CONTROL DEVICE FOR A VEHICLE

Abstract

Control device for a vehicle, the control device comprising: a regular control unit (10) configured to control a control object (2) to move a vehicle so that the control object is in a predetermined target state; a fallback control unit (22) configured to control the control object by fallback control in which a control function is restricted compared to regular control by the regular control unit in a case where an abnormality occurs in the control of the control object by the regular control unit; a fallback diagnostic unit (30) configured to: (i) to switch the control of the control object to fallback control by the fallback control unit in a case where a predetermined diagnostic condition is satisfied during execution of the regular control by the regular control unit; (ii) to diagnose whether or not the fallback control is being properly executed; and (iii) return to regular control by the regular control unit in a case where the diagnosis is completed; and a diagnostic monitoring unit (32) configured to: (iv) monitor a state of the control object in a case where the fallback diagnosis unit switches the control of the control object to fallback control; and (v) return the control of the control object to regular control by the regular control unit by stopping the diagnosis of the fallback control by the fallback diagnosis unit in a case where the control object deviates from the target state by an allowable value or more.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to a control device that controls a control object used to move a vehicle. BACKGROUND

[0002] Patent Document 1 discloses a device that controls an internal combustion engine, which is a power source of a vehicle. This device is configured to rotate a throttle valve to a predetermined opening degree when power to a motor that opens and closes the throttle valve is turned off. The device turns off power to the motor when an abnormality occurs in control.

[0003] In this device, the throttle valve can be opened and closed when an abnormality occurs in the control system. In this case, the vehicle's behavior is stabilized by keeping the throttle valve at a constant opening degree. PRIOR ART LITERATURE PATENT LITERATURE OVERVIEW

[0004] If the control device detects an abnormality in the control, it shuts off the power supply to the motor and stops controlling the throttle valve opening. Therefore, for example, in a case where a similar control is applied to an autonomous vehicle, a driver cannot manually control the internal combustion engine and thus cannot drive the vehicle if an abnormality occurs.

[0005] Accordingly, in the autonomously driving vehicle, control for a fundamental function of the vehicle is switched from regular control to fallback control instead of stopping control of a control object such as the throttle valve when an abnormality occurs in the control device. Fallback control is designed to allow a driver to manually operate the control object safely, for example, with an emergency function.

[0006] Furthermore, since it is necessary to ensure that fallback control can be executed when an abnormality occurs, it is necessary to previously diagnose whether fallback control can be executed normally when no abnormality occurs. The diagnosis is generally performed before the vehicle is parked, and the control of the control object is terminated so as not to affect the vehicle's movement. However, it is also necessary to ensure that fallback control can be executed during actual vehicle movement. Therefore, it is desirable to perform the diagnosis when the vehicle is actually moving.

[0007] However, a detailed investigation by the developer revealed that if the diagnosis is performed during actual vehicle operation, the controlled object may deviate significantly from the target state, which may cause a passenger to feel uncomfortable. One of the reasons is believed to be that the fallback control has a limited control function compared to the regular control.

[0008] It should be noted that this problem occurs not only in the control device that controls the control object constituting the vehicle's propulsion system, such as the internal combustion engine, but also in the control device that controls the control object constituting the vehicle's braking and steering systems. That is, this problem also occurs in the control device that controls the control object used in the vehicle's fundamental functions, such as moving, stopping, and turning.

[0009] In one aspect of the present disclosure, it is necessary to previously diagnose whether or not the fallback control functions properly during the regular control without giving the passenger a feeling of discomfort.

[0010] A vehicle control device according to one aspect of the present disclosure is a device that controls a control object (2) used in a vehicle and includes a regular control unit (10), a fallback control unit (22), a fallback diagnosis unit (30), and a diagnosis monitoring unit (32).

[0011] The regular control unit controls the control object so that the control object reaches a predetermined target state. In the event of a control abnormality, the fallback control unit controls the control object through fallback control, in which a control function is restricted compared to regular control by the regular control unit.

[0012] The fallback diagnosis unit switches control for the control object to fallback control by the fallback control unit while executing regular control by the regular control unit in a case where a predetermined diagnosis condition is met, and diagnoses whether the fallback control can be properly executed or not. The fallback diagnosis unit returns to regular control by the regular control unit in a case where the fallback control diagnosis is completed.

[0013] The diagnostic monitoring unit monitors a state of the control object in a case where the fallback diagnostic unit switches control of the control object to fallback control. The diagnostic monitoring unit stops the fallback control diagnosis by the fallback control unit and returns control of the control object to regular control by the regular control unit in a case where the control object deviates from a target state by an allowable value or more.

[0014] Therefore, according to the vehicle control device of the present disclosure, it is possible to switch the control to the fallback control and diagnose whether the fallback control is properly executed or not while the regular control unit controls the control object under the regular control.

[0015] Therefore, fallback control diagnosis can be performed more accurately by executing fallback control diagnosis not only when the vehicle is parked and stopped, but also when the vehicle is moving. Furthermore, it is possible to reliably execute fallback control in a case where an abnormality actually occurs in regular control while the vehicle is moving, and reliability of the control device can be improved by executing fallback control diagnosis as described above.

[0016] For example, if fallback control for diagnosis is executed while the vehicle is moving, the vehicle may decelerate contrary to a passenger's intention, which may cause a passenger to feel uncomfortable. In the control device of the present disclosure, control is returned to regular control in a case where the control object deviates by the allowable value or more from the target state in regular control while the diagnosis for fallback control is being executed. Accordingly, fallback control diagnosis can be executed without causing a passenger to feel uncomfortable.

[0017] A vehicle control device according to another aspect of the present disclosure, similar to the above-mentioned control device, includes a regular control unit (10), a fallback control unit (22), a fallback diagnosis unit (30), and a diagnosis monitoring unit (32). A difference from the above-described control device is that the diagnosis monitoring unit is configured to notify that the diagnosis for fallback control is currently being executed in a case where the control object deviates by the allowable value or more from the target state in the regular control while the diagnosis for fallback control is being executed.

[0018] According to this control device, a notification indicating that the fallback control diagnosis is currently being executed is delivered to a passenger in a case where the control object deviates from the target state by the allowable value or more in regular control while the fallback control diagnosis is being executed. Accordingly, it is possible to suppress discomfort conveyed to a passenger. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The disclosure is further described with reference to the drawings.

