Vehicle control apparatus

A vehicle control device includes: a first calculation processing portion outputting a calculation result based on an input value; and a second calculation processing portion acquiring the same input value as the input value of the first calculation processing portion, the second calculation processing portion detecting an abnormality of the first calculation processing portion based on comparison between the input value of the second calculation processing portion and the calculation result of the first calculation processing portion or based on whether the calculation result is a predefined highly safe state value at which a relatively high safety state of a vehicle is acquired.

TECHNICAL FIELD

The present invention relates to a technique of achieving cost reduction of a vehicle control device.

BACKGROUND ART

A vehicle control device including a first calculation processing portion and a second calculation processing portion is conventionally well known. For example, this corresponds to a vehicle computer system disclosed in Patent Document 1. In the vehicle computer system of Patent Document 1, the first calculation processing portion and the second calculation processing portion have the same configuration and execute the same calculation process. The vehicle computer system compares certain data of the first calculation processing portion and the second calculation processing portion in a calculation process step with each other to detect an abnormality.

PRIOR ART DOCUMENTS

Patent Documents

SUMMARY OF THE INVENTION

Problems to Be Solved by the Invention

As described in Patent Document 1, if one vehicle control device is disposed with two calculation processing portions having the same configuration and executing the same calculation process, detection of abnormality is certainly facilitated and the reliability of calculation result is improved. However, in a vehicle control device having one calculation processing portion as a monitoring object monitored by the other calculation processing portion (a monitoring portion), if the monitoring portion has the same configuration as the monitoring object as in Patent Document 1, a scale is increased not only in the monitoring object but also in the monitoring portion as the calculation performed by the monitoring object becomes complicated, causing a problem of significant increase in cost of the monitoring portion. For example, one calculation frequently performed in the vehicle control device is a fail-safe calculation. Since every vehicle situation is considered in this fail-safe calculation, the logic and the necessary input of the calculation become complicated. When the monitoring object performs the fail-safe calculation, if the monitoring portion is caused to perform the same fail-safe calculation, the monitoring portion requires a large amount of ROMs etc., as well as the monitoring object and is increased in scale, which leads to higher cost of the monitoring portion. Such a problem is unknown.

The present invention was conceived in view of the situations and it is therefore an object of the present invention to provide a vehicle control device capable of suppressing a cost increase while ensuring reliability of a calculation result of a calculation processing portion.

Means for Solving the Problem

To achieve the object, the first aspect of the invention provides a vehicle control device (a) comprising: a first calculation processing portion outputting a calculation result based on an input value; and a second calculation processing portion acquiring the same input value as the input value of the first calculation processing portion, (b) the second calculation processing portion detecting an abnormality of the first calculation processing portion based on comparison between the input value of the second calculation processing portion and the calculation result of the first calculation processing portion or based on whether the calculation result is a predefined highly safe state value at which a relatively high safety state of a vehicle is acquired.

Effects of the Invention

Consequently, since the second calculation processing portion does not need to have the same configuration as the first calculation processing portion for ensuring the reliability of the calculation result of the first calculation processing portion, the cost increase of the vehicle control device can be suppressed while the reliability of the calculation result of the first calculation processing portion is ensured even if the first calculation processing portion has a large-scale configuration.

The second aspect of the invention provides the vehicle control device recited in the first aspect of the invention, wherein the second calculation processing portion judges that the first calculation processing portion is abnormal if no condition is satisfied out of a condition that the calculation result of the first calculation processing portion is equal to the input value of the second calculation processing portion, a condition that the calculation result of the first calculation processing portion is the highly safe state value, and a condition that the calculation result of the first calculation processing portion is a value at which a higher safety state of the vehicle is acquired as compared to the input value of the second calculation processing portion. Consequently, it can be determined whether the first calculation processing portion is abnormal, under specific judgment criteria.

