Vehicle control device, vehicle control system, and vehicle control method

Abstract

To smoothly take over vehicle control in switching between systems that are different from each other.SOLUTION: A vehicle control device according to an embodiment includes a second controller that controls an actuator that drives a vehicle according to a first control value acquired from a first controller that controls the vehicle. The second controller performs learning processing on a correction value on the basis of a difference between a first control value acquired from the first controller and a second control value for backup control during control by the first controller, and performs control of the actuator according to a third control value obtained by correcting the second control value by the correction value when the first controller is abnormal.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present invention relates to a vehicle control device, a vehicle control system, and a vehicle control method.

Background Art

[0002] Recently, there is a market trend that the added value of automobiles is shifting to software, and "Software First" (SF) has been proposed. The control applications targeted for SF are mainly developed by automobile manufacturers. On the other hand, the platform software called BSW (Basic Software) is mainly developed by ECU (Electronic Control Unit) suppliers. That is, since the development entities of the system related to the control application and the system related to the platform software are different, the two systems are different from each other.

[0003] In addition, in the control system of an automobile, it is required to install a backup system in case of an abnormality in control functions such as control applications. In a redundant system having two identical motor systems, a technique for pre-learning the characteristics of the motors in each motor system is disclosed in case of substituting control with the other motor system when an abnormality occurs in one motor system (see, for example, Patent Document 1).

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] The technique described in Patent Document 1 mentioned above is a technique related to switching between the same systems.

[0006] In other words, this technology involves switching between similar control applications, and since both are basically developed by the same manufacturer, it is easy to incorporate features to ensure a smooth transition during the switch.

[0007] However, in cases of switching between different systems, such as when a system related to control applications is malfunctioning and the platform software is used for backup, the development of each system is often carried out by different manufacturers, making it difficult to incorporate functions for a smooth transition during the switchover.

[0008] The present invention has been made in view of the above, and aims to provide a vehicle control device, a vehicle control system, and a vehicle control method that can smoothly take over vehicle control when switching between different systems. [Means for solving the problem]

[0009] To solve the above-mentioned problems and achieve the objective, the vehicle control device according to the present invention includes a second controller that controls an actuator that drives the vehicle in accordance with a first control value obtained from a first controller that controls the vehicle. The second controller learns a correction value based on the difference between the first control value obtained from the first controller and a second control value for backup control while the first controller is controlling the vehicle. If the first controller is malfunctioning, the second controller controls the actuator in accordance with a third control value obtained by correcting the second control value with the correction value. [Effects of the Invention]

[0010] According to the present invention, vehicle control can be smoothly transferred when switching between different systems. [Brief explanation of the drawing]

[0011] [Figure 1] Figure 1 shows an example of the configuration of a vehicle control system. [Figure 2]Figure 2 is a schematic diagram showing an example of vehicle control during control switching. [Figure 3] Figure 3 shows an example of a processing mode by the control system microcontroller. [Figure 4] Figure 4 is a conceptual diagram of the gain learning mode. [Figure 5] Figure 5 shows an example of a gain map. [Figure 6] Figure 6 is a flowchart showing the processing steps executed by the control system microcontroller. [Figure 7] Figure 7 shows an example of a compatibility map. [Modes for carrying out the invention]

[0012] The vehicle control device, vehicle control system, and vehicle control method disclosed herein will be described below with reference to the attached drawings. However, the present invention is not limited to the embodiments described below.

[0013] First, an example of the configuration of the vehicle control system according to the embodiment will be described using Figure 1. Figure 1 is a block diagram showing an example of the configuration of the vehicle control system. The vehicle control system 1 shown in Figure 1 is installed in a vehicle (automobile) not shown.

[0014] As shown in Figure 1, the vehicle control system 1 includes an IoT microcontroller 10 that receives information input and a control system microcontroller 20 that executes processing to control the vehicle. The IoT microcontroller 10 is an example of a first controller, and the control system microcontroller 20 is an example of a vehicle control device and a second controller. The IoT microcontroller and the control system microcontroller 20 each have a processor (e.g., a CPU (Central Processing Unit)).

[0015] The IoT microcontroller 10 has a non-secure area 11 for storing application information and a secure area 12 that is more secure than the non-secure area 11. The IoT microcontroller 10 and the control system microcontroller 20 perform input / output of information via an interface provided in the secure area 12 of the IoT microcontroller 10.