[0020] They show: Fig. 1 is a block diagram showing a configuration of an entire control device according to a first embodiment; Fig. 2 is an explanatory diagram showing a transition of a control state after an abnormality is detected in a regular control; Fig. 3 is a flowchart showing fallback diagnosis processing executed by a monitoring microcomputer; Fig. 4 is an explanatory diagram showing a switching operation to regular control performed during a fallback control diagnosis; Fig. 5 is a flowchart showing a first modification of the relapse diagnosis processing used in Fig. 3 is shown; Fig. 6 is a flowchart showing a second modification of the relapse diagnosis processing used in Fig. 3 is shown; Fig. 7 is a flowchart showing a third modification of the relapse diagnosis processing used in Fig. 3 is shown; Fig. 8 is a flowchart showing a fourth modification of the relapse diagnosis processing used in Fig. 3 is shown; Fig. 9 is a flowchart showing a fifth modification of the relapse diagnosis processing used in Fig. 3 is shown; Fig. 10 is a flowchart showing a sixth modification of the relapse diagnosis processing used in Fig. 3 is shown; Fig. 11 is a flowchart showing a seventh modification of the relapse diagnosis processing used in Fig. 3 is shown; Fig. 12 is a flowchart showing an eighth modification of the relapse diagnosis processing used in Fig. 3 is shown; Fig. 13 is a flowchart showing a ninth modification of the relapse diagnosis processing used in Fig. 3 is shown; and Fig. 14 is a flowchart showing the relapse diagnosis processing according to a second embodiment. DESCRIPTION OF EMBODIMENTS

[0021] Embodiments of the present disclosure will be described below according to the drawings. (First embodiment)

[0022] As in Fig. As shown in Figure 1, a control device 1 of the present embodiment controls fuel injection from injectors 4 provided in a plurality of cylinders of an internal combustion engine 2 (KNOB) that configures a vehicle drive system. The control device 1 is a so-called internal combustion engine ECU. The ECU represents an electronic control device. (Configuration)

[0023] The control device 1 has various electronic circuits including a microcomputer and includes, as shown in Fig. 1, a regular control unit 10, a torque output request unit 12, and an injector drive unit 14.

[0024] The torque output request unit 12 requests a torque output of the internal combustion engine 2, which is a control target, from the regular control unit 10 (REGK). The regular control unit 10 performs regular and normal control for the internal combustion engine 2. The torque output request unit 12 calculates the target torque of the internal combustion engine 2 according to a driver's accelerator pedal operation amount during manual operation of the vehicle and outputs this target torque as a required torque. The torque output request unit 12 calculates the target torque according to a moving condition of the vehicle during autonomous driving of the vehicle and outputs the target torque as the required torque.

[0025] The regular control unit 10 calculates a fuel injection amount required to adjust an actual torque output to an output shaft of the internal combustion engine 2 to the required torque output from the torque output request unit 12. The actual torque is calculated based on a current operating state of the internal combustion engine 2, which is the control object. The current operating state may be a rotation speed, an intake pressure, a water temperature, and the like. The fuel injection amount represents an amount of fuel to be injected from each injector 4 provided in each cylinder of the internal combustion engine 2.

[0026] The injector drive unit 14 sets an injection timing and an injection period for sequentially injecting fuel into each cylinder in synchronization with the rotation of the internal combustion engine 2, and drives the injector 4 of each cylinder at the injection timing. The injector drive unit 14 sets the injection timing and injection period based on a fuel injection amount calculated by the regular control unit 10 or the fallback control unit 22, which will be described later.

[0027] Accordingly, fuel is injected and supplied to each cylinder of the internal combustion engine 2 in an intake stroke and mixed with intake air, and an air-fuel mixture is compressed and ignited in a compression stroke.

[0028] The regular control unit 10 is configured with a control microcomputer that performs various arithmetic processing for engine control, and the control microcomputer executes a predetermined program to provide functions as the regular control unit 10. Furthermore, the torque output request unit 12 and the injector drive unit 14 are composed of electronic circuits having these functions.

[0029] Next, the control device 1 is provided with a monitoring microcomputer 20 for monitoring a state of the internal combustion engine 2.

[0030] The monitoring microcomputer 20 has functions as a fallback control unit 22 (FABK), a fallback request unit 24, a torque monitoring unit 26, a fallback diagnosis unit 30 (FABD), and a diagnosis monitoring unit 32 (FABM). Note that these functions are provided by the CPU constituting the monitoring microcomputer 20, which executes a program stored in a computer-readable, non-volatile, tangible recording medium such as ROM.

[0031] The fallback control unit 22 executes the fallback control instead of the regular control by the regular control unit 10 in a case where an abnormality occurs in the engine control by the regular control unit 10. The fallback control restricts the torque output of the engine 2 compared to the regular control and continues an operation of the engine 2.

[0032] That is, for example, the fallback control unit 22 restricts the required torque output from the torque output request unit 12 to be equal to or less than a predetermined upper limit. Accordingly, the fallback control unit 22 calculates a restricted fuel injection amount from the injector 4 or a restricted number of injectors 4 used for fuel injection and outputs a calculation result to the injector drive unit 14.

[0033] Accordingly, the fuel injection amount or the number of injectors 4 used for fuel injection is reduced compared with the regular control, and the torque of the internal combustion engine 2 is reduced in a case where the fallback control unit 22 executes the fallback control.

[0034] As in Fig. As shown in Figure 2, when the internal combustion engine 2 is operating normally under regular control P1 (REGK) and an abnormality occurs in the control, the control is switched to fallback control P2 (FABK). Accordingly, the control device 1 suppresses an excessive increase in the torque of the internal combustion engine 2, enabling the vehicle to operate continuously.

[0035] In a case where an abnormality occurs in the regular control by the regular control unit 10, the device delivers a notification to a passenger of the vehicle. Thus, the passenger is notified of the abnormality. This prompts the driver to start manual driving of the vehicle, even when the vehicle is being driven automatically. As a result, the driver can move the vehicle with limited power. For example, the driver can move the vehicle to a safer location, such as a parking space and / or a stop area. This function can be referred to as limp home.

[0036] In this disclosure, fallback control means that a control function enables only limited power. In one aspect, limited power is safer than full power. Limited power may allow the vehicle to move below a limited slow speed. In the other aspect, limited power means fewer operational capabilities than full power. Limited power may enable fewer functions than those at full power. For example, the driver may execute a limp-home function using limited power that is less limited than that enabled in an autonomous driving mode. Fallback control may be referred to as limp-home control or degeneration control.

[0037] The fallback control P2 (FABK) by the fallback control unit 22 continues until a predetermined fixed time has elapsed, which is set as the time required for a driver to evacuate the vehicle. Then, the control device 1 stops the engine control at the control stop P3 (KNST) after a certain period of time has elapsed.