The third aspect of the invention provides the vehicle control device recited in the second aspect of the invention, wherein (a) the vehicle control device further comprises a shift operation device outputting a shift position selected by a driver as an electric signal to the first calculation processing portion and the second calculation processing portion, wherein (b) the input value of the first calculation processing portion and the second calculation processing portion is the shift position selected in the shift operation device, and wherein (c) the calculation result of the first calculation processing portion is set to any of the shift positions selectable in the shift operation device. Consequently, the cost increase of the vehicle control device providing shift control can be suppressed while preventing the impairment of the reliability of the calculation result of the first calculation processing portion, i.e., the reliability of the shift control, in the shift control of recognizing the shift position based on the electric signal from the shift operation device and providing shift control etc.

The fourth aspect of the invention provides the vehicle control device recited in the third aspect of the invention, wherein (a) any of the shift positions is selected in the shift operation device from a parking position at which power transmission to drive wheels is interrupted while the drive wheels are fixed, a neutral position at which the power transmission to the drive wheels is interrupted while the drive wheels are allowed to rotate, and a running position at which the vehicle is allowed to run forward or backward, wherein (b) the highly safe state value is predefined as the parking position, and wherein (c) the neutral position is predefined as a position at which a higher safety state of the vehicle is acquired as compared to the running position. Consequently, since the relationship between the height of the safety state of the vehicle and the shift position is predefined, the second calculation processing portion can easily determine whether the first calculation processing portion is abnormal.

Preferably, in the vehicle control device recited in the first aspect of the invention, the second calculation processing portion judges that the first calculation processing portion is abnormal if two conditions i.e., a condition that the calculation result of the first calculation processing portion is equal to the input value of the second calculation processing portion and a condition that the calculation result of the first calculation processing portion is the highly safe state value are not satisfied.

Preferably, in the vehicle control device recited in the first aspect of the invention, the second calculation processing portion judges that the first calculation processing portion is abnormal if two conditions i.e., a condition that the calculation result of the first calculation processing portion is equal to the input value of the second calculation processing portion and a condition that the calculation result of the first calculation processing portion is a value at which a higher safety state of the vehicle is acquired as compared to the input value of the second calculation processing portion are not satisfied.

Preferably, in the vehicle control device recited in the first aspect of the invention, the second calculation processing portion judges that the first calculation processing portion is abnormal if two conditions i.e., a condition that the calculation result of the first calculation processing portion is the highly safe state value and a condition that the calculation result of the first calculation processing portion is a value at which a higher safety state of the vehicle is acquired as compared to the input value of the second calculation processing portion are not satisfied.

Preferably, in the vehicle control device recited in the first aspect of the invention, the second calculation processing portion judges that the first calculation processing portion is abnormal if a condition that the calculation result of the first calculation processing portion is the highly safe state value is not satisfied.

MODE FOR CARRYING OUT THE INVENTION

EXAMPLE

FIG. 1is a diagram for explaining a general configuration of a vehicle10to which the present invention is applied and a block diagram exemplarily illustrating input/output signals of an electronic control device60controlling the vehicle10. InFIG. 1, the vehicle10is an FF (front-engine front-drive) type vehicle and the vehicle10includes a parking lock device16mechanically blocking rotation of drive wheels14during parking, a transmission18, a shift operation device30, etc., and employs a shift-by-wire (SBW) mode in which the electronic control device60acquires a shift position Psh selected in the shift operation device30through an electric signal. The transmission18is a stepped automatic transmission typically used in a vehicle and includes a plurality of planetary gear devices and a plurality of hydraulic friction engagement devices, for example. The vehicle10causes power of an engine12that is an internal combustion engine acting as a drive force source for running to be transmitted sequentially via the transmission18, a differential gear device (differential gear)26, a pair of axles (drive shafts)28, etc., to a pair of the drive wheels14. Although the vehicle10ofFIG. 1has only the engine12as the drive force source for running, the vehicle10may be a hybrid vehicle or an electric vehicle.

The vehicle10includes the electronic control device60acting as a vehicle control device providing various controls of the vehicle10. The electronic control device60includes a so-called microcomputer including, for example, a CPU, a RAM, a ROM, and an input/output interface. The electronic control device60executes signal processes in accordance with programs stored in advance in the ROM etc. to provide an output control of the engine12, a shift control of the transmission18, a control related to the shift-by-wire mode, a switching control of an operation state of the parking lock device16, etc.