[0016] In this way, in the vehicle control system 1, the IoT microcontroller 10 and the control system microcontroller 20 can be connected via the service IF121 in the secure area 12 of the IoT microcontroller 10. Therefore, the vehicle control system 1 can develop the IoT microcontroller 10 and the control system microcontroller 20 individually, which improves the software development efficiency of the control system application and facilitates software updates. Also, since the input / output of information between the IoT microcontroller 10 and the control system microcontroller 20 is performed via the service IF121 in the secure area 12, security can be ensured.

[0017] For example, the non-secure area 11 and the secure area 12 correspond to the normal world and the secure world in TrustZone (registered trademark), respectively. For example, the non-secure area 11 and the secure area 12 can be realized by partitioning the memory area. Note that the non-secure area 11 corresponds to an example of the first memory area, and the secure area 12 corresponds to an example of the second memory area.

[0018] The application placed in the non-secure area 11 cannot directly access the resources in the secure area 12. Therefore, the secure area 12 can be called a secure memory area. Here, secure means a state protected from external intrusion, unauthorized operation, destruction, modification, information leakage, deletion, seizure, communication interference, etc., or a state with a high level of protection.

[0019] The IoT microcontroller 10 has connected interfaces such as BLE (Bluetooth Low Energy) 141, USB (Universal Serial Bus) 142, and audio IF 143. Thereby, the IoT microcontroller 10 can perform communication via OTA (Over The Air).

[0020] Note that the connected interface is an interface that enables communication and connection. For example, it is an interface for communication and connection between devices, an interface for communication and connection between the IoT microcontroller 10 and the outside, an interface between a device and a user, etc.

[0021] Also, the IoT microcontroller 10 acquires application information from the outside, such as including the cloud, by wireless communication or the like, arranges it in the non-secure area 11, and also updates the application information already arranged in the non-secure area 11. It is assumed that it is prohibited to arrange the application information acquired from the outside of the vehicle control system 1 in the secure area 12. Here, arranging the application information is synonymous with storing it. The application information is a package file of an application. In the following description, the application may be omitted and referred to as an app.

[0022] In the example of FIG. 1, the case where three pieces of application information, i.e., application information 111, application information 112, and application information 113, are arranged in the non-secure area 11 is illustrated, but the number of pieces of application information may be any number.

[0023] For example, the applications corresponding to each piece of application information include those for controlling a vehicle (automobile) and those related to connected interfaces such as BLE 141 and USB 142. The applications include those for performing torque control, battery control, running control such as for an accelerator, those having a function of acquiring vehicle information and delivering it to a user's terminal such as a smartphone, and those for issuing instructions to the control system by voice.

[0024] For example, once application development is complete, the application developer can rewrite the IoT microcontroller 10 via OTA (Over-the-Air) through the cloud, thereby deploying the application information.

[0025] The secure area 12 houses the service IF 121 and the authentication unit 122. The service IF 121 has the function of acquiring information input from the control system microcontroller 20 and the function of issuing instructions to the BSW of the control system microcontroller 20 in response to the execution of the vehicle control application stored in the IoT microcontroller 10.

[0026] The authentication unit 122 authenticates that the application information placed in the non-secure area 11 is genuine. For example, it authenticates application information downloaded from the cloud by the IoT microcontroller 10 via OTA. For example, the authentication unit 122 verifies whether the encryption key attached to the application information is genuine.

[0027] For example, the authentication unit 122 checks whether the downloaded application information is legitimately distributed through the application store by using a whitelist, which is a list of applications and programs deemed safe.

[0028] For example, a whitelist might include a list of applications that are officially distributed through application stores, or a list of programs that have been previously verified as legitimate.

[0029] The VMM (Virtual Machine Monitor) 13 arbitrates the execution rights of the processors in the non-secure area 11 and the secure area 12. The execution of the service interface 121, authentication unit 122, VMM 13, and the applications corresponding to each application information is realized by the processor provided in the IoT microcontroller 10.

[0030] The control system microcontroller 20 is, for example, a microcontroller with higher quality and safety compared to the IoT microcontroller 10, and is, for example, a microcontroller that complies with the ISO 26262 standard. For example, the control system microcontroller is developed by a supplier to a vehicle manufacturer, etc.

[0031] As shown in Figure 1, the control system microcontroller 20 includes a switching unit 21, a backup control application 22, and BSW (Basic Software) 23. The switching unit 21, the backup control application 22, and the BSW 23 are implemented by the processor provided in the control system microcontroller 20.

