JP7574752B2 - Vehicle control device - Google Patents

Description

The present invention relates to a vehicle control device.

For example, Patent Document 1 discloses a technology in which multiple driving force sources of a hybrid vehicle are controlled by multiple slave ECUs (Electronic Control Units), and a master ECU manages each slave ECU and arbitrates each driving force. The master ECU and each slave ECU are realized, for example, by a microcontroller.

JP 2015-63158 A

Some microcontrollers used in ECUs are equipped with non-volatile memory that records the start and stop of the microcontroller. If this type of microcontroller stops operating unintentionally, for example due to a momentary power interruption, the non-volatile memory record still indicates the operating state, making it possible to detect the abnormality.

In contrast, microcontrollers that do not have non-volatile memory cannot detect the above-mentioned abnormalities. For example, if an abnormality occurs in the microcontroller of the slave ECU, the master ECU will stop control of the drive power source using a fail-safe function.

However, for example, when a slave ECU of a microcontroller with non-volatile memory and a slave ECU of a microcontroller without non-volatile memory are mixed, it is difficult for the master ECU to achieve an appropriate fail-safe because the microcontroller without non-volatile memory cannot detect abnormalities.

The present invention was made in consideration of the above problems, and aims to provide a vehicle control device that can achieve an appropriate fail-safe.

The vehicle control device described in this specification has a first computer that controls a first driving force source of a vehicle, a second computer that controls a second driving force source of the vehicle, and a third computer that instructs the first computer and the second computer regarding the control of the first driving force source and the second driving force source, the second computer has a non-volatile memory, and when control is stopped according to the instruction of the third computer, writes a stop record to the non-volatile memory and determines whether or not there is an abnormality in the second computer based on the stop record at the start of control, the first computer does not have a non-volatile memory, and measures the elapsed time from the start time of the first computer, and when the second computer determines that there is an abnormality, the third computer instructs the first computer and the second computer to stop control when the elapsed time is less than a threshold value.

In the above configuration, when the second computer determines that an abnormality exists, the third computer may instruct the second computer to stop control when the elapsed time is equal to or greater than the threshold value.

In the above configuration, when the second computer determines that an abnormality exists, the third computer may instruct the first computer to execute control of the first driving force source and the second driving force source when the elapsed time is equal to or greater than the threshold value.

In the above configuration, if the second computer determines that there is no abnormality, the third computer may instruct the first computer and the second computer to execute control.

In the above configuration, the third computer may instruct the second computer to temporarily halt control if the second computer first determines that an abnormality exists after the third computer is started.

The present invention makes it possible to achieve an appropriate fail-safe.

FIG. 1 is a configuration diagram showing an example of a vehicle. FIG. 2 is a diagram showing an example of a vehicle ECU and an MG-ECU. 4 is a time chart showing an example in which the MG-ECU determines that there is no abnormality. 4 is a time chart showing an example in which the MG-ECU determines that an abnormality exists. 4 is a flowchart showing an example of a drive process of an inverter. 4 is a flowchart showing an example of an operation of the MG-ECU. 4 is a flowchart showing an example of an operation of the MG-ECU. 4 is a flowchart showing an example of an operation of a vehicle ECU.

Figure 1 is a configuration diagram showing an example of a vehicle 90. The vehicle 90 is, as an example, a hybrid vehicle, and has a vehicle control device 9, inverters 60, 61, current sensors 62, 63, a boost converter 64, an MG battery 65, motor generators (MG) 50, 51, an axle 52, wheels 53, a differential gear device 54, a power split device 55, and an engine 56. Note that the vehicle 90 is not limited to a hybrid vehicle, and may be an electric vehicle without an engine 56.

MGs 50 and 51 function as both a generator and an electric motor. In this example, MG 50 functions as an electric motor and outputs torque by consuming power from MG battery 65. MG 51 functions as a generator and generates power by performing regenerative operation, charging the generated power to MG battery 65. MG battery 65 is, for example, a lithium ion battery, and functions as a power source for MG 50. MGs 50 and 51 are examples of the first and second driving power sources of vehicle 90, respectively.

The MG 50 is connected to the axle 52 via a differential gear device 54, and outputs torque to the axle 52. The engine 56 is connected to the axle 52 via a power split device 55, and transmits part of its power to the axle 52. Wheels 53 are connected to the ends of the axle 52. The driving force of the MG 50 and the engine 56 is transmitted to the wheels 53 via the axle 52.