The electronic control device60is supplied with, for example, shift lever position signals corresponding to an operation position Pope from a shift sensor36and a select sensor38(seeFIG. 2) that are position sensors for detecting the operation position Pope of a shift lever32, a P-switch signal indicative of a switch operation of a P-switch34for switching the shift position Psh selected in the shift operation device30from a non-P position other than a parking position (P-position) to the P-position, a power switch signal indicative of a switch operation of a vehicle power switch40for switching a switching state of power supply of the vehicle10in accordance with operation by a user (driver), a signal indicative of a vehicle speed V from a vehicle speed sensor42.

The electronic control device60outputs signals for controlling the engine12and the transmission18, for example.

FIG. 2is a diagram of an example of the shift operation device30acting as a switching device (operation device) switching a plurality of types of the shift positions Psh through artificial operation. The shift operation device30includes the shift lever32disposed near a driver's seat, for example, and acting as a momentary operator operated to any of the multiple operation positions Pope, i.e., an automatically returning operator automatically returning to an original position (initial position) when an operation force is canceled. The shift operation device30of this example includes the P-switch34operated when a driver selects the parking position (P-position) as another switch near the shift lever32.

The shift lever32is operated to each of the three operation positions Pope arranged in a front-back direction or up-down direction, i.e., a longitudinal direction, of the vehicle10as depicted inFIG. 2, which are an R-operation position (corresponding to an R-position), an N-operation position (corresponding to an N-position), and a D-operation position (corresponding to a D-position), as well as an M-operation position and a B-operation position (corresponding to a B-position) arranged in parallel therewith. The shift operation device30has the R-position selected as the shift position Psh when the shift lever32is shift-operated to the R-operation position by a driver, the N-position selected as the shift position Psh when the shift lever32is shift-operated to the N-operation position, the D-position selected as the shift position Psh when the shift lever32is shift-operated to the D-operation position, and the B-position selected as the shift position Psh when the shift lever32is shift-operated to the B-operation position. If the shift lever32is operated by a driver, the shift operation device30outputs the shift position Psh of the shift operation device30selected by the driver as an electric signal (shift lever position signal) to the electronic control device60. In particular, the shift position Psh is output to a main microcomputer62sand a monitoring microcomputer64s(seeFIG. 9). The shift lever32can be operated in the longitudinal direction between the R-operation position, the N-operation position, and the D-operation position, can be operated in the longitudinal direction between the M-operation position and the B-operation position, and can further be operated in a lateral direction of the vehicle10orthogonal to the longitudinal direction between the N-operation position and the B-operation position.

The P-switch34is a momentary push-button switch, for example, and outputs the P-switch signal to the electronic control device60each time a user (driver) performs a pushing operation. For example, if the shift position Psh is set to the P-position when the parking lock device16does not execute a parking lock mechanically blocking the rotation of the drive wheels14, the driver performs the pushing operation of the P-switch34. Therefore, if the driver performs the pushing operation of the P-switch34, the shift operation device30outputs the P-position, i.e., the shift position Psh selected by the driver, as an electric signal (P-switch signal) to the electronic control device60. In particular, the P-position is output to the main microcomputer62sand the monitoring microcomputer64s(seeFIG. 9). The P-position is a parking position (parking position) at which a power transmission path is interrupted in the transmission18while the parking lock device16executes the parking lock. In other words, the P-position is the parking position at which a power transmission to the drive wheels14is interrupted while the drive wheels14are fixed by the parking lock device16. This parking lock is executed on condition that a predetermined condition is satisfied such as the vehicle speed V equal to or less than a predetermined vehicle speed equivalent to a vehicle stop.

The M-operation position of the shift operation device30is the initial position of the shift lever32and, even if a lever operation is performed to the operation positions Pope (R-, N-, D-, and B-operation positions) other than the M-operation position, when a driver releases the shift lever32, i.e., an external force acting on the shift lever32disappears, the shift lever32returns to the M-operation position due to a mechanical mechanism such as a spring. When each of the shift positions Psh is selected in the shift operation device30, the electronic control device60operates the transmission18, the parking lock device16, etc., in accordance with the selected shift position Psh.