[0038] The fallback request unit 24 outputs a switching command to switch the control according to the switching request from the torque monitoring unit 26 or the fallback diagnosis unit 30. The fallback request unit 24 outputs a switching command from the regular control by the regular control unit 10 to the fallback control by the fallback control unit 22 or a switching command in an opposite direction.

[0039] A control switching unit 16 is arranged in a control variable input path of the injector drive unit 14. The control switching unit 16 selects either a calculation result of the fuel injection amount by the regular control unit 10 or a calculation result of the fuel injection amount by the fallback control unit 22 and inputs it to the injector drive unit 14.

[0040] The control switching unit 16 is configured to connect the regular control unit 10 to the injector drive unit 14 as an initial state when the control device 1 is started. The control switching unit 16 connects the fallback control unit 22 to the injector drive unit 14 in a case where a switch command for fallback control is input from the fallback request unit 24.

[0041] The fallback control by the fallback control unit 22 is executed by issuing a switching command from the fallback request unit 24, and normally the regular control is executed by the regular control unit 10.

[0042] In a case where the fallback control unit 22 is connected to the injector drive unit 14, a switching command to regular control can be input to the control switching unit 16 from the fallback request unit 24. In this case, the control switching unit 16 connects the regular control unit 10 to the injector drive unit 14 to switch the control of the internal combustion engine 2 to regular control.

[0043] When the internal combustion engine 2 is operated under regular control by the regular control unit 10, the torque monitoring unit 26 acquires an actual torque of the internal combustion engine 2 via a torque sensor or the like provided on the output shaft of the internal combustion engine 2. The torque monitoring unit 26 compares the acquired actual torque with the torque required by the torque output request unit 12.

[0044] For example, if a period in which the actual torque of the internal combustion engine 2 cannot be controlled to the required torque persists and is equal to or longer than a predetermined time, the torque monitoring unit 26 determines that an abnormality has occurred in the control system including the regular control unit 10. In this case, the torque monitoring unit 26 requests the fallback request unit 24 to switch to fallback control.

[0045] Accordingly, in a case where an abnormality occurs in the regular control by the regular control unit 10, a switching command is output from the fallback request unit 24 to the control switching unit 16, and the control of the internal combustion engine 2 is switched to the fallback control by the fallback control unit 22. Then, the fallback control unit 22 executes the fallback control for a certain period of time required for the vehicle to evacuate and then stops the control of the internal combustion engine 2.

[0046] Next, the fallback diagnosis unit 30 determines whether or not a predetermined diagnosis condition is met when the internal combustion engine 2 is under regular control by the regular control unit 10, and requests the fallback request unit 24 to switch to fallback control in a case where the predetermined diagnosis condition is met. Accordingly, a switch command is output from the fallback request unit 24 to the control switching unit 16, and control of the internal combustion engine 2 is switched to fallback control by the fallback control unit 22.

[0047] The fallback diagnosis unit 30 diagnoses whether or not the fallback control by the fallback control unit 22 is properly executed. When the diagnosis is completed, the fallback diagnosis unit 30 stores the diagnosis result in a predetermined non-volatile storage medium provided in the control device 1. When the diagnosis is completed, the fallback diagnosis unit 30 requests the fallback request unit 24 to switch to regular control. Accordingly, a switch command is output from the fallback request unit 24 to the control switching unit 16, and control of the internal combustion engine 2 is returned to regular control by the regular control unit 10.

[0048] As a result of the fallback control diagnosis, the fallback diagnosis unit 30 may determine that the fallback control is not implemented correctly. In this case, the fallback diagnosis unit 30 notifies a passenger of the result through notification processing such as illuminating a warning lamp. The fallback diagnosis unit 30 prompts the passenger to inspect and repair the internal combustion engine control system including the control device 1 by notifying the passenger.

[0049] The diagnostic condition used to determine whether the fallback diagnostic unit 30 is capable of switching the control of the internal combustion engine 2 from regular control to fallback control may include an operating condition. The operating condition may be set as a predetermined operating condition in which, for example, a passenger is not easily notified of a moving state of the vehicle, even if the fluctuation is actually generated by switching the control of the internal combustion engine 2 to fallback control.

[0050] That is, the diagnosis condition may be set to include an operating condition in which the internal combustion engine 2 is operated at low torque, and the torque of the internal combustion engine 2 does not fluctuate significantly due to switching to fallback control. The operating condition may include, for example, a constant-speed operating condition of the vehicle whose vehicle speed is equal to or greater than a predetermined vehicle speed, a deceleration operating condition of the vehicle, and the like.

[0051] Furthermore, in the present embodiment, the fallback control is executed by reducing the fuel injection amount and the number of injectors 4 used for fuel injection compared to the regular control. Accordingly, the fallback diagnosis unit 30 determines whether or not the fallback control is properly executed, for example, depending on the timing of the drive pulse output from the injector drive unit 14 to each injector 4 or the presence or absence of a drive pulse.

[0052] Next, the diagnosis monitoring unit 32 monitors whether or not a state of the internal combustion engine 2 deviates by an allowable value or more from the target state of the regular control when the fallback diagnosis unit 30 switches the control of the internal combustion engine 2 to the fallback control to diagnose the fallback control.

[0053] That is, in a case where the control of the internal combustion engine 2 is switched to the fallback control by the fallback diagnosis unit 30, the diagnosis monitoring unit 32 obtains the actual torque of the internal combustion engine 2 via a torque sensor or the like provided on the output shaft of the internal combustion engine 2.

[0054] Then, the obtained actual torque is compared with the required torque from the torque output request unit 12, and a diagnosis stop command is output to the fallback diagnosis unit 30 in a case where the actual torque deviates from the required torque by the allowable value or more.

[0055] Then, the fallback diagnosis unit 30 stops the fallback control diagnosis and requests the fallback request unit 24 to switch to regular control. Accordingly, a switch command is output from the fallback request unit 24 to the control switching unit 16, and the control of the internal combustion engine 2 is switched to regular control by the regular control unit 10. (Processing)

[0056] Next, the fallback diagnosis processing executed by the monitoring microcomputer 20 to provide functions of the fallback diagnosis unit 30 and the diagnosis monitoring unit 32 will be described with reference to the flowchart shown in Fig. 3 is shown.

[0057] This fallback diagnosis processing is processing executed when the monitoring microcomputer 20 determines that the above-mentioned diagnosis condition is satisfied while the internal combustion engine 2 is under regular control and the vehicle is moving.