The remaining power of the engine 56 is transmitted to the MG 51 by the power split device 55. This causes the MG 51 to generate electricity and output three-phase AC current to the inverter 61.

The inverter 61 has multiple switching elements, such as IGBTs (Insulated Gate Bipolar Transistors). Each switching element of the inverter 60 is on/off controlled by a switching signal input from the vehicle control device 9. This causes the inverter 61 to generate a DC voltage from the three-phase AC current. The DC voltage is converted by the boost converter 64 and applied to the MG battery 65. This charges the MG battery 65.

The boost converter 64 also boosts the DC voltage input from the MG battery 65 to a target voltage. The DC voltage is applied to the inverter 60 from the boost converter 64. The inverter 60 has a plurality of switching elements, such as IGBTs. Each switching element of the inverter 60 is on/off controlled by a switching signal input from the vehicle control device 9. This causes the inverter 60 to generate a three-phase AC current from the DC voltage of the boost converter 64. The MG 50 outputs torque from the three-phase AC current input from the inverter 60.

Current sensor 62 detects each current value of the three-phase AC current output from inverter 60 to MG 50. Current sensor 63 detects each current value of the three-phase AC current output from MG 51 to inverter 61. Current sensors 62 and 63 output each detection value to vehicle control device 9.

The vehicle control device 9 has the MG-ECUs 1 and 2, the vehicle ECU 3, an ignition switch (IG switch) 40, an accelerator sensor 41, a brake sensor 42, a vehicle speed sensor 43, and an ECU battery 44. The ECU battery 44 is the power source for the MG-ECUs 1 and 2 and the vehicle ECU 3. The ECU battery 44 supplies power to the MG-ECUs 1 and 2 and the vehicle ECU 3 via a power supply line 45.

MG-ECU1 is an example of a first computer that controls MG50, and MG-ECU2 is an example of a second computer that controls MG51. MG-ECU1, 2 and vehicle ECU3 each have a microcontroller, but are not limited to this and may be realized by other types of computers.

Detection values are input to the vehicle ECU 3 from an accelerator sensor 41, a brake sensor 42, and a vehicle speed sensor 43. The accelerator sensor 41 detects the opening degree of an accelerator pedal (not shown) of the vehicle 90, and outputs the detection value to the vehicle ECU 3. The brake sensor 42 detects the opening degree of a brake pedal (not shown) of the vehicle 90, and outputs the detection value to the vehicle ECU 3. The vehicle speed sensor 43 detects the speed of the vehicle 90, and outputs the detection value to the vehicle ECU 3.

The IG switch 40 also notifies the vehicle ECU 3 and the ECU battery 44 of the on/off state of the start button (not shown) of the vehicle 90. The ECU battery 44 starts supplying power when the start button is turned on, and stops supplying power when the start button is turned off.

When the start button is turned on, the vehicle ECU 3 starts up and begins controlling the vehicle 90. The vehicle ECU 3 calculates the torque required of the MG 50 (hereinafter referred to as the required torque) from the detection values of the accelerator sensor 41, the brake sensor 42, and the vehicle speed sensor 43. The vehicle ECU 3 instructs the MG-ECU 60 to control the MG 50 to perform powering operation based on the required torque, and instructs the MG-ECU 61 to control the MG 51 to perform regenerative operation based on the required torque. The vehicle ECU 3 is an example of a third computer that gives instructions to the MG-ECUs 1 and 2 regarding the control of the MGs 50 and 51.

MG-ECUs 1 and 2 drive inverters 60 and 61, respectively, according to control instructions from vehicle ECU 3. MG-ECUs 1 and 2 control the on/off of each switching element of inverters 60 and 61 using switching signals so that the required torque is output from MG 50. Furthermore, if an abnormality is detected in MG-ECU 2, MG-ECU 1 also drives inverter 61 instead of MG-ECU 2 according to control instructions from vehicle ECU 3, as shown by the dashed dotted line.

The current values of the three-phase AC current are input to MG-ECU1 and 2 from current sensors 62 and 63. MG-ECU1 drives inverter 60 using the current value of current sensor 62, and MG-ECU2 drives inverter 61 using the current value of current sensor 63. Furthermore, if an abnormality is detected in MG-ECU2, MG-ECU1 drives inverter 61 using the current value of current sensor 63.

