Vehicle control device

Abstract

To provide a vehicle control apparatus with a fail-safe function improved.SOLUTION: A vehicle control apparatus includes: a rotary electric machine; a battery for the rotary electric machine; a first control part for monitoring a state of the battery to detect an abnormal state of the battery; a second control part for controlling an output of the rotary electric machine; and a third control part for instructing the second control part to output from the rotary electric machine on the basis of a result of monitoring the battery state and executing operation limitation of the rotary electric machine in a case where the first control part detects a battery abnormality. Further, in the case of detecting a battery abnormality and non-execution of operation limitation of the rotary electric machine on the basis of the result of monitoring, the first control part instructs the second control part to stop operating the rotary electric machine; the third control part outputs a status signal that represents the status. Further, in the case that the status signal indicates an abnormal state of the third control part, the second control part causes the rotary electric machine to stop in accordance with the stop instruction of the rotary electric machine from the first control part, whereas in the case that the status signal indicates a normal state of the third control part, the second control part causes the rotary electric machine to continue operation.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a vehicle control device. [Background technology]

[0002] For example, Patent Document 1 discloses that, in the event of a failure that prevents current from flowing from the rotating electric machine to the battery, control is executed to set the output torque of the rotating electric machine to zero. Such a fail-safe operation is executed, for example, by a vehicle ECU (Electric Control Unit) that commands the torque of the motor. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2019-201467 A Summary of the Invention [Problem to be solved by the invention]

[0004] When the vehicle ECU fails and is unable to execute a fail-safe operation, it is conceivable that the motor ECU may stop the operation of the rotating electric machine, for example. However, the motor ECU cannot independently determine whether or not the fail-safe operation can be executed.

[0005] The present invention has been made in consideration of the above problems, and has an object to provide a vehicle control device with improved fail-safe function. [Means for solving the problem]

[0006] The vehicle control device of the present invention includes a rotating electric machine that drives a vehicle, a battery electrically connected to the rotating electric machine, a first control unit that monitors a state of the battery and detects an abnormal state from a result of monitoring the state of the battery, a second control unit that controls an output of the rotating electric machine, and a third control unit that instructs the second control unit to output the rotating electric machine based on the result of monitoring the state of the battery and restricts the operation of the rotating electric machine when the first control unit detects an abnormality of the battery, and when the first control unit detects that the battery is in an abnormal state based on the result of monitoring the state of the battery and that restriction of the operation of the rotating electric machine is not being executed due to the abnormal state of the third control unit, the first control unit instructs the second control unit to stop the operation of the rotating electric machine, and the third control unit outputs a state signal indicating a normal state or abnormal state of the third control unit to the second control unit, and when the state signal indicates the abnormal state of the third control unit, the second control unit stops the operation of the rotating electric machine in accordance with the instruction to stop the rotating electric machine from the first control unit, When the state signal indicates that the third control unit is in a normal state, the third control unit continues operation of the rotating electric machine without following an instruction from the first control unit to stop the rotating electric machine.

[0007] In the above configuration, the control unit may determine that the indication unit is in a normal state when the status signal has a predetermined regularity, and may determine that the indication unit is in an abnormal state when the status signal does not have the predetermined regularity.

[0008] In the aforementioned configuration, the third control unit may output the status signal that repeats a predetermined numerical pattern at a constant cycle when in a normal state.

[0009] In the above configuration, the third control unit may restrict the operation of the rotating electric machine by cutting off the electrical connection between the rotating electric machine and the battery when the first control unit detects an abnormality in the battery.

[0010] In the above configuration, when the first control unit determines, based on the results of monitoring the state of the battery, that the value of the current flowing between the rotating electric machine and the battery is less than a threshold value, it may detect that restriction on the operation of the rotating electric machine is not being executed due to an abnormal state of the third control unit. Effect of the Invention

[0011] According to the present invention, the fail-safe function of the vehicle control device can be improved. [Brief description of the drawings]

[0012] [Figure 1] FIG. 1 is a configuration diagram showing an example of a vehicle. [Diagram 2] 1 is a diagram showing an example of a frame signal of a local communication bus and a frame signal of a global communication bus; [Diagram 3] FIG. 11 is a diagram illustrating an example of a state determination value. [Figure 4] 5 is a sequence diagram showing an example of the operation of the battery ECU, the vehicle ECU, and the motor ECU when the battery is normal. FIG. [Diagram 5] 5 is a sequence diagram showing an example of the operation of a battery ECU, a vehicle ECU, and a motor ECU when the battery is in an abnormal state. FIG. [Figure 6] FIG. 4 is a diagram illustrating an example of a fail-safe operation of the vehicle ECU. [Figure 7] 10 is a sequence diagram showing another example of the operation of the battery ECU, the vehicle ECU, and the motor ECU when the battery is in an abnormal state. [Figure 8] FIG. 11 is a diagram illustrating an example of a forced stop of the operation of the motor generator. [Figure 9] 10 is a sequence diagram showing an operation of the motor ECU when a false forced stop instruction is transmitted while the vehicle ECU is in a normal state. FIG. [Figure 10] 4 is a flowchart showing an example of an operation of the battery ECU. [Figure 11] 5 is a flowchart showing a state determination process of a vehicle ECU based on a state determination value N. [Figure 12] 4 is a flowchart showing an example of a control process of a motor generator. [Figure 13] FIG. 4 is a diagram illustrating an example of a switching signal. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] (Vehicle configuration) 1 is a configuration diagram showing an example of a vehicle 9. The vehicle 9 includes a vehicle control device 1, a sensor unit 20, a battery 21, a system main relay (SMR) 22, a boost converter 23, an inverter 24, a motor generator (MG) 25, a current sensor 26, a rotational position sensor 27, and a wheel mechanism 28. Note that the vehicle 9 may be, but is not limited to, a hybrid vehicle or an electric vehicle.