[0058] As in Fig. 3, in a case where the fallback diagnosis processing is started, the fallback control request is first activated at S110. Accordingly, the control of the internal combustion engine 2 is switched from regular control to fallback control. Next, at S120, the actual torque ATQ of the internal combustion engine 2 is acquired, which is detected using a torque sensor or the like. In the following step S130, it is determined whether or not the actual torque ATQ acquired at S120 deviates from the required torque RTQ by a difference DT equal to or greater than an allowable value ALV (|ATQ-RTQ|≥ALV).

[0059] If it is determined at S130 that the actual torque does not deviate from the required torque by the allowable value or more, processing proceeds to S140. At S140, fallback control is executed for the time required for diagnosis, and it is determined whether or not the fallback diagnosis has been completed. If it is determined at S140 that the fallback diagnosis has not been completed, processing proceeds to S120, and the processing after S120 is executed again.

[0060] In a case where it is determined at S140 that the fallback diagnosis is completed, processing proceeds to S150. At S150, fallback diagnosis determination processing for diagnosing whether or not the fallback control can be properly executed is executed, and the diagnosis result is stored in a predetermined non-volatile storage medium.

[0061] In the fallback diagnosis determination processing of S150, it is determined whether or not the fallback control can be properly executed. Here, it is determined whether or not the fallback control can be properly executed based on a change in the drive pulse of each injector 4 during the fallback control diagnosis, such as the presence or absence of the drive pulse due to a cylinder reduction operation.

[0062] In a case where the fallback diagnosis determination processing of step 150 is completed, processing proceeds to step S160. Even if it is determined at step S130 that the actual torque deviates from the required torque by an allowable value or more, processing proceeds to step S160. Then, the fallback control request is deactivated at step S160, control of the internal combustion engine 2 is returned to regular control, and control processing is terminated.

[0063] In the relapse diagnosis processing, which is Fig. 3, the processings of S110 and S140 to S160 function as the fallback diagnosis unit 30, and the processings of S120 and S130 function as the diagnosis monitoring unit 32. (Advantages)

[0064] As described above, the control device 1 of the present embodiment switches the control of the internal combustion engine 2 from regular control to fallback control in a case where the diagnosis condition of the fallback control is met while the vehicle is moving. Furthermore, the control device 1 diagnoses whether or not the fallback control can be properly executed. Accordingly, the fallback control is tested before a situation dependent on the fallback control occurs.

[0065] Fig. 4 shows an example of a torque behavior of the internal combustion engine 2 during the fallback control diagnosis. During the fallback control diagnosis, the torque TQ of the internal combustion engine 2 may decrease due to a decrease in the fuel injection amount, a decrease in the fuel injection cylinder, and the like. For example, as shown in Fig. 4, the actual torque ATQ of the internal combustion engine 2 may be lower than the required torque RTQ.

[0066] In a case where a difference DT between the actual torque ATQ and the required RTQ becomes an allowable value ALV or more at time t1 due to a decrease in the actual torque of the internal combustion engine 2, the control of the internal combustion engine 2 is switched from the fallback control to the regular control.

[0067] Accordingly, the actual torque of the internal combustion engine 2 is suppressed from decreasing beyond a permissible value with respect to the required torque. Furthermore, the torque of the internal combustion engine 2 is controlled to the required torque by switching the control of the internal combustion engine 2 to regular control.

[0068] Therefore, according to the control device 1 of the present embodiment, the fallback control diagnosis can be performed while the vehicle is moving. Furthermore, at the time of the fallback control diagnosis, it is possible to suppress the occurrence of a situation in which the actual torque of the internal combustion engine 2 is significantly lower than the required torque and the vehicle cannot continue to move.

[0069] Furthermore, at the time of fallback control diagnosis, if the actual torque of the internal combustion engine 2 does not decrease by the allowable value or more than the required torque, the fallback control diagnosis can be completed. Accordingly, the fallback control can be diagnosed without causing discomfort to the passenger.

[0070] Next, modifications of the present embodiment will be described. (First modification)

[0071] In the above embodiment, the diagnosis monitoring unit 32 immediately outputs the diagnosis stop command to the fallback diagnosis unit 30 for returning the control for the internal combustion engine 2 to the regular control in a case where the actual torque of the internal combustion engine 2 deviates from the required torque by the allowable value or more.

[0072] Alternatively, the Fig. 5 may be executed. In a case where the diagnosis monitoring unit 32 determines at S130 that the actual torque of the internal combustion engine 2 deviates from the required torque by the allowable value or more, the processing proceeds to S170. At S170, it is determined whether or not the same state continues for a predetermined time or longer.

[0073] Then, if it is determined at S170 that the state in which the actual torque deviates from the required torque by the allowable value or more persists for a predetermined time or longer, processing proceeds to S160. At S160, the fallback control request is disabled, and the fallback diagnosis processing is terminated.

[0074] If it is determined at S170 that the state in which the actual torque deviates from the required torque by the allowable value or more does not persist for a predetermined time or longer, processing proceeds to S140. After that, the fallback control diagnosis continues from S140.

[0075] Accordingly, in this modified example, the control is returned to the regular control by stopping the fallback control diagnosis only in a case where a state in which the actual torque of the internal combustion engine 2 deviates from the required torque by the allowable value or more continues for a predetermined time or more.

[0076] Therefore, according to the present modification, compared to the previous embodiment, it is possible to suppress a situation where the fallback control diagnosis is erroneously stopped. For example, in a case where the actual torque temporarily drops immediately after the control is switched to fallback control, or in a case where the actual torque is erroneously detected due to noise or the like, it is possible to suppress situations where the fallback control diagnosis is erroneously stopped.

[0077] That is, according to the present modification, not only the same effect as that of the above embodiment can be obtained, but also the frequency of executing the fallback control diagnosis can be increased compared with the above embodiment. (Second modification)

[0078] In the above embodiment, the fallback diagnosis unit 30 has been described such that the diagnosis of the fallback control is started as soon as a predetermined diagnosis condition is satisfied.

[0079] On the other hand, in the modified example, the fallback diagnosis unit 30 stores the operating state of the internal combustion engine 2 as a diagnosis impossible state in a case where the diagnosis of the fallback is stopped by the diagnosis monitoring unit 32 during the fallback control diagnosis. Thereafter, the fallback diagnosis unit 30 is configured not to execute the fallback control diagnosis in the diagnosis impossible state.