(Configuration of vehicle ECU and MG-ECU)
2 is a configuration diagram showing an example of the vehicle ECU 3 and the MG-ECUs 1 and 2. The MG-ECU 1 has a microcontroller 1a and a signal transmission/reception circuit 1b, and the MG-ECU 2 has a microcontroller 2a and a signal transmission/reception circuit 2b. The vehicle ECU 3 has a microcontroller 3a and a signal transmission/reception circuit 3b.

The microcontroller 1a has a CPU (Central Processing Unit) 10, a ROM (Read Only Memory) 11, a RAM (Random Access Memory) 12, a communication port 13, and a hardware interface unit (HW-IF) 14. The CPU 10 is electrically connected to the ROM 11, the RAM 12, the communication port 13, and the HW-IF 14 via a bus 19 so that signals can be input and output between them.

The ROM 11 stores programs that drive the CPU 10. The RAM 12 functions as a working memory for the CPU 10. The communication port 13 processes communication between the CPU 10 and the microcontroller 3a of the vehicle ECU 3. The HW-IF 14 processes communication between the CPU 10 and the signal transmission/reception circuit 1b.

The signal transmission/reception circuit 1b is connected to the inverters 60, 61 and the current sensors 62, 63. The signal transmission/reception circuit 1b receives current values from the current sensors 62, 63 and outputs them to the CPU 10. The signal transmission/reception circuit 1b also generates switching signals based on notifications of the on/off timing of the switching elements input from the CPU 10 and outputs them to the inverters 60, 61. The signal transmission/reception circuit 1b is hardware such as an FPGA (Field Programmable Gate Array) or an ASIC (Application Specified Integrated Circuit).

The microcontroller 2a has a CPU 20, a ROM 21, a RAM 22, a communication port 23, a non-volatile memory 24, and a HW-IF 25. The CPU 20 is electrically connected to the ROM 21, the RAM 22, the communication port 23, the non-volatile memory 24, and the HW-IF 25 via a bus 29 so that signals can be input and output between them.

The ROM 21 stores programs that drive the CPU 20. The RAM 22 functions as a working memory for the CPU 20. The communication port 23 processes communication between the CPU 20 and the microcontroller 3a of the vehicle ECU 3. The HW-IF 25 processes communication between the CPU 20 and the signal transmission/reception circuit 2b.

The signal transmission/reception circuit 2b is connected to the inverter 61 and the current sensor 63. The signal transmission/reception circuit 2b receives a current value from the current sensor 63 and outputs it to the CPU 20. The signal transmission/reception circuit 2b also generates a switching signal based on the notification of the on/off timing of the switching element input from the CPU 20 and outputs it to the inverter 61. The signal transmission/reception circuit 2b is hardware such as an FPGA or ASIC.

In addition, startup status information 240 is written from the CPU 20 to the non-volatile memory 24. The startup status information 240 is information indicating that the CPU 20 has started or stopped normally. When the CPU 20 starts up, it reads out the startup status information 240 and determines whether or not there is an abnormality in the microcontroller 2a based on the startup status information 240. Details of the process of determining whether or not there is an abnormality based on the startup status information 240 will be described later.

The microcontroller 3a has a CPU 30, a ROM 31, a RAM 32, a communication port 33, a non-volatile memory 34, and a HW-IF 35. The CPU 30 is electrically connected to the CPU 30, the ROM 31, the RAM 32, the communication port 33, the non-volatile memory 34, and the HW-IF 35 via a bus 39 so that signals can be input and output between them.

The ROM 31 stores programs that drive the CPU 30. The RAM 32 functions as a working memory for the CPU 30. The communication port 33 processes communication between the CPU 30 and the microcontrollers 1a and 2a of the MG-ECUs 1 and 2. The non-volatile memory 34 stores various data relating to the control of the vehicle 90, for example. The HW-IF 35 processes communication between the CPU 30 and the signal transmission/reception circuit 3b.

The signal transmission/reception circuit 3b is connected to the IG switch 40, the accelerator sensor 41, the brake sensor 42, and the vehicle speed sensor 43. The signal transmission/reception circuit 3b receives detection values from the accelerator sensor 41, the brake sensor 42, and the vehicle speed sensor 43 and outputs them to the CPU 30. The signal transmission/reception circuit 3b also receives a notification of the on/off state of the start button from the IG switch 40 and outputs it to the CPU 30. The signal transmission/reception circuit 3b is hardware such as an FPGA or ASIC.