[0032] The switching unit 21 and the backup control application 22 are a backup system that performs fail-safe processing. Specific examples of fail-safe processing will be described later. BSW23 is platform software that provides common functions required by the application information.

[0033] When the IoT microcontroller 10 is operating normally, the BSW23 controls the vehicle based on control information input from the IoT microcontroller 10 via the service IF121. Furthermore, if an abnormality occurs in the IoT microcontroller 10, the BSW23 controls the vehicle based on control information input from the backup control application 22. Note that vehicle control by the BSW23 means outputting control information to each ECU (Electronic Control Unit).

[0034] Furthermore, the control system microcontroller 20 has I / O interfaces such as CAN (Controller Area Network) 241, GPIO (General Purpose Input / Output) 242, and AD (Analog to Digital Converter) 243.

[0035] Furthermore, serial communication, CAN communication, Ethernet (registered trademark), and wireless communication (Bluetooth (registered trademark), Wi-Fi (registered trademark), etc.) are used for communication between the IoT microcontroller 10 and the control system microcontroller 20.

[0036] By the way, the switching unit 21 of the control system microcontroller 20 determines whether or not an abnormality has occurred in the IoT microcontroller 10, and if it determines that an abnormality has occurred in the IoT microcontroller 10, it switches to vehicle control by the backup control application 22 of the control system microcontroller 20.

[0037] In other words, if the IoT microcontroller 10 is functioning correctly, the control system microcontroller 20 passes the input information from the sensors connected to the control system microcontroller 20 to the IoT microcontroller 10, and outputs the output information calculated by the IoT microcontroller 10 based on the input information to the actuator.

[0038] Meanwhile, if an abnormality occurs in the IoT microcontroller 10, the control system microcontroller 20 outputs output information calculated by the backup control application 22 based on the sensor input information to the actuator.

[0039] Here, as mentioned above, it is conceivable that the system development entities for both are different, such as the automobile manufacturer developing the application information to be placed in the non-secure area 11, and the ECU supplier developing the backup control application 22.

[0040] Therefore, for example, when switching control from application information located in the non-secure area 11 to the backup control application 22, there is a risk that vehicle control may be disrupted before and after the switch. Figure 2 is a schematic diagram showing an example of vehicle control during control switching, and is an overview of the problem.

[0041] In the following explanation, we will use the example of an application information located in the non-secure area 11 being an application for calculating the torque of a motor that drives a vehicle. Furthermore, in the following explanation, the "torque calculation application, which is application information located in the non-secure area 11," may be referred to as a "user application." Note that the motor in this context corresponds to an example of an actuator.

[0042] As shown in Figure 2, the user application and the backup control application 22 calculate the motor's torque output based on different torque maps A and B, respectively. A torque map is a control map that associates torque, motor rotational speed (rpm), and accelerator opening. However, for simplicity of explanation, Figure 2 shows the case where the torque map is a two-dimensional map of torque and rotational speed.

[0043] The user application and the backup control application 22 calculate torque values ​​based on input information regarding the accelerator opening, by performing calculations that refer to torque map A and torque map B. The torque value calculated by the user application corresponds to the first control value, and the torque value calculated by the backup control application 22 corresponds to the second control value.

[0044] Since the user application and the backup control application 22 are developed by different developers, the torque map A referenced by the user application and the torque map B referenced by the backup control application 22 are torque maps with different relationships between torque and rotational speed. Therefore, when control switches from the user application to the backup control application 22, the difference between the two torque maps may cause disturbances in the torque output, potentially leading to hunting.

[0045] Therefore, the control system microcontroller 20 according to this embodiment learns the difference between torque map A, which is referenced by the user application, and torque map B, which is referenced by the backup control application 22, and corrects this difference to perform vehicle control while the backup control application 22 is controlling the vehicle.

[0046] Specifically, the control system microcontroller 20 is provided with a processing mode that learns the difference between a first control value and a second control value based on input information (accelerator opening) input to the user application and output information (torque value) output from the user application in response to the input information.

[0047] Figure 3 shows an example of a processing mode by the control system microcontroller 20. As shown in Figure 3, the control system microcontroller 20 operates in gain learning mode when controlling the IoT microcontroller (user application). A specific example of the gain learning mode will be described later.

[0048] Furthermore, if an abnormality occurs in the IoT microcontroller 10, etc., and control is switched from the IoT microcontroller 10 to the control system microcontroller 20, the control system microcontroller 20 will switch to a gain map reflection mode that reflects the gain map described later. The gain map reflection mode is a mode in which the learning results of the gain learning mode are reflected in the gain map held by the control system microcontroller 20.