[0080] That is, as in Fig. 6, in the present modification, if it is determined at S130 that the actual torque of the internal combustion engine 2 deviates from the required torque by the allowable value or more in the fallback diagnosis processing, the processing proceeds to S180. Then, at S180, the current operating state of the internal combustion engine 2 is stored in the non-volatile storage medium as the diagnosis impossible state, and the processing proceeds to S160.

[0081] For example, the diagnosis impossible condition may include a rotation speed of the internal combustion engine 2, an intake pressure, a water temperature, and the like. Furthermore, the diagnosis impossible condition stored in the storage medium may include the operating state of the vehicle, such as a gear ratio of a transmission of the vehicle drive system driven by the internal combustion engine 2, a vehicle speed, and a steering angle.

[0082] Next, immediately after the aforementioned diagnosis condition is satisfied and the fallback diagnosis processing is started, it is determined at S210 whether or not the current operating state of the internal combustion engine 2 or the vehicle is in an undiagnosable state. Then, if it is determined at S210 that the current state is the diagnosis impossible state, the fallback diagnosis processing is terminated without executing the fallback control diagnosis in the processing after S110. Further, if it is determined at S210 that the current state is not the diagnosis impossible state, the processing proceeds to S110 and the fallback control diagnosis is executed.

[0083] Accordingly, according to the present modification, as compared with the above-mentioned embodiment, it is possible to suppress an event in which the control of the internal combustion engine 2 is switched to the fallback control and the fallback control diagnosis is executed in a case where the state of the internal combustion engine 2 or the vehicle is in the diagnosis impossible state.

[0084] Therefore, according to the present modification, not only the same effect as that of the above-described embodiment can be obtained, but also the diagnosis of the fallback control can be carried out under a more successful condition. (Third modification)

[0085] In the second modification, when the fallback control diagnosis is stopped by the diagnosis monitoring unit 32, the operating state of the internal combustion engine 2 or the vehicle at that time is stored as the diagnosis impossible state. Thereafter, the diagnosis monitoring unit 32 is configured not to execute the fallback control diagnosis in the stored diagnosis impossible state.

[0086] Alternatively, in the present modification, the fallback diagnosis unit 30 is configured not to repeat the fallback control diagnosis until a predetermined time has elapsed after the diagnosis impossible state is detected once. In a case where the fallback control diagnosis is stopped by the diagnosis monitoring unit 32 and the control of the internal combustion engine 2 is returned to regular control, the fallback diagnosis unit 30 is configured not to execute the fallback control diagnosis until a predetermined time has elapsed thereafter.

[0087] As in Fig. 7, in the fallback diagnosis processing, the diagnosis stop flag is set at S190 in a case where the actual torque of the internal combustion engine 2 deviates by the allowable value or more from the required torque at S130, and the processing proceeds to S160.

[0088] The diagnosis stop flag is a flag reset by so-called initialization processing in a case where the power supply to the control device 1 is switched from off to on and the monitoring microcomputer 20 is started. Immediately after the above-mentioned diagnosis condition is satisfied and the fallback diagnosis processing is started, it is determined at S310 whether or not the diagnosis stop flag is set.

[0089] If it is determined at S310 that the diagnostic stop flag is not set, processing proceeds to S110 and the fallback control diagnosis is executed. If it is determined at S310 that the diagnostic stop flag is set, processing proceeds to S320. At S320, it is determined whether or not a predetermined time has elapsed since the diagnostic stop flag was set.

[0090] If it is determined at S320 that a predetermined time has elapsed since the diagnosis stop flag was set, processing proceeds to S330. Processing resets the diagnosis stop flag at S330 and proceeds to S110 to execute the fallback control diagnosis.

[0091] If it is determined at S320 that the predetermined time has not yet elapsed since the diagnosis stop flag is set, the fallback diagnosis processing is terminated without executing the fallback control diagnosis.

[0092] This processing avoids a situation where the fallback control attempts are frequently repeated. If the diagnosis stop flag is set and the predetermined time has not yet elapsed, it is assumed that a state of the internal combustion engine 2 or the vehicle has not changed since the fallback control diagnosis was stopped. In this case, even if the fallback control diagnosis is executed again, it is highly likely that the diagnosis will be stopped again.

[0093] Therefore, the predetermined time used for determination at S320 is set to the time when the operating state of the internal combustion engine 2 or the vehicle is expected to change after the diagnosis stop flag is set. Therefore, according to the present modification, similar to the second modification, it is possible to suppress an event in which the control of the internal combustion engine 2 is switched to fallback control and the fallback control diagnosis is executed in a case where the state of the internal combustion engine 2 or the vehicle is in the diagnosis impossible state. Therefore, this modified example can perform the fallback control diagnosis under a more successful condition. (Fourth modification)

[0094] In the second and third modifications, in a case where the fallback control diagnosis is stopped by the diagnosis monitoring unit 32, it is configured to prevent frequent repetition of the diagnosis. Specifically, the control device 1 is configured so that the fallback control diagnosis is not executed until a predetermined time elapses after the diagnosis is stopped, or in a case where the internal combustion engine 2 or the vehicle is in the same operating state at that time.

[0095] Alternatively, the fallback diagnosis unit 30 is configured to prohibit re-diagnosis when the fallback control diagnosis is stopped by the diagnosis monitoring unit 32 until a predetermined reset condition is met. The fallback diagnosis unit 30 is configured not to execute the fallback control diagnosis until an operation of the control device 1 is once stopped and restarted by turning the power supply on and off or the like after the control is returned to regular control.

[0096] As in Fig. As shown in Fig. 8, in the present modification, similar to the third modification, in the fallback diagnosis processing, it is determined at S130 whether or not the actual torque of the internal combustion engine 2 deviates from the required torque by the allowable value or more. If an affirmative determination is made at S130, the diagnosis stop flag is set at S190, and processing proceeds to S160.

[0097] On the other hand, it is determined whether or not the diagnosis stop flag is set at S310 immediately after the aforementioned diagnosis condition is met and the fallback diagnosis processing is started. If it is determined at S310 that the diagnosis stop flag is not set, processing proceeds to S110 and the fallback control diagnosis is executed. If it is determined at S310 that the diagnosis stop flag is set, the fallback diagnosis processing is terminated without executing the fallback control diagnosis.

[0098] The diagnosis stop flag is reset in a case where a power supply to the control device 1 is turned off and on and the monitoring microcomputer 20 is started. Therefore, if the diagnosis stop flag is set at S190, the fallback control diagnosis is not executed until the monitoring microcomputer 20 is subsequently restarted.