Describing the shift positions Psh, the R-position is a running position at which a drive force causing the vehicle10to run backward is transmitted to the drive wheels14, i.e., a backward running position. The N-position (neutral position) is a neutral position achieving a neutral state in which the power transmission path in the transmission18is interrupted or, in other words, a neutral position at which the power transmission to the drive wheels14is interrupted while the drive wheels14are allowed to rotate. The D-position is a running position at which a drive force causing the vehicle10to run forward is transmitted to the drive wheels14, i.e., a forward running position. For example, while the parking lock device16executes the parking lock, if the R-position, the N-position, or the D-position is selected in the shift operation device30, the electronic control device60releases the parking lock given that a predetermined condition such as a depressing operation of a brake pedal is satisfied.

The B-position is a running position at which engine brake effect is produced by, for example, the vehicle10at the D-position to decelerate the rotation of the drive wheels14, i.e., a deceleration forward running position (engine brake range). Therefore, the electronic control device60disables the selection of the B-position if the shift operation is performed to select the B-position when the current shift position Psh is a shift position Psh other than the D-position, and enables the shift operation selecting the B-position only in the case of the D-position.

Since the shift lever32is returned to the M-operation position when the external force acting thereon disappears in the shift operation device30of this example, the shift position Psh being selected cannot be recognized by only visually recognizing the operation position Pope of the shift lever32. Therefore, a shift position display device46displaying the shift position Psh being selected is disposed at an easily viewable position for a driver in a vehicle interior.

This example employs a so-called shift-by-wire (SBW) mode and, since the shift operation device30is two-dimensionally shift-operated in a first direction P1that is the longitudinal direction and a second direction P2that is the lateral direction intersecting with (inFIG. 2, orthogonal to) the direction P1, the shift operation device30includes the shift sensor36as a first direction detecting portion detecting a shift operation in the first direction P1and the select sensor38as a second direction detecting portion detecting a shift operation in the second direction P2, so as to output the operation position Pope of the shift lever32as detection signals of the position sensors to the electronic control device60. Each of the shift sensor36and the select sensor38outputs to the electronic control device60a detection signal (electric signal) corresponding to the operation position Pope, and the electronic control device60recognizes (determines) the operation position Pope of the shift lever32, i.e., the shift position Psh selected by the shift operation, based on the detection signals.

Describing one example of the detection signals indicative of the operation positions Pope of the shift lever32, the shift sensor36outputs a detection signal corresponding to any of a first-direction first position P1_1indicative of the R-operation position, a first-direction second position P1132. indicative of the M-operation position or the N-operation position, and a first-direction third position P1_3indicative of the B-operation position or the D-operation position to the electronic control device60depending on the shift operation of the shift lever32. The select sensor38outputs a detection signal corresponding to either a second-direction first position P2_1indicative of the M-operation position or the B-operation position, or a second-direction second position P2_2indicative of the R-operation position, the N-operation position, or the D-operation position to the electronic control device60depending on the shift operation of the shift lever32. Although one sensor may be disposed for each of the shift sensor36and the select sensor38, two sensors are disposed for each of the sensors in this example in preparation for a failure etc., of the sensors. For example, two sensors acting as the shift sensor36are a main shift sensor and a sub-shift sensor outputting the same detection signals to the electronic control device60, and two sensors acting as the select sensor38are a main select sensor and a sub-select sensor outputting the same detection signals to the electronic control device60.

