is a signal that is used to determine whether the microcomputer 22 is functioning normally.

[0072] In the monitoring IC 24 according to the second embodiment, the determination unit 51 determines, as described above, whether the microcomputer 22 is abnormal, based on the test result signal, and outputs the determination result to the implementation unit 53. The estimation unit 52 specifies the estimated control mode, as described above. In the present embodiment, however, the estimation unit 52 outputs the signal about the estimated control mode to the implementation unit 53 and the special stop unit 54. The implementation unit 53 outputs the first failover signal C1 and the second failover signal C2, as described above.

[0073] If the estimated control mode and the control mode specified by the air-fuel ratio indicated by the A / F signal do not match, the special stop unit 54 determines that the determination result by the determination unit 51 is incorrect or false and performs a control action to stop the engine. Here, the condition in which the determination result by the determination unit 51 is incorrect exhibits at least one of the cases: the case in which the microcomputer 22 is abnormal, and the case in which the determination unit 51 is abnormal. This is because, when the microcomputer 22 and the determination unit 51 are abnormal, the estimated control mode and the control mode specified by the air-fuel ratio indicated by the A / F signal are essentially identical.

[0074] The special stop unit 54 specifies, in particular based on a predefined characteristic map, correspondence information, a calculation formula, or the like, which of the many control modes executed by the microcomputer 22 will realize the air-fuel ratio indicated by the A / F signal. Correspondence information that links or associates the value of the A / F signal with one of the control modes, stoichiometric control and lean combustion control, can be stored in the monitoring IC 24.

[0075] The special stop unit 54 uses, for example, the correspondence information to specify which control mode—stoichiometric control or lean-burn control—is implemented, as indicated by the A / F signal. In this embodiment, if the control mode specified by the air-fuel ratio indicated by the A / F signal is stoichiometric control, the special stop unit 54 outputs a high-level signal indicating the actual mode; conversely, if the control mode is lean-burn control, a low-level signal is output indicating the actual mode.

[0076] If the signal for the estimated control mode and the signal for the actual mode match, the special stop unit 54 outputs a third low-level failsafe signal C3 to the first drive unit 61 and a fourth low-level failsafe signal C4 to the second drive unit 62. Conversely, if the signal for the estimated control mode and the signal for the actual mode do not match, the special stop unit 54 outputs a third high-level failsafe signal C3 to the first drive unit 61 and a fourth high-level failsafe signal C4 to the second drive unit 62. [2-2. Operation]

[0077] The following describes the condition of the vehicle, based on the monitoring of the monitoring IC 24, which is configured as described above. (Plant 4)

[0078] If the estimated control mode matches the control mode specified by the air-fuel ratio indicated by the A / F signal, the special stop unit 54 outputs the third low-level fail-safe signal C3 to the first drive unit 61. Furthermore, the fourth low-level fail-safe signal C4 is output to the second drive unit 62. If, as a result, the microcomputer 22 in the vehicle is functioning normally, the vehicle operates normally according to the control mode. If the microcomputer 22 is malfunctioning, the implementation unit 53 performs fail-safe control. (Plant 5)

[0079] If the estimated control mode and the control mode specified by the air-fuel ratio indicated by the A / F signal do not match, the special stop unit 54 determines that the determination result by the determination unit 51 is incorrect. In this case, the third failsafe signal C3 is output at a high level to the first drive unit 61. Furthermore, the fourth failsafe signal C4 is output at a high level to the second drive unit 62. As a result, the vehicle is in a failsafe state in which the engine shuts down and the vehicle stops. [2-3. Effects]

[0080] The second embodiment described above provides the effects (1a) - (1e) of the first embodiment described above and the following effects.

[0081] (2a) In the microcomputer 22, the inspection unit 42 and the management unit 43 generate a monitoring signal (i.e., a test result signal) which is used to determine whether the microcomputer 22 is normal and output the monitoring signal to the monitoring IC 24. The special stop unit 54 determines, based on the A / F signal, whether the determination result by the determination unit 51 is correct. If it is determined that the determination result is incorrect, it is appropriate to perform a failsafe control under the assumption that at least one of the units, microcomputer 22 and estimation unit 52, is abnormal.

[0082] (2b) The special stop unit 54 can initiate a control action to stop the engine, which is the control target, if the estimated control mode and the control mode specified by the air-fuel ratio indicated by the A / F signal do not match. Even if the determination unit 51 determines that the microcomputer 22 is normal, the vehicle can be stopped if the estimated control mode and the control mode specified by the air-fuel ratio indicated by the A / F signal do not match. This allows vehicle safety to be maintained more reliably.