[0014] The battery 21 is, for example, a lithium ion battery, and is electrically connected to the MG 25. The battery 21 supplies power to the MG 25 during power running, and is charged with power generated by the MG 25 during regenerative operation. The sensor unit 20 is, for example, a battery sensor, and detects various values ​​related to the operating state of the battery. Examples of detected values ​​of the sensor unit 20 include, but are not limited to, the current value, voltage value, and temperature of the battery 21.

[0015] The battery 21 is electrically connected to the boost converter 23 via the SMR 22. The boost converter 23 boosts the DC voltage input from the battery 21 to a target voltage. The boost converter 23 is electrically connected to the inverter 24. The DC voltage is applied from the boost converter 23 to the inverter 24.

[0016] The inverter 24 has a plurality of switching elements, such as IGBTs (Insulated Gate Bipolar Transistors). Each switching element of the inverter 24 is on / off controlled by a switching signal input from the vehicle control device 1. As a result, the inverter 24 generates a three-phase (u-phase, v-phase, and w-phase) AC current from a DC voltage.

[0017] The current sensor 26 detects, for example, the current values ​​of the u-phase and v-phase of the three-phase AC current output from the inverter 24 to the MG 25. The rotational position sensor 27 is, for example, a resolver, and detects the rotational position of the rotor of the MG 25.

[0018] The MG 25 generates torque from the three-phase AC current input from the inverter 24 and outputs the torque to the wheel mechanism 28. The wheel mechanism 28 includes a gear mechanism 280 connected to a rotating shaft of the MG 25, an axle 281, and wheels 282. The wheel mechanism 28 converts the torque of the MG 25 into driving force for the wheels 282. The MG 25 is an example of a rotating electric machine that drives the vehicle 9.

[0019] The vehicle control device 1 controls, for example, the inverter 24 so that the vehicle 9 is driven in accordance with a user's operation, and executes a fail-safe operation so that the vehicle 9 can be safely stopped if an abnormality occurs in the battery 21. The vehicle control device 1 has a battery ECU 10, a vehicle ECU 11, a motor ECU 12, an accelerator sensor 13, a brake sensor 14, a speed sensor 15, a communication interface unit 16, and a central gateway (central GW) 17.

[0020] The central GW 17 has a plurality of global communication buses GBa to GBc for performing communication based on a CAN (Controller Areas Network). A battery ECU 10, a vehicle ECU 11, a motor ECU 12, etc. are electrically connected to the global communication bus GBa. An accelerator sensor 13, a brake sensor 14, a speed sensor 15, etc. are electrically connected to the global communication bus GBb. A communication interface unit 16, etc. are electrically connected to the global communication bus GBc.

[0021] The central GW 17 transfers frame signals between the multiple global communication buses GBa to GBc, thereby enabling the battery ECU 10, the vehicle ECU 11, the motor ECU 12, the accelerator sensor 13, the brake sensor 14, the speed sensor 15, and the communication interface unit 16 to transmit and receive frame signals to and from each other.

[0022] The communication interface unit 16 is, for example, a communication circuit for a wireless LAN (Local Area Network), and processes communication between a terminal device 8, such as a smartphone, outside the vehicle 9 and the vehicle control device 1. The communication interface unit 16 transmits and receives diagnostic information of the vehicle 9 and the like to and from the terminal device 8 when, for example, a fault diagnosis of the vehicle 9 is executed.

[0023] The accelerator sensor 13 detects the depression of an accelerator pedal (not shown) of the vehicle 9. The brake sensor 14 detects the depression of a brake pedal (not shown) of the vehicle 9. The speed sensor 15 detects the speed of the vehicle 9. The accelerator sensor 13, the brake sensor 14, and the speed sensor 15 notify the detection values ​​to the vehicle ECU 11 via global communication buses GBa and GBb.

[0024] The battery ECU 10, the vehicle ECU 11, and the motor ECU 12 are, for example, microcontrollers, but are not limited thereto, and may be integrated circuits such as a field programmable gate array (FPGA) or an application specified integrated circuit (ASIC). The battery ECU 10 and the vehicle ECU 11 communicate with each other via a local communication bus LBa, and the vehicle ECU 11 and the motor ECU 12 communicate with each other via a local communication bus LBb. The local communication buses LBa and LBb are communication lines based on CAN, similar to the global communication buses GBa to GBc.

[0025] The battery ECU 10 monitors the state of the battery 21 by acquiring various detection values ​​related to the state of the battery 21 from the sensor unit 20. The battery ECU 10 calculates the charge amount and input / output limit values ​​of the battery 21 from each detection value, and further determines whether the battery 21 is in an abnormal state from each detection value.

[0026] The battery ECU 10 calculates the charge amount of the battery from, for example, the voltage of the battery 21 detected by the sensor unit 20, and calculates the input / output limit values ​​from the temperature and voltage of the battery 21 detected by the sensor unit 20. The battery ECU 10 notifies the vehicle ECU 11 of the charge amount, input / output limit values, etc. of the battery 21 as the monitoring results of the battery 21 via the local communication bus LBa.