Thus, the MG-ECU 2 has a microcontroller 2a equipped with a non-volatile memory 24, whereas the MG-ECU 1 has a microcontroller 1a that does not have a non-volatile memory.

(Abnormality determination based on startup status information)
Next, a method will be described in which the microcontroller 2a including the non-volatile memory 24 performs abnormality determination based on the startup state information. Here, an example of an abnormality is a momentary interruption in the power supply of the ECU battery 44 caused by noise in the power supply line 45 (hereinafter, a momentary interruption in the power supply).

Figure 3 is a time chart showing an example in which the MG-ECU 2 determines that there is no abnormality. First, when the start button is turned on at time t1, the IG switch 40 is turned on, and the power supply (MG power supply) of the MG-ECU 2 is turned on.

Next, at time t2, the MG-ECU 2 starts up (ECU state = started). At this time, the CPU 20 of the MG-ECU 2 updates the start-up state information 240 in the non-volatile memory 24 from the "stopped" state to the "started" state.

Next, at time t3, when the start button is turned off, the IG switch 40 is turned off. The MG-ECU 2 stops driving the inverter 61 (control of the MG 51) in accordance with a stop command from the vehicle ECU 3 (ECU state = stopped). At this time, the CPU 20 of the MG-ECU 2 updates the start-up state information 240 in the non-volatile memory 24 from the "started" state to the "stopped" state. After that, at time t4, the power supply to the MG-ECU 2 is turned off.

Next, when the start button is turned on again at time t5, the IG switch 40 is turned on and the power supply of the MG-ECU 2 is turned on. At this time, the CPU 20 of the MG-ECU 2 judges whether or not there is an abnormality based on the startup state information 240 in the non-volatile memory 24. Because the MG-ECU 2 stopped normally at time t3, the startup state information 240 indicates a "stopped" state. Therefore, the MG-ECU 2 judges its own state to be "normal" (no abnormality) as the abnormality judgment result.

Next, at time t6, the MG-ECU 2 starts up (ECU state = started). At this time, the CPU 20 of the MG-ECU 2 updates the start-up state information 240 in the non-volatile memory 24 from the "stopped" state to the "started" state. In this way, the CPU 20 checks the start-up state information 240 when the MG-ECU 2 starts up.

Figure 4 is a time chart showing an example in which the MG-ECU 2 determines that an abnormality exists. First, when the start button is turned on at time t11, the IG switch 40 is turned on, and the power supply to the MG-ECU 2 is turned on.

Next, at time t12, the MG-ECU 2 starts up (ECU state = started). At this time, the CPU 20 of the MG-ECU 2 updates the start-up state information 240 in the non-volatile memory 24 from the "stopped" state to the "started" state.

Between times t13 and t14, the power supply to the MG-ECU 2 is interrupted. A power interruption can occur, for example, when noise occurs in the power supply line 45. The power supply is turned off between times t13 and t14. As a result, the MG-ECU 2 is forcibly shut down at time t14 due to the power interruption.

When the power supply of the MG-ECU 2 is turned on at time t15, the CPU 20 of the MG-ECU 2 determines whether or not there is an abnormality based on the startup state information 240 in the non-volatile memory 24. Because the MG-ECU 2 stopped at time t13 due to an abnormality caused by a momentary power interruption, the startup state information 240 has not been updated to the "stopped" state, unlike the example in Figure 3. Therefore, the startup state information 240 indicates the "started" state. Therefore, the MG-ECU 2 determines its own state to be "abnormal" (abnormality present) as the abnormality determination result.

Then, as described below, the vehicle ECU 3 stops the MG-ECU 2 in response to an abnormality notification from the MG-ECU 2.

In this way, the MG-ECU 2 updates the startup state information 240 in the non-volatile memory 24 when it is started and stopped. Therefore, when it is started, the MG-ECU 2 can determine from the startup state information 240 whether it was stopped normally the previous time. In contrast, the other MG-ECU 1 does not have a non-volatile memory, so it cannot make an abnormality determination when it is started.

(Inverter drive processing)
5 is a flowchart showing an example of a drive process for the inverters 60, 61. The CPUs 10, 20 of the MG-ECUs 1, 2 follow a control instruction from the vehicle ECU 3 and execute, for example, the following process to PWM (Pulse Width Modulation) the inverters 60, 61.