[0049] Subsequently, the control system microcontroller 20 transitions to a control mode that performs vehicle control based on a gain map that reflects the learning results from the gain learning mode, based on the processing results from the gain map reflection mode. Through this series of processes, the backup control application 22 of the control system microcontroller 20 can suppress hunting (see Figure 2) when control is switched from the user application.

[0050] Here, we will explain how the control system microcontroller 20 determines if the IoT microcontroller 10 is malfunctioning. The switching unit 21 of the control system microcontroller 20 determines if the IoT microcontroller 10 is malfunctioning based on a malfunction notification from the IoT microcontroller 10 or a communication malfunction that occurs between the IoT microcontroller 10 and the IoT microcontroller 10.

[0051] The IoT microcontroller 10 determines any abnormalities in itself through a built-in WDT (Watch Dog Timer), ROM / RAM checks of the IoT microcontroller 10 (e.g., parity check, ECC (Error-Correcting Code), checksum, CRC (Cyclic Redundancy Check)), etc.

[0052] Furthermore, the control system microcontroller 20 determines if there is an abnormality in the IoT microcontroller 10 based on the interruption of communication with the IoT microcontroller 10 or abnormalities in the communication data (parity check, ECC, checksum, CRC).

[0053] Then, when the switching unit 21 of the control system microcontroller 20 determines that the IoT microcontroller 10 is abnormal, it will switch the processing mode of the backup control application 22 from gain learning mode to gain map reflection mode and then to control mode as needed.

[0054] Furthermore, the switching unit 21 of the control system microcontroller 20 disables the vehicle control information input via the IoT microcontroller 10's service IF 121 after determining that the IoT microcontroller 10 is malfunctioning. This allows for an appropriate switch to vehicle control by the backup control application 22 if a malfunction occurs in the IoT microcontroller 10.

[0055] After an abnormality occurs in the IoT microcontroller 10, the backup control application 22 continues to perform vehicle control until the vehicle's power is turned off. In other words, after an abnormality occurs, the backup control application 22 continues to perform vehicle control until the vehicle comes to a stop.

[0056] Subsequently, for example, after the vehicle's power is turned on, if the abnormality is confirmed to have been resolved through various initial checks within the IoT microcontroller 10, control by the IoT microcontroller 10 will begin.

[0057] In this way, after an abnormality occurs in the IoT microcontroller 10, the backup control application 22 can continue to perform vehicle control until the vehicle's power is turned off, thereby ensuring safe vehicle control. Furthermore, the control system microcontroller 20 may transfer vehicle control authority to the IoT microcontroller 10 after confirming that the IoT microcontroller 10 is functioning normally.

[0058] Next, we will explain the specific processing of the gain learning mode using Figure 4. Figure 4 is a conceptual diagram of the gain learning mode. As shown in Figure 4, in the gain learning mode, the torque calculation application of the IoT microcontroller 10 calculates a first control value Sg1 according to the input (for example, accelerator opening).

[0059] Similarly, the backup control application 22 of the control system microcontroller 20 also calculates a second control value Sg2 in accordance with the input received by the IoT microcontroller 10. The IoT microcontroller 10 performs gain learning in accordance with the first control value Sg1 calculated by the torque calculation application and the second control value Sg2 calculated by the backup control application 22.

[0060] Gain learning is performed by continuously calculating "gain = first control value Sg1 / second control value Sg2". The results of gain learning are used when correcting the second control value Sg2. Specifically, the control system microcontroller 20 corrects the second control value Sg to the third control value Sg3 by "second control value Sg2 × gain".

[0061] Furthermore, as shown in Figure 4, the control system microcontroller 20 outputs a first control value Sg1 calculated by the torque calculation application when the IoT microcontroller 10 is functioning normally, and outputs a third control value Sg3 which is the second control value Sg2 corrected using the results of gain learning when an abnormality occurs in the IoT microcontroller 10.

[0062] This makes it possible to smoothly transfer control when control is handed over from the IoT microcontroller 10 to the backup control application 22.

[0063] In gain learning mode, the backup control application 22 sequentially calculates the gain for each accelerator opening and updates the gain map. In this case, the backup control application 22 may update the gain map to the latest value each time gain learning is performed, or it may update the gain map using the calculation result of annealing.

[0064] The annealing operation can be calculated using the formula: GainMap(x) = PreviousGainMap(x) + ((Gain(x) - PreviousGainMap(x)) × AnnealedValue). In the above formula, the annealed value is any number between 0 and 1, and "x" is the rotational speed.