[0027] Furthermore, the battery ECU 10 determines that the battery 21 is in an abnormal state, for example, when the temperature of the battery 21 detected by the sensor unit 20 is equal to or higher than a threshold (i.e., in an overheated state) or when the voltage of the battery 21 detected by the sensor unit 20 is equal to or higher than a threshold (i.e., in an overvoltage state). The battery ECU 10 notifies the vehicle ECU 11 of the abnormal state of the battery 21 via the local communication bus LBa.

[0028] In this way, the battery ECU 10 monitors the state of the battery 21 and detects an abnormal state from the monitoring result of the battery 21. The battery ECU 10 is an example of a first control unit.

[0029] The vehicle ECU 11 receives detection values ​​from the accelerator sensor 13, the brake sensor 14, and the speed sensor 15 via a global communication bus GBa. The vehicle ECU 11 also receives the charge amount, input / output limit values, and the like as monitoring results of the battery 21 from the battery ECU 10 via a local communication bus LBa. The vehicle ECU 11 calculates a torque command value for the MG 25 based on the detection values ​​from the accelerator sensor 13, the brake sensor 14, and the speed sensor 15 and the monitoring results of the battery 21.

[0030] The vehicle ECU 11 notifies the motor ECU 12 of the torque command value via the local communication bus LBb. That is, the vehicle ECU 11 instructs the motor ECU 12 to output the MG 25 based on the result of monitoring the state of the battery 21.

[0031] Furthermore, the vehicle ECU 11 executes a fail-safe operation that restricts the operation of the MG 25 when the battery ECU 10 detects an abnormality in the battery 21. For example, when the vehicle ECU 11 receives a notification of an abnormal state of the battery 21 from the battery ECU 10, the vehicle ECU 11 switches the SMR 22 to a cut-off state. This cuts off the electrical connection between the MG 25 and the battery 21, thereby preventing the operation of the vehicle 9 from becoming abnormal. Note that the fail-safe operation is not limited to the electrical connection between the MG 25 and the battery 21, and other means for safely stopping the operation of the MG 25 may be used. The vehicle ECU 11 is an example of a third control unit.

[0032] The motor ECU 12 controls the torque of the MG 25 by outputting a switching signal to the inverter 24. The motor ECU 12 receives a torque command value from the vehicle ECU 11 via the local communication bus LBb, and controls the duty ratio of the switching signal so that the MG 25 outputs a torque corresponding to the torque command value. At this time, the motor ECU 12 controls the duty ratio based on a current value detected by a current sensor 26 and a rotational position of the rotor of the MG 25 detected by a rotational position sensor 27. The motor ECU 12 is an example of a control unit that controls the output of the MG 25.

[0033] Furthermore, when the vehicle ECU 11 executes a fail-safe operation, the motor ECU 12 receives a torque output stop command from the vehicle ECU 11 via the local communication bus LBb. In this case, the motor ECU 12 controls the duty ratio of the switching signal so that the three-phase AC current is set to 0 (A), for example, in order to stop the torque output from the MG 25.

[0034] When the battery ECU 10 detects an abnormality from the monitoring result of the battery 21, it further judges whether the fail-safe operation by the vehicle ECU 11 has been successful based on the detection value of the sensor unit 20. For example, when the current value of the battery 21 detected by the sensor unit 20 is substantially 0 (A), the battery ECU 10 judges that the fail-safe operation has been successful because no current flows from the battery 21 to the MG 25.

[0035] If the vehicle ECU 11 is in an abnormal state due to a breakdown, it cannot perform the fail-safe operation. In this case, the current value of the battery 21 detected by the sensor unit 20 is not 0 (A), so the battery ECU 10 determines that the fail-safe operation has failed.

[0036] When the battery ECU 10 determines that the fail-safe operation has failed, it transmits a forced stop instruction to the motor ECU 12 via the global communication bus GBa. The motor ECU 12 stops the operation of the MG 25 in accordance with the forced stop instruction. For example, the motor ECU 12 outputs a forced stop signal to the inverter 24 to shut off the gate of the IGBT of the inverter 24, thereby forcibly stopping the operation of the MG 25.

[0037] In this way, when the battery ECU 10 detects, based on the monitoring results of the battery 21, that the battery 21 is in an abnormal state and that the restriction on the operation of the MG 25 is not being executed due to the abnormal state of the vehicle ECU 11, it instructs the motor ECU 12 to stop the operation of the MG 25.

[0038] The motor ECU 12 stops the operation of the MG 25 in accordance with the forced stop instruction only when the vehicle ECU 11 has a malfunction. The vehicle ECU 11 periodically transmits an abnormality determination signal used for abnormality determination of the vehicle ECU 11 to the motor ECU 12 via the local communication bus LBb. The abnormality determination signal is an example of a state signal indicating a normal state or an abnormal state of the vehicle ECU 11. In this example, the abnormality determination signal indicates a periodic counter value, but is not limited to this and may be a periodic pulse signal.

[0039] When the abnormality determination signal indicates an abnormal state of the vehicle ECU 11, the motor ECU 12 stops the operation of the MG 25 in accordance with the forced stop instruction from the battery ECU 10, and when the abnormality determination signal indicates a normal state of the vehicle ECU 11, the motor ECU 12 continues the operation of the MG 25 without following the forced stop instruction. Therefore, the motor ECU 12 can stop the operation of the MG 25 only when the vehicle ECU 11 has failed.