FIG. 3is a functional block diagram of a generalized main portion of a configuration in the electronic control device60for providing one control out of various controls provided in the vehicle10. The various controls are controls related to vehicle running, for example, and the various controls correspond to shift control of recognizing the shift position Psh based on the electric signal from the shift operation device30, throttle control for opening/closing operation of an electronic throttle valve disposed on the engine12based on an electric signal corresponding to an accelerator opening degree Acc, etc. As depicted inFIG. 3, the electronic control device60includes a main microcomputer62outputting a calculation result for providing the one control in the vehicle10and a monitoring microcomputer64as a monitoring portion monitoring whether an abnormality exists in the main microcomputer62that is a main calculation processing portion as well as a monitoring object. In other words, the main microcomputer62is a first calculation processing portion outputting the calculation result based on an input value and the monitoring microcomputer64is a second calculation processing portion acquiring the input value same as the input value of the main microcomputer62to detect an abnormality in the main microcomputer62based on the input value. The main microcomputer62functionally includes an input accepting portion66accepting input signals (electric signals indicative of pulse interval, voltage, etc.) from detection equipment such as a sensor and the monitoring microcomputer64also functionally includes a similar input accepting portion68. The both input accepting portions66and68have the same configurations executing the same processes as each other since the main microcomputer62and the monitoring microcomputer64acquire the same input values as each other. Specifically, the input accepting portions66and68execute a process of obtaining from the input signal an input value indicated by the input signal. The input value is a control value directly indicated by the input signal input to the input accepting portions66and68. For example, if the calculation result of the main microcomputer62is used for the shift control, the input value is the shift position Psh directly indicated by the input signal, and if the calculation result is used for the throttle control, the input value is a magnitude of the accelerator opening degree Acc directly indicated by the input signal from an accelerator opening degree sensor detecting the accelerator opening degree Acc. Taking the shift control as an example, the input accepting portions66and68obtain from input signals from the shift sensor36and the select sensor38the shift position Psh indicated by the input signals as the input value.

As depicted inFIG. 3, the main microcomputer62determines a final control value that is the calculation result based on the input value acquired by the input accepting portion66and outputs the final control value. The final control value is used for providing the one control associated with the main microcomputer62. The final control value is a value of the same type as, and comparable with, the input value and, for example, if the input value is the accelerator opening degree Acc, the final control value is the accelerator opening degree Acc, or if the input value is the shift position Psh, the final control value is the shift position Psh. Specifically, in the course of obtaining the final control value from the input value, the main microcomputer62executes various generally known intermediate processes and a so-called fail-safe process for improving a safety of the vehicle10and determines the final control value after these processes. Therefore, if the processes in the main microcomputer62are normal, the main microcomputer62does not deteriorate (lower) a safety state of the vehicle10acquired from the final control value as compared to the safety state of the vehicle10acquired from the input value. Although the safety state of the vehicle10is a safe vehicle state for an occupant of the vehicle10and the safety state of the vehicle10widely differs depending on details of control of the main microcomputer62, for example, if the main microcomputer62sprovides the shift control, the vehicle10is in a higher safety state when the vehicle state is closer to a vehicle stop state. The input value varies discretely or continuously within a predefined maximum variation range of the possible input values, and the final control value varies discretely or continuously within the same range as the maximum variation range as is the case with the input value.

The monitoring microcomputer64provides abnormality detection control of detecting an abnormality of the main microcomputer62based on comparison between an input value of the monitoring microcomputer64, i.e., an input value acquired by the input accepting portion68, and a calculation result of the main microcomputer62, i.e., the final control value, or based on whether the final control value is a predefined highly safe state value. Therefore, the monitoring microcomputer64performs fail-safe output indicative of whether the main microcomputer62is abnormal. The highly safe state value is predefined depending on specific control of the one control associated with the main microcomputer62. Defining the highly safe state value, the highly safe state value is a value at which a relatively high safety state of the vehicle10can be acquired, for example, a value at which the highest safety state of the vehicle10can be acquired within the maximum variation range. If the monitoring microcomputer64judges that the main microcomputer62is abnormal, for example, the final control value of the main microcomputer62is handled as an abnormal value in the one control associated with the main microcomputer62. The electronic control device60then executes a process predefined to be executed when the final control value is an abnormal value in the one control.

Specifically, the monitoring microcomputer64functionally includes an abnormality detection control portion70for providing the abnormality detection control, and the abnormality detection control portion70detects an abnormality of the main microcomputer62by using any one of determination patterns depicted inFIGS. 4 to 8in the abnormality detection control. In other words, the abnormality detection control portion70judges whether the main microcomputer62is abnormal. Which of the determination patterns depicted inFIGS. 4 to 8is employed to provide the abnormality detection control is determined depending on specific control of the one control associated with the main microcomputer62. Each of the control operations depicted inFIGS. 4 to 8is performed solely or concurrently with another control operation. Common steps inFIGS. 4 to 8are denoted by the same reference numerals.