[0083] In the embodiments described above, the ECU 10 corresponds to an electronic control unit, the microcomputer 22 and the target control unit 41 correspond to a control unit, and the monitoring IC 24 corresponds to a monitoring unit. The actuator corresponds to a drive mechanism, the first actuator and the electronic throttle 31 correspond to a first drive mechanism, and the second actuator and the injector 32 correspond to the second drive mechanism. The inspection unit 42 and the management unit 43 correspond to the monitoring signal unit. The stoichiometric control corresponds to a first control mode, and the lean combustion control corresponds to a second control mode. The A / F signal corresponds to the air-fuel ratio signal, and the test result signal corresponds to the monitoring signal. [3. Other embodiments]

[0084] While the embodiments of the present invention have been described above, the present invention is not limited to the embodiments above and can be modified in various ways, as described below.

[0085] (3a) In the embodiments described above, the target control unit 41 determines the control mode based on the signal indicating the requested torque and the engine speed signal. However, the present invention is not limited to this. The target control unit 41 can be configured to determine the control mode based on the same signal as the signal indicating the requested torque and the engine speed signal, using a signal similar to the signal indicating the requested torque instead of the signal indicating the requested torque. A signal similar to the signal indicating the requested torque can include a signal indicating the requested air volume, a signal indicating the engine intake manifold pressure, a signal indicating the fuel injection quantity, a signal indicating the ignition timing, and the like. Each of these quantities, engine intake air volume, engine intake air pressure, fuel injection quantity, ignition timing, etc.,, can be detected by various sensors.

[0086] (3b) In the embodiments described above, the estimating unit 52 estimates the control mode similarly to the target control unit 41 based on the signal about the requested torque and the engine speed using a characteristic map. However, the present invention is not limited to this. The estimating unit 52 can be configured to estimate the control mode by processing that differs from that of the target control unit 41 and that uses a state signal that is different from that of the target control unit 41.

[0087] (3c) In the embodiments described above, the test result signal was used as the monitoring signal, but in the present invention, the monitoring signal is not limited to the test result signal. For example, a so-called watchdog signal (hereinafter referred to as the WDG signal) can be used as the monitoring signal. In this case, the inspection unit 42 can be a WDG circuit that generates a WDG signal, and the management unit 43 can be a circuit that outputs the WDG signal to the monitoring IC 24. In the monitoring IC 24, the determination unit 51 can compare the received cycle of the WDG signal with a predetermined cycle as an expected value and determine that the microcomputer 22 is functioning normally if these values ​​match. This allows the effects described above to be obtained in a similar manner.In addition, the inspection unit 42, the management unit 43 and the determination unit 51, which are configurations for determining an abnormality of the microcomputer 22, can be easily configured.

[0088] (3d) The embodiments described above have described an example in which a control target is the engine and the microcomputer 22, which is the control unit, determines a control mode from the control modes, stoichiometric control and lean combustion control, which are the plurality of control modes, and controls the control target. However, the present invention is not limited thereto.

[0089] The control target can be, for example, various devices for controlling the vehicle. The target control unit 41 can, for example, be a control device that controls (i) various devices of a drive system, such as the motor described above, (ii) various devices that actuate the steering system according to the steering input, or (iii) various devices in a braking system, such as a brake.

[0090] The multitude of control modes of the control target can furthermore exhibit different control modes for these control targets.

[0091] (3e) The above embodiments have described an example in which the motor, as a control target, is driven by the electronic throttle 31, which is the first drive mechanism, and the injector 32, which is the second drive mechanism. However, the present invention is not limited thereto. The plurality of drive mechanisms that drive the control target, such as the first drive mechanism and the second drive mechanism, can comprise different actuators, electronic control devices, and the like, according to the control target.

[0092] (3f) The embodiments described above were described as an example in which the microcomputer 22, which is the control unit, operates the engine as a control target in a plurality of control modes, the plurality of control modes being stoichiometric control, which is the first control mode, and lean-burn control, which is the second control mode. However, the present invention is not limited thereto. The control mode of the control target executed by the microcomputer 22, which is the control unit, may further comprise one or more control modes in addition to the first and second control modes. The monitoring IC 24 may be configured to perform a different failover control for each of the plurality of control modes (i.e., three or more control modes).

[0093] The ECU 10 and the methods described in the present invention can be implemented by a dedicated computer, provided by configuring a processor and memory programmed to perform one or more functions executed by a computer program. Alternatively, the control circuit and the methods described in the present invention can be implemented by a dedicated computer in which the processor is configured by one or more dedicated hardware logic circuits.Alternatively, the control circuit and the methods described in this invention can be implemented by one or more dedicated computers, configured by a combination of a processor programmed to perform one or more functions and a memory and processor configured by one or more hardware logic circuits. The computer program can also be stored as computer-executable instructions on a computer-readable, non-transient tangible storage medium. The technique for implementing the functions of each unit of the ECU 10 need not necessarily include software; all functions can be implemented using one or more hardware circuits.