[0040] The global communication bus GBa, through which the forced stop instruction is transmitted and received, is connected to the communication interface unit 16 via the central GW 17. For this reason, it is conceivable that, for example, a malicious user may transmit a false forced stop instruction to the motor ECU 12 from the terminal device 8 via the communication interface unit 16.

[0041] However, the motor ECU 12 does not stop the operation of the MG 25 in accordance with a false forced stop instruction because it stops the operation of the MG 25 in accordance with the forced stop instruction from the battery ECU 10 only when the abnormality determination signal indicates an abnormal state of the vehicle ECU 11. Also, there is no need to provide a costly encryption means or the like on the global communication buses GBa to GBc in order to prevent false forced stop instructions.

[0042] (Frame signal) 2 is a diagram showing an example of a frame signal Fa of the local communication buses LBa and LBb and a frame signal Fb of the global communication buses GBa to GBc. Each of the frame signals Fa and Fb has, as an example, a data ID, a data area, and a CRC (Cyclic redundancy Check) area.

[0043] The data ID is an identifier for identifying the type of data stored in the data area. The battery ECU 10, the vehicle ECU 11, the motor ECU 12, and the communication interface unit 16 identify the frame signal to be received by the data ID. In addition, the battery ECU 10, the vehicle ECU 11, the motor ECU 12, the accelerator sensor 13, the brake sensor 14, the speed sensor 15, and the communication interface unit 16 transmit a frame signal with a data ID corresponding to the data to be transmitted.

[0044] The data area contains various data. The CRC area contains a check code that checks for errors in the data in the data area. Errors in data up to a certain number of bits can be corrected by the check code.

[0045] The data of the frame signal Fa of the local communication buses LBa and LBb includes, for example, battery state information, battery abnormality information, a torque command value, a torque output stop instruction, and a state determination value. The battery ECU 10 stores the charge amount and input / output limit value of the battery 21 in the data area of ​​the frame signal Fa as battery state information and transmits the same. The battery ECU 10 also stores the abnormal state of the battery 21 in the data area of ​​the frame signal Fa as battery abnormality information and transmits the same.

[0046] The vehicle ECU 11 stores a torque command value of the MG 25 in the data area of ​​the frame signal Fa and transmits it. When performing a fail-safe operation, the vehicle ECU 11 stores a torque output stop instruction in the data area of ​​the frame signal Fa and transmits it. The vehicle ECU 11 also periodically stores a state determination value in the data area of ​​the frame signal Fa and transmits it. The vehicle ECU 11 also periodically stores a state determination value in the data area of ​​the frame signal Fa and transmits it.

[0047] On the other hand, data of the frame signal Fb of the global communication buses GBa to GBc includes, for example, diagnostic information, accelerator sensor values, brake sensor values, speed sensor values, and forced stop instructions. The communication interface unit 16 receives the frame signal Fb, in which the diagnostic information is stored in the data area, from the vehicle ECU 11 or the like, and transfers it to the terminal device 8.

[0048] The accelerator sensor 13 stores an accelerator sensor value indicating the opening degree of the accelerator pedal in the data area of ​​the frame signal Fb and transmits it. The brake sensor 14 stores a brake sensor value indicating the opening degree of the brake pedal in the data area of ​​the frame signal Fb and transmits it. The speed sensor 15 stores a speed sensor value indicating the speed of the vehicle 9 in the data area of ​​the frame signal Fb and transmits it. If the fail-safe operation fails, the battery ECU 10 stores a forced stop instruction in the data area of ​​the frame signal Fb and transmits it.

[0049] (Status judgment value) 3 is a diagram showing an example of the state determination value. Reference character G1a shows an example of a time change in the state determination value when the vehicle ECU 11 is normal. The state determination value increases by one from "0" to "6" for example every predetermined period Δt. The state determination value indicates the normal state of the vehicle ECU 11 by repeatedly counting up within the range of "0" to "6". As shown by the arrow, the motor ECU 12 reads out the state determination value every period Δt, and determines that the vehicle ECU 11 is normal if the state determination value is counted up normally.

[0050] Reference symbol G2a shows an example of a change in the state determination value over time when the vehicle ECU 11 has a malfunction. In this example, the state determination value is not "5" at time t1, but is "4" like the previous cycle, and continues to be "4" thereafter. The motor ECU 12 detects that the state determination value is not counting up normally at time t1, and thereby determines that the vehicle ECU 11 is in an abnormal state.

[0051] Reference symbol G3a shows another example of a change in the state determination value over time when the vehicle ECU 11 has a malfunction. In this example, the state determination value is not "6" at time t2, but "0" after "6". In other words, the state determination value counts up by skipping "6". The motor ECU 12 detects that the state determination value is not counting up normally at time t2, and thereby determines that the vehicle ECU 11 is in an abnormal state.

[0052] In this way, when the vehicle ECU 11 is in an abnormal state, the vehicle ECU 11 outputs a state determination value that repeats a predetermined numerical pattern at a constant cycle, so that the motor ECU 12 can easily determine the abnormal state of the vehicle ECU 11 by using, for example, a counter that counts up at a cycle Δt.

[0053] The state determination value is not limited to the above-mentioned repeated count-up, and may be, for example, a simple periodic pulse pattern or a repeated predetermined numerical value pattern. In other words, the state determination value may have a predetermined regularity.