[0099] Therefore, according to this modification, when the fallback control diagnosis is stopped by the diagnosis monitoring unit 32, it is possible to suppress a situation that the fallback control diagnosis is executed within the same power cycle in which the power supply to the control device 1 is continued.

[0100] According to this modification, the same effect as that of the above embodiment can be achieved. Furthermore, in this modified example, compared with the above-described embodiment or the first and second modified examples, it is possible to securely suppress the event in which the fallback control diagnosis is executed when the internal combustion engine 2 or the vehicle is in the diagnosis impossible state. (Fifth Modification)

[0101] Next, in the fourth modification, when the fallback control diagnosis is stopped by the diagnosis monitoring unit 32, the diagnosis is not executed thereafter in the same power cycle. Alternatively, the modified example is configured to change the diagnosis condition to a different diagnosis condition and execute the fallback control diagnosis using a changed diagnosis condition by the fallback diagnosis unit 30 in a case where the fallback control diagnosis is stopped by the diagnosis monitoring unit 32. The diagnosis condition before the change may be called a primary diagnosis condition. The diagnosis condition after the change may be called a secondary diagnosis condition.

[0102] As in Fig. As shown in Figure 9, in this modified example, processing proceeds in the same manner as in the third and fourth modified examples. In the fallback diagnosis processing, the diagnosis stop flag is set at S190 in a case where a determination is made that the actual torque of the internal combustion engine 2 deviates from the required torque by the allowable value or more at S130, and processing proceeds to S160.

[0103] It is determined whether or not the diagnosis stop flag is set at S310 immediately after the aforementioned diagnosis condition is met and fallback diagnosis processing is started. If the diagnosis stop flag is not set at S310, processing proceeds to S110 and fallback control diagnosis is executed.

[0104] If it is determined at S310 that the diagnosis stop flag is set, processing proceeds to S350. At S350, it is determined whether the condition for rerunning the diagnosis is met. This secondary diagnosis condition is set to enable a higher probability of success for the fallback control diagnosis than the regular primary diagnosis condition. The secondary condition can also be called a repeat diagnosis condition.

[0105] The repetition diagnosis condition is set to include the operating condition for repeating the diagnosis so that the torque fluctuation caused by switching the control of the internal combustion engine 2 from regular control to fallback control becomes smaller than the aforementioned primary diagnosis conditions. That is, the repetition diagnosis condition is more restricted in terms of the operating condition of the internal combustion engine 2 or the vehicle 2 than the primary diagnosis condition.

[0106] If it is determined at S350 that the retry diagnosis condition is not met, the fallback diagnosis processing is terminated without executing the fallback control diagnosis. If it is determined at S350 that the retry diagnosis condition is met, processing proceeds to S110 and the fallback control diagnosis is executed again.

[0107] Accordingly, according to the present modification, the fallback control diagnosis can only be executed in a case where the retry diagnosis condition is met after the diagnosis monitoring unit 32 stops the fallback control diagnosis. The retry diagnosis condition is set so that the fallback control diagnosis can be executed more reliably, since the retry diagnosis condition is more difficult to establish than the regular primary diagnosis condition. Therefore, the fallback control diagnosis can be executed under a more stringent condition. (Sixth Modification)

[0108] Next, in the above embodiment, the fallback diagnosis unit 30 executes the fallback control diagnosis again when the diagnosis condition is satisfied next, even if the fallback control diagnosis is executed in the processings from S110 to S150.

[0109] Alternatively, in the present modification, the fallback diagnosis unit 30 is configured so that the fallback diagnosis unit is not executed until the control device 1 is restarted after the fallback control diagnosis in the processing from S110 to S150 is completed. Restarting the control device 1 may be configured to be executed in a case where the operation of the control device 1 is temporarily stopped due to, for example, a power interruption or the like.

[0110] As in Fig. 10, in this modified example, in the fallback diagnosis processing, in a case where the fallback diagnosis determination processing of S150 is executed, the diagnosis completion flag is set at S420 and then the processing proceeds to S160.

[0111] The diagnosis completion flag is a flag reset by so-called initialization processing in a case where the power supply to the control device 1 is turned off and on and the monitoring microcomputer 20 is started.

[0112] It is determined at S410 whether the diagnosis completion flag is set immediately after the aforementioned diagnosis condition is met and fallback diagnosis processing is started. If the diagnosis completion flag is not set, processing proceeds to S110 and fallback control diagnosis is executed.

[0113] If it is determined at S410 that the diagnosis completion flag is set, the fallback diagnosis processing is terminated without executing the fallback control diagnosis. In this modification, the fallback control diagnosis is executed at least once in the fallback diagnosis processing at S110 to S150 after the power supply to the control device 1 is turned off and on and the monitoring microcomputer 20 is started. If the fallback control diagnosis is executed correctly, the fallback control diagnosis is prohibited until the monitoring microcomputer 20 is restarted.

[0114] According to this modified example, the frequency of executing the fallback control diagnosis can be reduced compared to the above-described embodiment and the first to fifth modified examples. Accordingly, it is possible to suppress a situation in which the torque of the internal combustion engine 2 fluctuates due to the execution of the fallback control for diagnosis. (Seventh Modification)

[0115] In the sixth modification, the fallback diagnosis unit 30 is configured so that the fallback control diagnosis is not executed in the same power supply cycle after the fallback control diagnosis is completed once.

[0116] Alternatively, in the present modification, as in Fig. As shown in FIG. 11, the fallback diagnosis unit 30 executes S440 after executing the fallback diagnosis determination processing of S150 in the fallback diagnosis processing. At S440, the operating state of the internal combustion engine 2 or the vehicle is stored in a non-volatile storage medium as a diagnosis completion state.

[0117] For example, similar to the diagnosis impossible state described above, the diagnosis completion state may include a rotation speed of the internal combustion engine 2, an intake pressure, a water temperature, a gear ratio of a transmission, a vehicle speed of the vehicle, a steering angle, and the like. At S430, it is determined whether or not the operating state of the internal combustion engine 2 or the vehicle is the diagnosis completion state, which is stored at S440 immediately after the aforementioned diagnosis condition is satisfied and the fallback diagnosis processing is started.

[0118] If the operating state of the internal combustion engine 2 or the vehicle is not in the diagnosis completion state, processing proceeds to S110 and the fallback control diagnosis is executed. If the operating state of the internal combustion engine 2 or the vehicle is in the diagnosis completion state, the fallback diagnosis processing is terminated without executing the fallback control diagnosis.