For example, when a first determination pattern depicted inFIG. 4is employed in the abnormality detection control, as depicted inFIG. 4, the abnormality detection control portion70makes a judgment on a first condition that the final control value (calculation result) of the main microcomputer62is equal to the input value of the monitoring microcomputer64at SA1, makes a judgment on a second condition that the final control value of the main microcomputer62is the highly safe state value at SA2, and makes a judgment on a third condition that the final control value of the main microcomputer62is a value at which a higher safety state of the vehicle10is acquired as compared to the input value of the monitoring microcomputer64at SA3. If none of the first to third conditions are satisfied, the abnormality detection control portion70judges that the main microcomputer62is abnormal at SA4. A height of the safety state of the vehicle10acquired from the input value and a height of the safety state of the vehicle10acquired from the final control value are preferably predefined.

When a second determination pattern depicted inFIG. 5is employed in the abnormality detection control, as depicted inFIG. 5, when none of two conditions, i.e., the first and second conditions, are satisfied, the abnormality detection control portion70judges that the main microcomputer62is abnormal at SA5.

When a third determination pattern depicted inFIG. 6is employed in the abnormality detection control, as depicted inFIG. 6, when none of two conditions, i.e., the first and third conditions, are satisfied, the abnormality detection control portion70judges that the main microcomputer62is abnormal at SA6.

When a fourth determination pattern depicted inFIG. 7is employed in the abnormality detection control, as depicted inFIG. 7, when none of two conditions, i.e., the second and third conditions, are satisfied, the abnormality detection control portion70judges that the main microcomputer62is abnormal at SA7.

When a fifth determination pattern depicted inFIG. 8is employed in the abnormality detection control, as depicted inFIG. 8, when the second condition is not satisfied, the abnormality detection control portion70judges that the main microcomputer62is abnormal at SA8.

Description will then be made of an example of the case that the one control associated with the main microcomputer62ofFIG. 3is specifically the shift control with reference toFIG. 9.FIG. 9is a functional block diagram corresponding toFIG. 3and is a functional block diagram of a main portion of the configuration in the electronic control device60for providing the shift control. The main microcomputer62ofFIG. 3is specifically represented as the main microcomputer62sinFIG. 9and the monitoring microcomputer64ofFIG. 3is specifically represented as the monitoring microcomputer64sinFIG. 9. The input accepting portion66of the main microcomputer62ofFIG. 3is specifically represented as an input accepting portion66sof the main microcomputer62sinFIG. 9; the input accepting portion68of the monitoring microcomputer64ofFIG. 3is specifically represented as an input accepting portion68sof the monitoring microcomputer64sinFIG. 9; and the abnormality detection control portion70of the monitoring microcomputer64ofFIG. 3is specifically represented as an abnormality detection control portion70sof the monitoring microcomputer64sinFIG. 9. In other words, the main microcomputer62sand the monitoring microcomputer64sare included in the electronic control device60inFIG. 9, and the main microcomputer62sand the monitoring microcomputer64scorrespond to the first calculation processing portion of the present invention and the second calculation processing portion of the present invention, respectively. InFIG. 9, the input accepting portions66sand68sreceive input of an electric signal, i.e., an input signal, from the shift operation device30and the input accepting portion66sand68sobtain from the input signal the shift position Psh indicated by the input signal as the input value. In other words, the input value of the main microcomputer62sand the monitoring microcomputer64sis the shift position Psh selected in the shift operation device30. For example, if the lever operation of the shift lever32is performed by a driver to the R-operation position, the input value turns to the R-position and, if the lever operation of the shift lever32is performed by a driver to the N-operation position, the input value turns to the N-position.