First, the CPU 10, 20 receives the required torque from the vehicle ECU 3 (step St1). The vehicle ECU 3 calculates the required torque from the detection values of, for example, the accelerator sensor 41, the brake sensor 42, and the vehicle speed sensor 43.

Next, the CPUs 10 and 20 calculate the current command value of the three-phase AC current of the MGs 50 and 51 according to the required torque (step St2). For example, the CPUs 10 and 20 calculate the current command value by referring to a current command value map based on the required torque.

Next, the CPUs 10 and 20 detect the current values of the three-phase AC currents using the current sensors 62 and 63 (step St3). The CPUs 10 and 20 may process the three-phase AC currents and the current command values in the d-q coordinate system by a three-phase-two-phase transformation.

Next, the CPUs 10 and 20 calculate the voltage command values for the MGs 50 and 51 by feedback controlling the difference between the current command values and the current values of the three-phase AC currents (step St4).

Next, the CPUs 10 and 20 calculate the duty ratio of the switching signal to be output to the inverters 60 and 61 from the voltage command value (step St5). As shown by the symbol G, the CPUs 10 and 20 generate a carrier signal that changes in a triangular wave shape on the time axis, and compare the voltage command value of each phase that changes in a sinusoidal wave shape with the signal value of the carrier signal. The carrier signal is a signal for determining the on/off timing of the switching signal. When the signal value of the carrier signal is equal to or greater than the voltage command value, the switching signal is turned off, and when the signal value of the carrier signal is less than the voltage command value, the switching signal is turned off. The CPUs 10 and 20 calculate the time Ton when the switching signal is on and the time Toff when the switching signal is off. The duty ratio of the PWM signal is determined by these times Ton and Toff.

Next, the CPUs 10 and 20 notify the signal transmission/reception circuits 1b and 2b, respectively, of the on/off timing of the switching signal (step St6). As a result, the signal transmission/reception circuits 1b and 2b generate switching signals and output them to the inverters 60 and 61.

(Operation of MG-ECU)
6 is a flowchart showing an example of the operation of the MG-ECU 1. Unlike the other MG-ECU 2, the MG-ECU 1 does not have a non-volatile memory, and therefore cannot detect abnormalities caused by momentary power interruption, etc. For this reason, the MG-ECU 1 measures the start-up time and notifies the vehicle ECU 3, and the vehicle ECU 3 determines whether the MG-ECUs 1 and 2 are abnormal based on the start-up time of the MG-ECU 1 when it receives a determination notification that the other MG-ECU 2 has an abnormality.

First, the CPU 10 performs a startup process for the MG-ECU 1 (step St11). The startup process includes a process for reading a program from the ROM 11 and loading it into the RAM 12, a boot process, and various initial setting processes.

Next, the CPU 10 starts measuring the startup time (step St12). Here, the startup time is the time that has elapsed since the startup time of the MG-ECU 1. The CPU 10 generates a counter according to a program, for example, and starts the counting operation of the counter after startup.

Next, the CPU 10 determines whether or not there is an instruction to control the MG 50 from the vehicle ECU 3 (step St13). If the CPU 10 has received an instruction to control the MG 50 (Yes in step St13), it starts the drive process of the inverter 60 (step St14).

Then, the CPU 10 determines whether or not there is an instruction to control the MG 51 from the vehicle ECU 3 (step St15). If only the MG-ECU 2 of the MG-ECUs 1 and 2 is abnormal, the vehicle ECU 3 instructs the MG-ECU 1 to control the MG 51 instead of the MG-ECU 2. If the CPU 10 has received an instruction to control the MG 51 (Yes in step St15), it starts the drive process of the inverter 61 (step St16). The drive process of the inverters 60 and 61 is as described above.

In addition, if the CPU 10 has not received an instruction to control MG 50 (No in step St13) or has not received an instruction to control MG 51 (No in step St15), it executes the operation of step St17 below.

Next, the CPU 10 determines whether or not a startup time has been requested from the vehicle ECU 3 (step St17). If a startup time has been requested (Yes in step St17), the CPU 10 notifies the vehicle ECU 3 of the startup time (step St18). If a startup time has not been requested (No in step St17), the CPU 10 executes the operation of the following step St19.