[0054] That is, when the state determination value has a predetermined regularity, the motor ECU 12 determines that the vehicle ECU 11 is in a normal state, and when the state determination value does not have the predetermined regularity, the motor ECU 12 determines that the vehicle ECU 11 is in an abnormal state. Therefore, the motor ECU 12 can detect a failure of the vehicle ECU 11 more accurately than when the failure of the vehicle ECU 11 is determined simply from the level (high level or low level) of the signal value, for example.

[0055] (Operation sequence of battery ECU, vehicle ECU, and motor ECU) 4 is a sequence diagram showing an example of the operations of the battery ECU 10, the vehicle ECU 11, and the motor ECU 12 when the battery 21 is normal. The battery ECU 10 monitors the state of the battery 21 by acquiring each detection value from the sensor unit 20 (reference S1). The battery ECU 10 calculates the charge amount and input / output limit values ​​from the monitoring results and transmits them to the vehicle ECU 11 as battery state information.

[0056] Further, the vehicle ECU 11 transmits a state determination value indicating a normal state to the motor ECU 12. The motor ECU 12 determines that the vehicle ECU 11 is in a normal state based on the state determination value (reference S4).

[0057] Next, the vehicle ECU 11 receives the accelerator sensor value, the brake sensor value, and the speed sensor value (reference S2), and then calculates a torque command value from the accelerator sensor value, the brake sensor value, the speed sensor value, and the battery state information (reference S3).

[0058] Next, the vehicle ECU 11 transmits the torque command value to the motor ECU 12. The motor ECU 12 controls the MG 25 by outputting a switching signal to the inverter 24 based on the torque command value (reference S5).

[0059] 5 is a sequence diagram showing an example of the operations of the battery ECU 10, the vehicle ECU 11, and the motor ECU 12 when the battery 21 is in an abnormal state. In this example, the vehicle ECU 11 is in a normal state.

[0060] The battery ECU 10 monitors the state of the battery 21 by acquiring each detection value from the sensor unit 20 (reference S11). In this example, the battery ECU 10 determines that the battery 21 is in an abnormal state because, for example, the temperature detected by the sensor unit 20 is equal to or higher than a threshold value. The battery ECU 10 transmits battery abnormality information to the vehicle ECU 11.

[0061] In addition, the vehicle ECU 11 transmits a state determination value indicating a normal state to the motor ECU 12. The motor ECU 12 determines that the vehicle ECU 11 is in a normal state based on the state determination value (reference S13). In addition, the vehicle ECU 11 receives the accelerator sensor value, the brake sensor value, and the speed sensor value via the global communication bus GBa (reference S12).

[0062] Next, when the vehicle ECU 11 receives the battery abnormality information, it shifts to the fail-safe mode without calculating the normal torque command value (step S14). Next, the vehicle ECU 11 shuts off the SMR 22 in the fail-safe mode (step S15). As a result, the electrical connection between the battery 21 and the MG 25 is disconnected.

[0063] Next, the vehicle ECU 11 transmits a torque output stop instruction to the motor ECU 12. When receiving the torque output stop instruction, the motor ECU 12 performs torque output stop control on the inverter 24 (step S16). At this time, the motor ECU 12 controls the duty ratio of the switching signal so that the three-phase alternating current becomes 0 (A). As a result, the operation of the MG 25 stops.

[0064] In addition, since the battery ECU 10 has detected an abnormal state of the battery 21, it acquires the current value of the battery 21 from the sensor unit 20 after, for example, a period T has elapsed from the transmission timing of the battery abnormality information (step S17). That is, the battery ECU 10 monitors the battery 21 again. The battery ECU 10 compares the current value of the battery 21 with the threshold value TH, and determines that the fail-safe operation of the vehicle ECU 11 is successful by detecting that the current value is substantially 0 (A), that is, the current value <TH (step S18).

[0065] FIG. 6 is a diagram showing an example of the fail-safe operation of the vehicle ECU 11. Since the battery 21 is in an abnormal state, the vehicle ECU 11 shifts to the fail-safe mode and outputs a cutoff signal to the SMR 22 to cut off the electrical connection between the battery 21 and the MG 25. For this reason, the current value of the battery 21 becomes less than the threshold value TH (substantially 0 (A)), and the battery ECU 10 determines that the fail-safe (FS) operation of the vehicle ECU 11 has been successful.

[0066] In addition, since the vehicle ECU 11 controls the SMR 22 to be in the cutoff state, it transmits a torque output stop instruction to the motor ECU 12. The motor ECU 12 outputs a switching signal to the inverter 24 so that the three-phase alternating current becomes 0 (A) according to the torque output stop instruction.

[0067] In this way, when the battery 21 is in an abnormal state, the vehicle ECU 11 can safely stop the operation of the vehicle 9 by performing a fail-safe operation.

[0068] 7 is a sequence diagram showing another example of the operations of the battery ECU 10, the vehicle ECU 11, and the motor ECU 12 when the battery 21 is in an abnormal state. In this example, the vehicle ECU 11 is in an abnormal state.

[0069] The battery ECU 10 monitors the state of the battery 21 by acquiring each detection value from the sensor unit 20 (reference S21). In this example, the battery ECU 10 determines that the battery 21 is in an abnormal state from each detection value of the sensor unit 20. The battery ECU 10 transmits battery abnormality information to the vehicle ECU 11.