[0065] The backup control application 22 updates the gain map as needed in learning mode. The gain map updated by the backup control application 22 is stored in non-volatile memory, so that data is not lost even when the vehicle's power is turned off. When the vehicle's power is turned on, the backup control application 22 reads the gain map from the non-volatile memory and uses it.

[0066] Incidentally, for example, the backup control application 22 may not be able to generate a gain map for all rotational speeds, and it is conceivable that gain may be missing for some rotational speeds in the gain map.

[0067] In this case, the backup control application 22 generates a gain map with interpolation for missing sections of the gain map using various interpolation methods such as linear interpolation. This allows the backup control application 22 to smoothly control the vehicle even in areas where the gain map is missing.

[0068] In this way, the backup control application 22 generates a gain map based on the input / output information of the user application. As a result, the control system microcontroller 20 can bring the vehicle control by the backup control application 22 closer to the vehicle control by the user application without rewriting the torque map of the backup control application 22.

[0069] Furthermore, when the backup control application 22 transitions from learning mode to control mode, it calculates torque B by referring to torque map B based on input information regarding accelerator opening, multiplies torque B by a gain, and then performs vehicle control.

[0070] Therefore, the backup control application 22 can bring torque B closer to the value of torque A that would normally be calculated by the user application by multiplying the gain of the gain map by the torque B obtained from torque map B.

[0071] As a result, the backup control application 22 can continue to perform control without hunting when control is switched from the user application.

[0072] Next, we will explain the processing procedure executed by the control system microcontroller 20 using Figure 6. Figure 6 is a flowchart showing the processing procedure executed by the control system microcontroller 20. Here, we will explain the series of processing steps from when the backup control application 22 of the control system microcontroller 20 takes over control from the user application.

[0073] As shown in Figure 6, the control system microcontroller 20 starts gain learning, for example, when the vehicle's power is turned on (step S101). Gain learning corresponds to an example of a learning process of the difference between the first control characteristic and the second control characteristic.

[0074] Next, the control system microcontroller 20 determines whether or not an abnormality has occurred in the IoT microcontroller 10 (step S102). If the control system microcontroller 20 determines that an abnormality has occurred in the IoT microcontroller 10 (step S102; Yes), it terminates gain learning (step S103) and reflects the learning results in the gain map held by the control system microcontroller 20 (step S104).

[0075] Then, the control system microcontroller 20 starts control based on the gain map that reflects the learning results, based on the processing results up to step S104 (step S105), and then terminates the process.

[0076] Furthermore, if the control system microcontroller 20 determines that no abnormality has occurred in the IoT microcontroller 10 (step S102; No), it continues gain learning (step S106) and returns to the determination process in step S102.

[0077] As described above, the control system microcontroller 20 according to the embodiment (an example of a vehicle control device and a second controller) is a control system microcontroller 20 that controls the vehicle when the IoT microcontroller 10 (an example of a first controller) that controls the vehicle is malfunctioning.

[0078] The control system microcontroller 20 learns a correction value based on the difference between a first control value obtained from the IoT microcontroller 10 and a second control value for backup control while the IoT microcontroller 10 is controlling the system. If the IoT microcontroller 10 is malfunctioning, the microcontroller 20 controls the actuator according to a third control value obtained by correcting the second control value with the correction value. Therefore, according to the control system microcontroller 20 of this embodiment, vehicle control can be smoothly taken over when switching between different systems.

[0079] Incidentally, the above-described embodiment described a case where the actuator is a motor, but it is not limited to this. The actuator may be other actuators mounted on the vehicle, such as power steering or power windows.

[0080] Furthermore, although the above-described embodiment used a torque map as an example for the first and second control characteristics, the first and second control characteristics are not limited to this. They may also be a calibration map related to a sensor mounted on the vehicle.

[0081] Figure 7 shows an example of a calibration map. The calibration map shown in Figure 7 shows the accelerator pedal opening on the vertical axis and the AD value of the accelerator pedal opening on the horizontal axis. The accelerator pedal opening shown on the vertical axis of Figure 7 is the detection result of the accelerator pedal opening sensor that detects the accelerator pedal opening, and is an analog signal. Furthermore, the accelerator pedal opening here is an example of input information input from a sensor mounted on the vehicle, and the AD value corresponds to an example of conversion information.