[0094] (3h) Several functions of an element in the embodiments described above can be implemented by several elements, or a single function of an element can be implemented by several elements. Furthermore, several functions or several elements can be implemented by one element, or a function implemented by several elements can be implemented by one element. Additionally, a part of the configuration of the embodiments described above can be omitted. At least one part of the configuration of the embodiments described above can be added to or replaced by the configuration of the other embodiments described above.

[0095] (3i) In addition to the ECU 10 described above, the present invention can be implemented in various forms, such as a monitoring IC 24, a system comprising the monitoring IC 24 and the ECU 10 as components, a computer with the function of the monitoring IC 24, a program that causes the ECU 10 to operate, a program for implementing the function of the monitoring IC 24, a monitoring method and a non-transient tangible storage medium, such as a semiconductor memory, in which the program is stored.< / gesamtaufbau>

Claims

[1] Electronic control unit attached to a vehicle for controlling a predetermined control target, comprising: a control unit (22) configured to a control mode is determined from a variety of control modes that specify the control types of the control target, and the steering target is controlled, and a monitoring unit (24) configured to monitor the control unit, where: the monitoring unit features: a determination unit (51) configured to determine whether an abnormality has occurred in the control unit, an estimation unit (52) configured to estimate as one of the estimated control modes the control mode determined by the control unit, and an implementation unit (53) configured to perform a fail-safe control, which is different for each estimated control mode, in response to the determination that the abnormality has occurred in the control unit. [2] Electronic control unit according to claim 1, wherein: the control unit is configured so that it at least one status signal is obtained that represents a state of the vehicle, and one control mode with a predefined processing based on the obtained at least one state signal, and in the monitoring unit the estimation unit is configured so that it that obtains at least one status signal, and The control mode, which is determined by the control unit, is estimated based on the at least one state signal obtained. [3] Electronic control unit according to claim 2, wherein: the estimation unit is configured so that it the same at least one state signal as the at least one state signal obtained by the control unit, and Based on the obtained at least one state signal, estimates the one control mode determined by the control unit, using the same processing as the specified processing with which the control unit determines the one control mode. [4] Electronic control unit according to any one of claims 1 to 3, wherein: The control target is controlled by a variety of drive mechanisms that are driven according to drive signals. the control unit is configured to perform a control for outputting the drive signals, wherein the drive signals for the respective driving of the multitude of drive mechanisms are determined according to the one control mode of the multitude of control modes, the multitude of control modes includes a first control mode and a second control mode, the multitude of drive mechanisms includes a first drive mechanism and a second drive mechanism, In the monitoring unit, the estimation unit is configured to estimate one of the control modes, first control mode and second control mode, as the one control mode determined by the control unit, and In cases where it is determined that the abnormality occurred in the control unit, the implementation unit is configured so that it The control for the first drive mechanism acts as the fail-safe control when the estimated control modes are first control mode and second control mode, and the first control mode is the one in question. The control for both drive mechanisms, first drive mechanism and second drive mechanism, is performed as the fail-safe control when the estimated control modes, first control mode and second control mode, are the second control mode. [5] Electronic control unit according to claim 4, wherein: In cases where it is determined that the abnormality has occurred in the control unit, the implementation unit is configured to perform the control to stop the drive signal to the first drive mechanism as the fail-safe control when the estimated control mode is the first control mode and the second control mode. [6] Electronic control unit according to claim 4 or 5, wherein: In cases where it is determined that the abnormality has occurred in the control unit, the implementation unit is configured to perform the control to stop the drive signal to the first drive mechanism and to stop the drive signal to the second drive mechanism as a failsafe control when the estimated control mode is the second control mode. [7] Electronic control unit according to any one of claims 1 to 5, wherein: the control target is an engine the multitude of control modes that implement different air-fuel ratios, the control unit has a monitoring signal unit (42, 43) which is configured to generate a monitoring signal that is used to determine whether the control unit is normal, and outputs the monitoring signal to the monitoring unit, in the monitoring unit the determination unit is configured to determine, based on the monitoring signal output by the control unit, whether the abnormality has occurred in the control unit, and the monitoring unit is configured to include a special stop unit (54) which is configured to determine, on the basis of a signal about the air-fuel ratio indicating an air-fuel ratio, whether a determination result by the determination unit is correct. [8] Electronic control unit according to claim 7, wherein: The special stop unit is configured to perform the control to stop the control target when the control mode specified by the air-fuel ratio indicated by the air-fuel ratio signal does not match the estimated control mode estimated by the estimation unit.

Images