[0119] In this modification, the fallback diagnosis unit 30 stores an operating state of the internal combustion engine 2 or the vehicle, which are the control object, at the time of diagnosis completion as the diagnosis completion state in response to completion of the fallback control diagnosis. Thereafter, the fallback diagnosis unit 30 executes the fallback control diagnosis when the internal combustion engine 2 or the vehicle is not in the diagnosis completion state.

[0120] Therefore, according to this modification, the fallback control diagnosis can be executed under a plurality of operating conditions in which the operating state of the internal combustion engine 2 or the vehicle is different. (Eighth Modification)

[0121] In the seventh modification, the fallback control diagnosis is executed when the internal combustion engine 2 or the vehicle is in an operating state different from the diagnosis completion state. Alternatively, the fallback diagnosis unit 30 in the present modification is configured to execute the fallback control diagnosis when the internal combustion engine 2 or the vehicle is in the diagnosis completion state.

[0122] As in Fig. As shown in FIG. 12, in this modified example, in the fallback diagnosis processing, in a case where the fallback diagnosis determination processing of S150 is executed, the diagnosis completion flag is set at S420. At S440, the operating state of the internal combustion engine 2 or the vehicle is stored in the non-volatile storage medium as the diagnosis completion state.

[0123] It is determined at S410 whether the diagnosis completion flag is set immediately after the aforementioned diagnosis condition is met and fallback diagnosis processing is started. If it is determined at S410 that the diagnosis completion flag is not set, processing proceeds to S110 and fallback control diagnosis is executed.

[0124] The processing proceeds to S430 in a case where the diagnosis completion flag is set at S410, and it is determined whether or not the operation state of the internal combustion engine 2 or the vehicle is the diagnosis completion state stored at S440.

[0125] Processing proceeds to S110 in a case where it is determined at S430 that the state of the internal combustion engine 2 or the vehicle is in the diagnosis completion state, and the fallback control diagnosis is executed. The fallback diagnosis processing is terminated without executing the fallback control diagnosis in a case where it is determined at S430 that the state of the internal combustion engine 2 or the vehicle is not in the diagnosis completion state.

[0126] Accordingly, according to this modification, if the fallback control diagnosis is once successful, then the fallback control diagnosis is executed again in a case where the internal combustion engine 2 or the vehicle is in the operating state in which the fallback control diagnosis is once successful.

[0127] Therefore, according to this modification, the fallback control diagnosis can be executed under the condition that the diagnosis is simply successful, and it is possible to suppress the deviation of the actual torque of the internal combustion engine 2 from the required torque at the time of the fallback control diagnosis. (Ninth Modification)

[0128] In the above modification, the fallback diagnosis unit 30 diagnoses the fallback control when a predetermined diagnosis condition is met, such as when the vehicle is traveling at a constant speed or decelerating. The fallback control diagnosis is performed by executing fallback diagnosis processing in the monitoring microcomputer 20.

[0129] A range of torque fluctuation of the internal combustion engine 2 caused by switching control from regular control to fallback control also changes depending on a road environment in which the vehicle is traveling. For example, in a predetermined road environment, a torque fluctuation of the internal combustion engine 2 caused by switching from regular control to fallback control may be large. The torque fluctuations may be large, for example, when the vehicle is traveling in mountainous areas, when the road on which the vehicle is traveling is congested, or when the vehicle is traveling at low speed on a speed-regulated road.

[0130] Therefore, in this modified example, the fallback diagnosis unit 30 considers a road environment for fallback control in addition to the diagnosis condition. The fallback diagnosis unit 30 is configured to determine whether or not to execute the fallback control diagnosis based on both a driving state of the vehicle, such as constant speed driving or deceleration of the vehicle, and a road environment around the vehicle.

[0131] In this modification, the fallback diagnosis processing can be started in a case where the diagnosis condition is met based on the vehicle's motion state. In this case, as shown in Fig. 13, at S510, the device acquires information indicating a road environment around the vehicle using a navigation device or a GPS receiving device mounted on the vehicle.

[0132] In the subsequent step S520, it is determined whether or not the road environment obtained in S510 is a road environment suitable for fallback control diagnosis. If it is determined in S520 that the road environment around the vehicle is a road environment suitable for fallback control diagnosis, processing proceeds to S110 to execute the fallback control diagnosis.

[0133] If it is determined at S520 that the road environment obtained at S510 is not suitable for fallback control diagnosis, the fallback diagnosis processing is terminated without executing the fallback control diagnosis. For example, the fallback diagnosis processing is terminated without executing the fallback control diagnosis in a case where the vehicle is traveling in a mountainous area or in a case where the road on which the vehicle is traveling is congested.

[0134] Therefore, according to this modification, the fallback control diagnosis can be performed under a more successful diagnosis condition compared with the above embodiment. (Second embodiment)

[0135] Next, a second embodiment of the present disclosure will be described.

[0136] The control device 1 of the internal combustion engine 2 of the present embodiment has the same configuration as that of the first embodiment, and a difference from the first embodiment is an operation of the diagnosis monitoring unit 32. In the present embodiment, as shown in Fig. As shown in Figure 14, in the fallback diagnosis processing, a passenger is notified that the vehicle system is being diagnosed. Vehicle system diagnosis includes fallback control diagnosis. Vehicle system diagnosis may also be referred to as a system check. At S130, if it is determined that the actual torque of the internal combustion engine 2 deviates from the required torque by the allowable value or more, processing proceeds to S610. At S610, the passenger is notified that the system check is being performed, and processing proceeds to S140.

[0137] At S610, the device notifies a passenger of the vehicle that the device is currently performing the fallback control diagnosis by illuminating an indicator lamp, displaying a message on a display screen, outputting a voice message or an alarm sound, or the like. Thereafter, the fallback control diagnosis continues by proceeding to S140.

[0138] According to the present embodiment, when the actual torque of the internal combustion engine 2 deviates from the required torque by an allowable value or more when performing the fallback control diagnosis, it is possible to notify a passenger of the reason. Accordingly, it is possible to suppress a situation in which the passenger feels discomfort due to a change in the driving state accompanying the fallback control diagnosis.

[0139] The processing of S610 in the relapse diagnosis processing may be executed in the relapse diagnosis processing of the first embodiment or a modification thereof described above. (Other embodiments)

[0140] Although the embodiments and modifications of the present disclosure have been described above, the present disclosure is not limited to the above-described embodiments and modifications, and various modifications may be made to implement the present disclosure.