[0082] Calibration maps A1 and A2 are control maps that user applications refer to when performing A / D conversion of analog signals. For example, the accelerator pedal has a clearance to prevent sudden acceleration. This clearance varies from vehicle to vehicle and also changes due to aging and other factors. Therefore, user applications perform calibration of calibration map A1.

[0083] Figure 7 shows the result of calibration by the user application, where the clearance F1 in the compatibility map A1 is updated to clearance F2, and the compatibility map is updated from A1 to A2.

[0084] The control system microcontroller 20 continuously acquires the accelerator opening input to the user application and the AD value of the accelerator opening converted by the user application, and performs gain learning on a continuous basis based on the acquired accelerator opening and AD value. The gain learning can be performed using the same method as the gain learning for the torque map.

[0085] The control system microcontroller 20 then generates a gain map from the gain learning results and performs vehicle control based on the generated gain map. This allows the control system microcontroller 20 to handle redundancy even without prior knowledge of the calibration values ​​provided by the user application. Although accelerator pedal opening was used as an example here, gain maps can be similarly generated for various sensor information input to the user application, such as intake air temperature, atmospheric pressure, and fuel pressure.

[0086] Furthermore, the sensors targeted for gain map generation may also be sensors that detect the state of each actuator. Sensors that detect the state of each actuator include sensors that detect steering angle and vehicle speed.

[0087] For example, the user application also performs calibration on the steering angle and vehicle speed calibration maps, and then uses the calibration maps from the user application to control the vehicle.

[0088] Therefore, the control system microcontroller 20 can perform vehicle control equivalent to that performed by a user application using a calibration-adjusted map by learning the gain for each actuator.

[0089] Incidentally, although the above-described embodiment described a case in which control is performed on a vehicle, the present invention may also be applied to other systems that perform backup control using different systems.

[0090] Furthermore, while the above-described embodiment explains the extraction of control values ​​and correction values ​​based on torque maps and gain maps, it is not limited to this. For example, instead of torque maps and gain maps, these values ​​may be derived based on predetermined calculation formulas.

[0091] Further effects and modifications can be readily derived by those skilled in the art. Therefore, broader aspects of the present invention are not limited to the specific details and representative embodiments expressed and described above. Accordingly, various modifications are possible without departing from the spirit or scope of the overall concept of the invention as defined by the appended claims and their equivalents. [Explanation of Symbols]

[0092] 1. Vehicle control system 10 IoT Microcontroller (Example of a First Controller) 11 Nonsecure Area 12 Secure Area 13 VMM 20. Control System Microcontroller (Example of a Vehicle Control System and Second Controller) 21 Switching section 22 Backup control app 23 BSW

Claims

1. The system includes a second controller that controls the actuators that drive the vehicle according to a first control value obtained from a first controller that controls the vehicle, The second controller is, During control by the first controller, a correction value is learned based on the difference between the first control value obtained from the first controller and the second control value for backup control. If the first controller is malfunctioning, the actuator is controlled according to a third control value obtained by correcting the second control value with the correction value. Vehicle control device.

2. The first controller is, A first memory area that stores application information obtained from an external source, A second memory area that is more secure than the first memory area, It has, The second controller is, Information is input and output between the first controller and the second memory area via an interface provided in the second memory area. The vehicle control device according to claim 1.

3. The second controller is, The input information acquired from the sensor is output to the first controller, and the second control value is generated based on the input information. The first control value is, Based on the input information obtained from the second controller, the first controller generates: The vehicle control device according to claim 1.

4. The second controller is, The aforementioned correction value is generated from the gain map, The gain map is learned in the aforementioned learning process. The vehicle control device according to claim 1.

5. The second controller is, After an abnormality occurs in the first controller, control of the vehicle continues until the vehicle's power is turned off. The vehicle control device according to claim 1.

6. A first controller that controls the vehicle, The vehicle is equipped with a second controller that controls the actuators that drive the vehicle, The second controller is, During control by the first controller, a correction value is learned based on the difference between the first control value obtained from the first controller and the second control value for backup control. If the first controller is malfunctioning, the actuator is controlled according to a third control value obtained by correcting the second control value with the correction value. Vehicle control system.

7. A vehicle control method executed by a second controller that controls actuators that drive a vehicle, in accordance with a first control value obtained from a first controller that controls the vehicle, During control by the first controller, a correction value is learned based on the difference between the first control value obtained from the first controller and the second control value for backup control. If the first controller is malfunctioning, the actuator is controlled according to a third control value obtained by correcting the second control value with the correction value. Vehicle control method.

Images