[0070] A malfunction has occurred in the vehicle ECU 11 (reference S22). Due to the malfunction, the vehicle ECU 11 is unable to normally count up the state determination value. Therefore, the vehicle ECU 11 transmits a state determination value indicating an abnormal state to the motor ECU 12. The motor ECU 12 receives the state determination value and determines that the vehicle ECU 11 is in an abnormal state (reference S23).

[0071] Furthermore, since the battery ECU 10 has detected an abnormal state of the battery 21, after a period of time T has elapsed from the timing of transmitting the battery abnormality information, the battery ECU 10 acquires the current value of the battery 21 from the sensor unit 20 (reference S24). That is, the battery ECU 10 again monitors the battery 21. The battery ECU 10 compares the current value of the battery 21 with the threshold value TH, and detects that the current value is not 0 (A), that is, that the current value is equal to or greater than TH, thereby determining that the fail-safe operation of the vehicle ECU 11 has failed (reference S25).

[0072] Since the fail-safe operation has failed, the battery ECU 10 transmits a forced stop instruction to the motor ECU 12. The motor ECU 12 performs gate cutoff for the inverter 24 in accordance with the forced stop instruction, thereby forcibly stopping the operation of the MG 25 (reference S26).

[0073] 8 is a diagram showing an example of a forced stop of the operation of the MG 25. Due to a malfunction, the vehicle ECU 11 cannot cut off the SMR 22 (see symbol Pa). Therefore, the connection between the battery 21 and the MG 25 remains maintained.

[0074] Furthermore, due to the failure, the vehicle ECU 11 cannot transmit a torque output stop command to the motor ECU 12 (see symbol Pb), and therefore the motor ECU 12 cannot control the three-phase AC current to 0 (A) by a switching signal (see symbol Pc).

[0075] Because the SMR 22 is not cut off, the current value of the battery 21 becomes equal to or greater than the threshold value TH, and the battery ECU 10 determines that the fail-safe (FS) operation has failed. Therefore, the battery ECU 10 transmits a forced stop command to the motor ECU 12 via the global communication bus GBa.

[0076] In this way, when the battery ECU 10 determines, based on the results of monitoring the battery 21, that the value of the current flowing between the MG 25 and the battery 21 is less than the threshold value, it detects that the restriction on the operation of the MG 25 is not being executed due to an abnormal state of the vehicle ECU 11. Therefore, the battery ECU 10 can easily determine that the restriction on the operation of the MG 25 is not being executed.

[0077] Since the vehicle ECU 11 has a failure, the motor ECU 12 outputs a forced stop signal to the inverter 24 in accordance with the forced stop instruction. As a result, the IGBT in the inverter 24 is forced to be in the OFF state, and the operation of the inverter 24 is stopped. As a result, the operation of the MG 25 is forced to be stopped.

[0078] In this way, when the motor ECU 12 determines that the vehicle ECU 11 is in an abnormal state, it performs control to forcibly stop the operation of the MG 25 in accordance with the forced stop instruction received from the battery ECU 10. However, as described below, when the motor ECU 12 determines that the vehicle ECU 11 is in a normal state, it does not stop the operation of the MG 25 even if it receives a forced stop instruction.

[0079] 9 is a sequence diagram showing the operation of the motor ECU 12 when a false forced stop instruction is transmitted in a case where the vehicle ECU 11 is in a normal state. In this example, the vehicle ECU 11 is in a normal state.

[0080] The vehicle ECU 11 transmits a state determination value indicating a normal state to the motor ECU 12. The motor ECU 12 determines that the vehicle ECU 11 is in a normal state based on the state determination value (reference S31).

[0081] For example, a malicious user inputs a false forced stop instruction to the communication interface unit 16 from the terminal device 8. The false forced stop instruction is transmitted from the communication interface unit 16 to the motor ECU 12.

[0082] However, since the motor ECU 12 has already determined that the vehicle ECU 11 is in a normal state, the motor ECU 12 discards the false forced stop instruction (reference S32). Therefore, the motor ECU 12 is restrained from stopping the operation of the MG 25 in accordance with the false forced stop instruction. This also applies to a case where the motor ECU 12 erroneously transmits a forced stop instruction even though the vehicle ECU 11 is in a normal state. That is, when the state determination value indicates a normal state, the motor ECU 12 continues the operation of the MG 25 without following the forced stop instruction.

[0083] 10 is a flowchart showing an example of the operation of the battery ECU 10. The battery ECU 10 acquires each detection value of the battery 21 from the sensor unit 20 (step St1).

[0084] Next, the battery ECU 10 determines whether the battery 21 is in an abnormal state based on each detected value of the battery 21 (step St2). When the battery 21 is in a normal state (No in step St2), the battery ECU 10 transmits battery state information such as the state of charge and input / output limit values to the vehicle ECU 11 (step St9).

[0085] Also, when the battery 21 is in an abnormal state (Yes in step St2), the battery ECU 10 transmits battery abnormality information to the vehicle ECU 11 to shift the vehicle ECU 11 to the fail-safe mode (step St3). Examples of the abnormal state of the battery 21 include overvoltage, failure of the sensor unit 20, and high temperature. After that, the battery ECU 10 waits for a period T required for the completion of the fail-safe operation (step St4).