As described with regard to the main microcomputer62ofFIG. 3, the main microcomputer62sexecutes the intermediate processes and the fail-safe process for the input value acquired by the input accepting portion66sand determines and outputs the final control value that is the calculation result based on the input value after these processes. The final control value is also referred to as a control shift inFIG. 9. When the main microcomputer62sdetermines the control shift, for example, the shift control of the transmission18is provided in accordance with the control shift and the parking lock device16is operated. The control shift is set to any of the shift positions Psh selectable in the shift operation device30, i.e., any of the R-, N-, D-, B-, and P-positions. Since the main microcomputer62sprovides the shift control, for example, the intermediate processes or the fail-safe process provided by the main microcomputer62smay be that (i) when the current shift position Psh is other than the D-position, if the B-position is acquired as the input value, the control shift (final control value) is not set to the B-position and is allowed to remain at the current shift position Psh, that (ii) during high speed running at a predetermined vehicle speed or higher, when the current shift position Psh is the D-position, if the R-position is acquired as the input value, the control shift is determined as the N-position, that (iii) during high speed running at a predetermined vehicle speed or higher, when the current shift position Psh is the R-position, if the D-position is acquired as the input value, the control shift is determined as the N-position, and that (iv) if an input signal continuously input to the input accepting portions66sand68sis a signal that is impossible if electric circuits such as the shift operation device30are normal, the control shift is determined as the N-position.

The monitoring microcomputer64sprovides the abnormality detection control as described above for the monitoring microcomputer64ofFIG. 3. Since the final control value of the main microcomputer62sis used for the shift control, if the vehicle state acquired from the shift position Psh defined as the input value or the final control value is closer to the vehicle stop state, it is determined that the vehicle10is in a higher safety state. Therefore, as depicted in a vehicle safety state map ofFIG. 10, among the R-, N-, D-, B-, P-positions, the P-position is the shift position Psh at which the highest safety state of the vehicle10is acquired. The N-position is the shift position Psh at which the next highest safety state of the vehicle10is acquired after the P-position. The N-position is the shift position Psh at which a higher safety state of the vehicle10is acquired as compared to the R-, D-, and B-positions, i.e., as compared to the running positions. Such a relationship between the height of the safety state of the vehicle10and the shift position Psh is predefined as the vehicle safety state map ofFIG. 10and stored in the monitoring microcomputer64s. As can be seen from this vehicle safety state map, the highly safe state value ofFIG. 9is the P-position. From the vehicle safety state map ofFIG. 10, the relationship of the input value of the monitoring microcomputer64s, the control shift (final control value) of the main microcomputer62s, and the satisfaction of the first to third conditions (seeFIG. 4) can be represented by a map ofFIG. 11. InFIG. 11, [1] . indicates that the first condition is satisfied; [2] . indicates that the second condition is satisfied; [3] . indicates that the third condition is satisfied; and a “cross mark” indicates that none of the first to third conditions is satisfied. Since both the D- and B-positions are the running positions causing the vehicle10to run forward, both the D- and B-positions are considered as the same shift position Psh in the abnormality detection control provided by the monitoring microcomputer64sas can be seen fromFIG. 11.

Since the vehicle safety state map ofFIG. 10is predefined as described above, the monitoring microcomputer64sjudges whether the main microcomputer62sis abnormal from the vehicle safety state map in the abnormality detection control. As is the case with the description ofFIG. 3, if the monitoring microcomputer64sjudges that the main microcomputer62sis abnormal, the control shift (final control value) of the main microcomputer62sis handled as an abnormal value in the shift control. The electronic control device60then executes a process predefined to be executed when the control shift is an abnormal value. For example, the electronic control device60executes a process of displaying the occurrence of abnormality at an easily viewable position for a driver in a vehicle interior or a process of promptly stopping the vehicle10if running.

InFIG. 9, the first determination pattern is specifically employed out of the first to fifth determination patterns depicted inFIGS. 4 to 8in the abnormality detection control executed by the monitoring microcomputer64s. This is because the abnormality detection control relates to the shift control. Therefore, the abnormality detection control portion70sof the monitoring microcomputer64sexecutes the flowchart depicted inFIG. 4in the abnormality detection control. In particular, the abnormality detection control portion70smakes a judgment on each of the first to third conditions described at SA1to SA3ofFIG. 4in accordance with the vehicle safety state map. If none of the first to third conditions is satisfied, the abnormality detection control portion70sjudges that the main microcomputer62sis abnormal at SA4. ofFIG. 4.