When the vehicle ECU 3 determines that the other MG-ECU 2 has an abnormality, it determines whether or not there is an abnormality in the MG-ECU 1 based on the startup time. This allows the vehicle ECU 3 to achieve an appropriate fail-safe in the event that an abnormality occurs in the MG-ECUs 1 and 2.

Next, the CPU 10 determines whether or not a stop command has been received from the vehicle ECU 3 (step St19). If a stop command has been received (Yes in step St19), the CPU 10 executes a process to stop the drive process of the inverters 60, 61 (step St20). At this time, the MG-ECU 1 controls each switching element of the inverters 60, 61 to be turned off.

If an abnormality occurs in the MG-ECU 1 or if the IG switch 40 is turned off, the vehicle ECU 3 instructs the MG-ECU 1 to stop. The CPU 10 then ends its operation, but if power is being supplied from the ECU battery 44, it resumes operation from step St1 after a predetermined time has elapsed.

In this way, the MG-ECU1 notifies the vehicle ECU3 of the startup time. When the vehicle ECU3 receives notification from the other MG-ECU2 that an abnormality has been determined, it determines whether or not there is an abnormality in the MG-ECU1 from the startup time. For example, if noise occurs in the power supply lines 45 of the MG-ECUs 1 and 2, causing a momentary interruption in the power supply to both MG-ECUs 1 and 2, the MG-ECU2 will determine that there is an abnormality, and because the startup time of the MG-ECU1 at the time of determination will be shorter than a predetermined threshold (i.e., immediately after startup), the vehicle ECU3 can determine whether or not there is an abnormality in the MG-ECU1.

Figure 7 is a flowchart showing an example of the operation of the MG-ECU 2. The MG-ECU 2 can detect an abnormality caused by a momentary power interruption or the like by reading out the startup status information 240 in the non-volatile memory 24 at startup. Therefore, if the MG-ECU 2 determines that an abnormality exists based on the startup status information 240, it notifies the vehicle ECU 3 of the abnormality.

First, the CPU 20 performs a startup process for the MG-ECU 2 (step St31). The startup process includes a process for reading a program from the ROM 21 and loading it into the RAM 22, a boot process, and various initial setting processes.

Next, the CPU 20 reads out the start-up state information 240 from the non-volatile memory 24 (step St32) and determines whether the start-up state information 240 indicates a "stopped" state (step St33). If the start-up state information 240 indicates a "stopped" state (Yes in step St33), the CPU 20 determines that no abnormality such as a momentary power interruption occurred in the MG-ECU 2 before startup and that the stop process was executed normally, and updates the start-up state information 240 to the "started" state without notifying the vehicle ECU 3 of the abnormality (step St34).

When the startup state information 240 indicates the "started" state (No in step St33), the CPU 20 determines that an abnormality such as a momentary power interruption occurred in the MG-ECU 2 before startup and that the stop process was not performed normally, and notifies the vehicle ECU 3 of the abnormality (step St40). As a result, the vehicle ECU 3 determines that an abnormality has occurred in the MG-ECU 2, and instructs the MG-ECU 2 to stop control of the MG 51.

Next, the CPU 20 determines whether or not there is an instruction to control the MG 51 from the vehicle ECU 3 (step St35). If there is an instruction to control the MG 51 (Yes in step St35), the CPU 20 starts the drive process of the inverter 61 (step St36). The drive process of the inverter 61 is as described above.

In addition, if the CPU 20 has not received an instruction to control the MG 51 (No in step St35), it does not drive the inverter 61 and executes the operation of step St37 below.

Then, the CPU 20 determines whether or not a stop command has been received from the vehicle ECU 3 (step St37). If the CPU 20 has received a stop command (Yes in step St37), it executes processing to stop the drive processing of the inverter 61 and the like (step St38). If an abnormality occurs in the MG-ECU 2 or the IG switch 40 is turned off, the vehicle ECU 3 issues a stop command to the MG-ECU 1. At this time, the MG-ECU 2 controls each switching element of the inverter 61 to turn off. Note that even if the CPU 20 receives a stop command when it is not performing the drive processing of the inverter 61, it still performs various processes in preparation for stopping the power supply.

The CPU 20 then updates the startup state information 240 to a "stopped" state (step St39). Therefore, at the next startup, the CPU 20 can determine in step St33 above that no abnormality has occurred in the MG-ECU 2, since the startup state information 240 indicates a stopped state. The CPU 20 then ends its operation, but if power is being supplied from the ECU battery 44, it resumes operation from step St31 after a predetermined time has elapsed.