[0086] Next, the battery ECU 10 acquires the current value of the battery 21 from the sensor unit 20 (step St5). Next, the battery ECU 10 compares the current value with a threshold TH (>0) (step St6).

[0087] When the current value < TH holds (No in step St6), the battery ECU 10 determines that the current value has become substantially 0 (A) due to the fail-safe operation and determines that the fail-safe operation of the vehicle ECU 11 has been successful (step St10). After that, the battery ECU 10 ends the operation.

[0088] Also, when the current value ≥ TH holds (Yes in step St6), the battery ECU 10 determines that the fail-safe operation of the vehicle ECU 11 has failed (step St7). Next, the battery ECU 10 transmits a forced stop instruction to the motor ECU 12 via the global communication bus GBa (step St8). After that, the battery ECU 10 ends the operation.

[0089] In this way, when the battery ECU 10 detects, based on the monitoring results of the battery 21, that the battery 21 is in an abnormal state and that the restriction on the operation of the MG 25 is not being executed due to the abnormal state of the vehicle ECU 11, it instructs the motor ECU 12 to stop the operation of the MG 25.

[0090] Furthermore, the battery ECU 10 determines that the fail-safe operation has been successful when the value of the current flowing between the MG 25 and the battery 21 is less than the threshold value TH, and determines that the fail-safe operation has failed when the value of the current is equal to or greater than the threshold value TH. Therefore, the battery ECU 10 can easily determine from the current value whether the fail-safe operation of cutting off the connection between the MG 25 and the battery 21 has been successful.

[0091] Fig. 11 is a flowchart showing the state determination process of the vehicle ECU 11 based on the state determination value N. This process is executed at each period Δt shown in Fig. 3. A variable n (=0, 1, 2, . . . , 6) is an expected value of the state determination value N. It is assumed that the initial values ​​of the variable n and the state determination value N are "0".

[0092] The motor ECU 12 acquires the state determination value N from the vehicle ECU 11 via the local communication bus LBb (step St21). Next, the motor ECU 12 compares the state determination value N with the variable n (step St22). If the state determination value N and the variable n match each other (Yes in step St22), the motor ECU 12 determines that the vehicle ECU 11 is in a normal state (step St23).

[0093] Next, the motor ECU 12 compares the variable n with an upper limit value n_max (an integer equal to or greater than 1) (step St24). Here, the upper limit value n_max is "6" in the example of FIG. 3. If the variable n and the upper limit value n_max match each other (Yes in step St24), the motor ECU 12 sets the variable n to "0" (step St25). If the variable n and the upper limit value n_max do not match each other (No in step St24), the motor ECU 12 adds 1 to the variable n (step St26). This updates the variable n to the expected value for the next cycle of the state determination value N. Then, the process ends.

[0094] Moreover, if the state determination value N and the variable n do not match each other (No in step St22), the motor ECU 12 determines that the vehicle ECU 11 is in an abnormal state due to a malfunction (step St27), and then the process ends.

[0095] In this way, if the state determination value N counts up by one every period Δt, the motor ECU 12 determines that the vehicle ECU 11 is in a normal state, and if the state determination value N does not count up by one every period Δt, the motor ECU 12 determines that the vehicle ECU 11 is in an abnormal state.

[0096] 12 is a flowchart showing an example of a control process of the MG 25. The motor ECU 12 executes this process, for example, at a predetermined cycle.

[0097] The motor ECU 12 determines whether or not a torque command value has been received from the vehicle ECU 11 (step St31). If the motor ECU 12 has received a torque command value (Yes in step St31), the motor ECU 12 calculates each of the d-axis and q-axis current command values ​​of the MG 25 based on the torque command value (step St32). Here, the motor ECU 12 acquires, for example, an effective current value and a current advance angle of the MG 25 corresponding to the torque command value from map data, and calculates each of the current command values ​​from the effective current value and the current advance angle based on a predetermined calculation formula.

[0098] Next, the motor ECU 12 obtains each of the d-axis and q-axis current values ​​of the three-phase AC current from each of the detection values ​​of the current sensor 26 and the rotational position sensor 27 (step St33). Here, the motor ECU 12 calculates the electrical angle of the MG 25 from the detection value of the rotational position sensor 27, and obtains the d-axis current Id and the q-axis current Iq by performing a 3-phase-to-2-phase conversion on each of the current values ​​of the three-phase AC current detected by the current sensor 26 using the electrical angle.

[0099] Next, the motor ECU 12 calculates voltage command values ​​for each phase (u-phase, v-phase, and w-phase) of the three-phase AC voltage of the MG 25 from the d-axis current command value and current value and the q-axis current command value and current value (step St34). Here, the motor ECU 12 calculates each of the d-axis and q-axis voltage command values ​​by feedback control of the difference between the d-axis current command value and current value and the difference between the q-axis current command value and current value. The motor ECU 12 calculates the voltage command values ​​for each phase of the three-phase AC voltage by performing 2-phase-3-phase conversion of each of the d-axis and q-axis voltage command values ​​using the electrical angle of the MG 25.

[0100] Next, the motor ECU 12 generates a switching signal based on the voltage command value of each phase and outputs the signal to the inverter 24 (step St35). Here, the motor ECU 12 performs a duty calculation based on the voltage command value.