[0141] For example, in the above embodiment, the case where the technique of the present disclosure is applied to the control device for controlling fuel injection from the injector 4 provided in the internal combustion engine 2, which is the power source of the vehicle, is described. Even if the technique of the present disclosure is applied to the control device that controls a portion of the internal combustion engine 2 other than the injector 4, the same effect as that described above can be obtained. For example, this disclosure can be applied to a control device that controls an opening degree of a throttle valve provided in an intake system of the internal combustion engine 2, or the like.

[0142] Furthermore, the technique of the present disclosure is not limited to application to the internal combustion engine 2, which is a power source of a vehicle. For example, this disclosure is also applicable to a control device that controls a control object comprising a vehicle drive system around an internal combustion engine, a braking system such as a vehicle braking device, and a steering system such as a vehicle steering device.

[0143] Furthermore, any part of the Fig. 1 shown control device 1 may be provided by a dedicated computer or a hardware logic circuit or a combination of a computer and a logic circuit.

[0144] Furthermore, in the above embodiment, a plurality of functions of a component may be provided by a plurality of components, or a function of a component may be provided by a plurality of components. Furthermore, a plurality of functions of a plurality of components may be provided by a single component, or a single function provided by a plurality of components may be provided by a single component. Furthermore, part of the configuration of the above-described embodiment may be omitted. Furthermore, functions provided in the first and second embodiments described above and the first modification to the ninth modification may be appropriately provided by combination.

[0145] Furthermore, the present disclosure can be understood as a system having a control device as a component, a program for operating a computer as a control device, or a non-volatile tangible recording medium such as a semiconductor memory in which this program is recorded. Furthermore, this disclosure can be understood as a control method.

Claims

[1] A control device for a vehicle, the control device comprising: a regular control unit (10) configured to control a control object (2) to move a vehicle so that the control object is in a predetermined target state; a fallback control unit (22) configured to control the control object by fallback control in which a control function is restricted compared to regular control by the regular control unit in a case where an abnormality occurs in the control of the control object by the regular control unit; a fallback diagnostic unit (30) configured to: (i) to switch the control of the control object to fallback control by the fallback control unit in a case where a predetermined diagnostic condition is satisfied during execution of the regular control by the regular control unit; (ii) to diagnose whether or not the fallback control is being properly executed; and (iii) return to regular control by the regular control unit in a case where the diagnosis is completed; and a diagnostic monitoring unit (32) configured to: (iv) monitor a state of the control object in a case where the fallback diagnosis unit switches the control of the control object to fallback control; and (v) return the control of the control object to regular control by the regular control unit by stopping the diagnosis of the fallback control by the fallback diagnosis unit in a case where the control object deviates from the target state by an allowable value or more. [2] The control device according to claim 1, wherein the diagnosis monitoring unit is configured to return the control of the control object to the regular control by stopping a fallback control diagnosis by the fallback diagnosis unit in a case where a state in which the control object deviates from the target state by the allowable value or more continues for a predetermined time or more. [3] Control device according to claim 1 or 2, wherein the diagnosis monitoring unit is configured to store a current operation state of the control object as a diagnosis impossible state in a case where the control object deviates from the target state by the allowable value or more and a fallback control diagnosis by the fallback diagnosis unit is stopped, and wherein the fallback diagnosis unit is configured not to execute the fallback control diagnosis in a case where the control object is in the diagnosis impossible state after the control of the control object is returned to regular control by stopping the fallback control diagnosis by the diagnosis monitoring unit. [4] The control device according to any one of claims 1 to 3, wherein the fallback diagnosis unit is configured not to execute a fallback control diagnosis until a predetermined time has elapsed after the control of the control object is returned to regular control by stopping the fallback control diagnosis by the diagnosis monitoring unit. [5] The control device according to any one of claims 1 to 3, wherein the fallback diagnosis unit is configured not to execute a fallback control diagnosis until an operation of the control device is turned off and restarted after the control of the control object is returned to regular control by stopping the fallback control diagnosis by the diagnosis monitoring unit. [6] The control device according to any one of claims 1 to 3, wherein the fallback diagnosis unit is configured to execute a fallback control diagnosis by switching the control of the control object to the fallback control in a case where a retry diagnosis condition enabling a higher probability of success of the fallback control diagnosis than the diagnosis condition is satisfied after the control of the control object is returned to the regular control by stopping the fallback control diagnosis by the diagnosis monitoring unit. [7] The control device according to any one of claims 1 to 6, wherein the fallback diagnosis unit is configured not to execute a fallback control diagnosis until an operation of the control device is turned off and restarted after the fallback control diagnosis is completed. [8] The control device according to any one of claims 1 to 6, wherein the fallback diagnosis unit is configured to store a current operation state of the control object as a diagnosis completion state in a case where a fallback control diagnosis is completed, and then execute the fallback control diagnosis in a case where the control object is in an operation state different from the diagnosis completion state. [9] The control device according to any one of claims 1 to 6, wherein the fallback diagnosis unit is configured to store a current operation state of the control object as a diagnosis completion state in a case where a fallback control diagnosis is completed, and then execute the fallback control diagnosis in a case where an operation state of the control object is in the diagnosis completion state. [10] Control device according to one of claims 1 to 9, wherein the diagnosis condition is set to include a predetermined movement state of the vehicle so that a movement fluctuation of the vehicle caused by switching the control of the control object from the regular control to the fallback control is reduced; and wherein the fallback diagnosis unit is configured to enable fallback control diagnosis in a case where a motion state of the vehicle is the motion state set as the diagnosis condition. [11] Control device according to claim 10, wherein the diagnostic condition includes a road environment around the vehicle in addition to the vehicle's motion state, and wherein the fallback diagnosis unit is configured to acquire a road environment while the vehicle is moving and to determine whether or not the diagnosis condition is satisfied based on the road environment and the moving state. [12] A control device for a vehicle, the control device comprising: a regular control unit (10) configured to control a control object (2) to move a vehicle so that the control object is in a predetermined target state; a fallback control unit (22) configured to control the control object by fallback control in which a control function is restricted compared to regular control by the regular control unit in a case where an abnormality occurs in the control of the control object by the regular control unit; a fallback diagnostic unit (30) configured to: (i) switching the control of the control object to fallback control by the fallback control unit under a predetermined diagnostic condition during execution of the regular control by the regular control unit; (ii) to diagnose whether or not the fallback control is being properly executed; and (iii) return to regular control by the regular control unit after the diagnosis is completed; and a diagnostic monitoring unit (32) configured to: (iv) monitor a state of the control object in a case where the fallback diagnosis unit switches the control of the control object to fallback control; and (vi) to notify about execution of the fallback control diagnosis in a case where the control object deviates from the target state by an allowable value or more.

Images