If the CPU 20 has not received a stop instruction (No in step St37), it executes the operation of step St37 again.

In this way, when the MG-ECU 2 stops control of the MG 51 in accordance with an instruction from the vehicle ECU 3, it writes the start-up status information 240 = "stopped" to the non-volatile memory 24 as a stop record, and when control begins, it determines whether or not there is an abnormality in the MG-ECU 2 based on the start-up status information 240.

(Operation of Vehicle ECU)
Fig. 8 is a flowchart showing an example of the operation of the vehicle ECU 3. In Fig. 8, the two reference characters A are connected to each other. The vehicle ECU 3 determines the presence or absence of an abnormality in the MG-ECU 1 based on the notification of the abnormality determination from the MG-ECU 2 and the notification of the startup time from the MG-ECU 1.

First, the CPU 30 performs a startup process for the vehicle ECU 3 (step St51). The startup process includes a process for reading a program from the ROM 31 and loading it into the RAM 32, a boot process, and various initial setting processes.

Next, CPU 30 determines whether it has received a notification from MG-ECU 2 that an abnormality has been detected (step St52). If CPU 30 has not received a notification (No in step St52), it instructs MG-ECUs 1 and 2 to control MGs 50 and 51, respectively (step St53). At this time, CPU 30 notifies MG-ECUs 1 and 2 of the required torque of each MG 50 and 51 along with the control instructions. MG-ECUs 1 and 2 start driving inverters 60 and 61, respectively, in accordance with the control instructions so that the required torque is output from MGs 50 and 51.

In this way, if the vehicle ECU 3 determines that the MG-ECU 2 is normal, it instructs the MG-ECUs 1 and 2 to execute control. Therefore, if the MG-ECU 2 is normal, not only can the MG-ECU 2 control the MG 51, but the MG-ECU 1 can also control the MG 50.

Then, the CPU 30 determines whether the IG switch 40 is off (step St54). If the IG switch 40 is off (Yes in step St54), the CPU 30 instructs the MG-ECUs 1 and 2 to stop control of the MGs 50 and 51, respectively (step St55). The MG-ECUs 1 and 2 each execute the stop of control of the MGs 50 and 51, etc., in accordance with the control instruction.

Next, the CPU 30 performs a process to stop the vehicle ECU 3 (step St56). After that, the CPU 30 stops operating.

Also, if the IG switch 40 is on (No in step St54), the operations from step St52 onwards are executed again.

When the CPU 30 receives a notification that an abnormality has been detected (Yes in step St52), the CPU 30 determines whether the notification is the first notification after the startup process in step St51 (step St57). Here, the CPU 30 counts the number of notifications after the startup process using, for example, a counter.

If the notification is the first notification since the startup process of step St51 (Yes in step St57), the CPU 30 instructs the MG-ECU 2 to stop control (step St58). The MG-ECU 2 stops driving the inverter 61 in accordance with the instruction to stop. The CPU 30 then performs the operation of step St52 again. For this reason, the MG-ECU 2 temporarily stops control, but resumes control after a predetermined time has elapsed.

In this way, when the MG-ECU 2 first determines that there is an abnormality after startup, the vehicle ECU 3 instructs the MG-ECU 2 to suspend control for a predetermined period of time. Therefore, if the abnormal state of the MG-ECU 2 is temporary, the vehicle ECU 3 can quickly recover from the abnormal state by having the MG-ECU 2 temporarily suspend control.

If the notification is the second notification after the startup process of step St51 (No in step St57), the CPU 30 requests the MG-ECU 1 to notify it of the startup time in order to determine whether or not there is an abnormality in the MG-ECU 1 (step St59). In response to the request, the CPU 10 of the MG-ECU 1 notifies the CPU 30 of the startup time.

Next, CPU 30 compares the startup time with a predetermined threshold value TH (step St60). If startup time < TH is true (Yes in step St60), CPU 30 determines that MG-ECU 1 has just been restarted due to the occurrence of an abnormality, and instructs MG-ECUs 1 and 2 to stop control (step St61). Here, threshold value TH is preset based on, for example, the time required for the startup process of MG-ECUs 1 and 2. If an abnormality such as a momentary power interruption occurs not only in MG-ECU 2 but also in MG-ECU 1, MG-ECU 1 will restart, so it is possible to determine an abnormality from the short startup time.