[0101] 13 is a diagram showing an example of a switching signal. The motor ECU 12 generates a carrier signal that changes in a triangular wave shape on the time axis, and compares the signal value of the carrier signal with the voltage command value of each phase that changes in a sinusoidal wave shape. The carrier signal is a signal for determining the on / off timing of the switching signal. When the signal value of the carrier signal is equal to or greater than the voltage command value, the switching signal is turned off, and when the signal value of the carrier signal is less than the voltage command value, the switching signal is turned off.

[0102] The motor ECU 12 calculates the time Ton during which the switching signal is on and the time Toff during which the switching signal is off. The times Ton and Toff determine the duty ratio of the switching signal.

[0103] 12 again, when the motor ECU 12 has not received a torque command value (No in step St31), it determines whether or not it has received a torque output stop command from the vehicle ECU 11 via the local communication bus LBb (step St36). When the motor ECU 12 has received a torque output stop command (Yes in step St36), it sets the d-axis and q-axis current command values ​​to 0 (A) (step St37). This causes the torque of the MG 25 to become 0 (N·m).

[0104] Furthermore, if the motor ECU 12 has not received a torque output stop command (No in step St36), it determines whether or not it has received a forced stop command from the battery ECU 10 via the global communication bus GBa (step St38). If the motor ECU 12 has not received a forced stop command (No in step St38), it ends this process.

[0105] When the motor ECU 12 has received the forced stop instruction (Yes in step St38), it determines whether the vehicle ECU 11 is in an abnormal state (step St39). The state of the vehicle ECU 11 is determined by a state determination process shown in Fig. 11. When the vehicle ECU 11 is in a normal state (No in step St39), the motor ECU 12 ends this process.

[0106] Furthermore, when the vehicle ECU 11 is in an abnormal state (Yes in step St39), the motor ECU 12 performs gate shutoff control on the inverter 24 (step St40). As a result, the inverter 24 stops operating, and the operation of the MG 25 stops.

[0107] As described above, when the battery ECU 10 detects, based on the monitoring result of the battery 21, that the battery 21 is in an abnormal state and that the restriction on the operation of the MG 25 is not being executed due to the abnormal state of the vehicle ECU 11, it instructs the motor ECU 12 to forcibly stop the MG 25. If the state determination value N indicates the abnormal state of the vehicle ECU 11, the motor ECU 12 stops the operation of the MG 25 in accordance with the MG 25 forcible stop instruction from the battery ECU 10, and if the state determination value N indicates the vehicle ECU 11 is in a normal state, it continues the operation of the MG 25 without following the forcible stop instruction from the battery ECU 10.

[0108] Therefore, when the vehicle ECU 11 fails and is in an abnormal state due to an abnormality in the battery 21, the motor ECU 12 can stop the operation of the MG 25. Therefore, when the vehicle ECU 11 cannot perform a fail-safe operation, the vehicle control device 1 can stop the operation of the MG 25 by the motor ECU 12 instead of the vehicle ECU 11, and can safely stop the vehicle 9. Therefore, the vehicle control device 1 can improve the fail-safe function.

[0109] The above-described embodiment is a preferred example of the present invention, but the present invention is not limited to this embodiment and can be modified in various ways without departing from the scope of the present invention. [Explanation of symbols]

[0110] 1 Vehicle control device 9 Vehicles 10 Battery ECU (first control unit) 11 Vehicle ECU (third control unit) 12 Motor ECU (second control unit) 16 Communication interface section 20 Sensor unit 21 Battery 22 S.M.R. 24 Inverter 25 MG (rotating electric machine) GBa~GBc Global Communication Bus

Claims

1. A rotating electric machine that drives a vehicle; a battery electrically connected to the rotating electric machine; a first control unit that monitors a state of the battery and detects an abnormal state from a result of monitoring the state of the battery; A second control unit that controls an output of the rotating electric machine; a third control unit that instructs the second control unit to output the rotating electric machine based on a result of monitoring the state of the battery, and executes a restriction on the operation of the rotating electric machine when the first control unit detects an abnormality in the battery, the first control unit, when detecting, based on a result of monitoring the state of the battery, that the battery is in an abnormal state and that a restriction on the operation of the rotating electric machine is not being executed due to the abnormal state of the third control unit, instructs the second control unit to stop the operation of the rotating electric machine; The third control unit outputs a status signal indicating a normal state or an abnormal state of the third control unit to the second control unit, The second control unit is When the state signal indicates an abnormal state of the third control unit, stopping the operation of the rotating electric machine in accordance with an instruction to stop the rotating electric machine from the first control unit; When the state signal indicates a normal state of the third control unit, the rotating electric machine is continued to operate without following an instruction from the first control unit to stop the rotating electric machine. Vehicle control device.

2. The second control unit determines that the third control unit is in a normal state when the status signal has a predetermined regularity, and determines that the third control unit is in an abnormal state when the status signal does not have the predetermined regularity. The vehicle control device according to claim 1.

3. The third control unit outputs the status signal that repeats a predetermined numerical pattern at a constant period when the status signal is in a normal state. The vehicle control device according to claim 2.

4. the third control unit, when the first control unit detects an abnormality in the battery, restricts the operation of the rotating electric machine by cutting off an electrical connection between the rotating electric machine and the battery.

4. A vehicle control device according to claim 1.

5. When the first control unit determines that a value of a current flowing between the rotating electric machine and the battery is less than a threshold value based on a result of monitoring the state of the battery, the first control unit detects that a restriction on the operation of the rotating electric machine is not being executed due to an abnormal state of the third control unit.

5. A vehicle control device according to claim 1.

Images