In this way, when the vehicle ECU 3 determines that the MG-ECU 2 has an abnormality, if the start-up time is less than the threshold, it instructs the MG-ECUs 1 and 2 to stop control. Therefore, the MG-ECUs 1 and 2 stop driving the inverters 60 and 61, respectively, in accordance with the instruction to stop. This allows the vehicle ECU 3 to achieve an appropriate fail-safe in response to the abnormality in the MG-ECUs 1 and 2.

Furthermore, if start-up time ≧TH holds (No in step St60), the CPU 30 determines that an abnormality has occurred only in the MG-ECU 2, and instructs the MG-ECU 2 to stop control (step St62). In this way, when the vehicle ECU 3 determines that the MG-ECU 2 has an abnormality, it instructs the MG-ECU 2 to stop control if the start-up time is equal to or greater than the threshold value TH. Therefore, the MG-ECU 2 stops control of the MG 51 in accordance with the stop instruction. This allows the vehicle ECU 3 to achieve an appropriate fail-safe in response to the abnormality in the MG-ECU 2.

Next, the CPU 30 instructs the MG-ECU 1 to control the MG 51 instead of the MG-ECU 2 (step St63). The MG-ECU 1 drives the inverter 61 in accordance with the control instruction.

In this way, when the vehicle ECU 3 determines that the MG-ECU 2 is abnormal, if the startup time is equal to or greater than the threshold value TH, it instructs the MG-ECU 1 to execute control of the MGs 50 and 51. This allows the vehicle ECU 3 to achieve an appropriate fail-safe in cases where only the MG-ECU 2 is abnormal.

Next, the CPU 30 determines whether the IG switch 40 is off (step St64). If the IG switch 40 is off (Yes in step St64), the CPU 30 instructs the MG-ECU 1 to stop control of the MGs 50 and 51 (step St65). Following the instruction to stop control, the MG-ECU 1 stops driving the inverters 60 and 61, thereby stopping control of the MGs 50 and 51.

Also, if the IG switch 40 is on (No in step St64), the CPU 30 executes the operation of step St63 again. In this manner, the vehicle ECU 3 operates.

In this way, the vehicle ECU 3 can determine whether there is an abnormality in both MG-ECUs 1 and 2 based on the start-up time of MG-ECU 1 in addition to the result of determining whether there is an abnormality in MG-ECU 2, and achieve an appropriate fail-safe.

The above-described embodiment is a preferred example of the present invention. However, the present invention is not limited to this embodiment, and various modifications are possible without departing from the spirit of the present invention.

1 MG-ECU (first computer)
2 MG-ECU (second computer)
3 Vehicle ECU (third computer)
9 Vehicle control device 24 Non-volatile memory 50 Motor generator (first driving force source)
51 Motor generator (second driving force source)
60, 61 Inverter 90 Vehicle

Claims (5)

a first computer that controls a first driving force source of the vehicle;
a second computer for controlling a second driving power source of the vehicle;
a third computer that issues instructions to the first computer and the second computer regarding control of the first driving power source and the second driving power source,
the second computer has a non-volatile memory, and when the second computer stops control in accordance with an instruction from the third computer, writes a stop record into the non-volatile memory, and when the second computer starts control, determines whether or not there is an abnormality in the second computer based on the stop record;
the first computer does not have a non-volatile memory, measures an elapsed time from a start-up time of the first computer,
when the second computer determines that an abnormality has occurred, and the elapsed time is less than a threshold, the third computer instructs the first computer and the second computer to stop control.
Vehicle control device. when the second computer determines that an abnormality has occurred and the elapsed time is equal to or greater than the threshold, the third computer instructs the second computer to stop control.
The vehicle control device according to claim 1. when the second computer determines that an abnormality has occurred and the elapsed time is equal to or greater than the threshold, the third computer instructs the first computer to execute control of the first driving force source and the second driving force source.
The vehicle control device according to claim 2. When the second computer determines that there is no abnormality, the third computer instructs the first computer and the second computer to execute control.
4. A vehicle control device according to claim 1. the third computer instructs the second computer to temporarily stop control when the second computer first determines that an abnormality exists after the third computer is started up;
5. A vehicle control device according to claim 1.

Images