As described above, according to this example, the electronic control device60includes the main microcomputer62,62sthat is the first calculation processing portion outputting a calculation result based on the input value, and the monitoring microcomputer64,64sthat is the second calculation processing portion acquiring the same input value as the input value of the main microcomputer62,62s. The monitoring microcomputer64,64sdetects an abnormality of the main microcomputer62,62sbased on comparison between the input value of the monitoring microcomputer64,64sand the calculation result of the main microcomputer62,62sor based on whether the calculation result is the predefined highly safe state value at which the relatively high safety state of the vehicle10is acquired. Therefore, since the monitoring microcomputer64,64sdoes not need to have the same configuration as the main microcomputer62,62sfor ensuring a reliability of the calculation result of the main microcomputer62,62s, a cost increase of the electronic control device60can be suppressed while the reliability of the calculation result of the main microcomputer62,62sis ensured even if the main microcomputer62,62shas a large-scale configuration.

According to this example, as depicted in the flowchart ofFIG. 4, the monitoring microcomputer64sjudges that the main microcomputer62sis abnormal if no condition is satisfied out of the first condition that the final control value (calculation result) of the main microcomputer62sis equal to the input value of the monitoring microcomputer64s, the second condition that the calculation result of the main microcomputer62sis the highly safe state value, and the third condition that the calculation result of the main microcomputer62sis a value at which a higher safety state of the vehicle10is acquired as compared to the input value of the monitoring microcomputer64s. Therefore, the monitoring microcomputer64scan determine whether the main microcomputer62sis abnormal, under specific judgment criteria.

According to this example, the shift operation device30outputs the shift position Psh selected by a driver as an electric signal to the main microcomputer62sand the monitoring microcomputer64s. The input value of the main microcomputer62sand the monitoring microcomputer64sis the shift position Psh selected in the shift operation device30and the final control value (calculation result) of the main microcomputer62sis set to any of the shift positions Psh (the R-, N-, D-, B-, and P-positions) selectable in the shift operation device30. Therefore, a cost increase of the monitoring microcomputer64scan be suppressed while preventing the impairment of the reliability of the calculation result of the main microcomputer62s, i.e., a reliability of the shift control, in the shift control of recognizing the shift position Psh based on the electric signal from the shift operation device30. In short, the cost increase of the electronic control device60providing the shift control can be suppressed.

According to this example, the highly safe state value is predefined as the P-position (parking position). The N-position (neutral position) is predefined as the position at which a higher safety state of the vehicle10is acquired as compared to the R-, D-, and B-positions (running positions). Therefore, since the relationship between the height of the safety state of the vehicle10and the shift position Psh is predefined, the monitoring microcomputer64scan easily determine whether the main microcomputer62sis abnormal in accordance with the flowchart ofFIG. 4.

Although the example of the present invention has been described in detail with reference to the drawings, the present invention is applicable in other forms.

For example, although the shift lever32is two-dimensionally shift-operated in the example, the shift lever32may be shift-operated along one axis or may be three-dimensionally shift-operated. Although the shift lever32returns to the M-operation position when the external force acting on the shift lever32disappears, the shift lever32may be formed such that the shift lever stays at the operation position Pope in accordance with the operation of a driver without returning to the M-operation position.

Although the shift sensor36and the select sensor38are included as the position sensors detecting the position of the shift lever32in the example, the number of the position sensors is not limited to two.

Although the shift lever32is a momentary lever switch in the example, the shift lever32may be replaced with, for example, a push-button switch or a sliding switch. Additionally, the shift operation device30may be shift-operated by a foot instead of being operated by hand, or may be shift-operated in response to voice of a driver. In short, the shift operation device30may be any operation device converting an intention of shifting of a driver into an electric signal.

Although the vehicle safety state map is exemplarily illustrated inFIG. 10in the example, the vehicle safety state map may be switched depending on a vehicle state such as whether the vehicle10is stopped, decelerated, or running at high speed.

Although the input accepting portions66,68,66s, and68sobtain from the input signal the input value indicated by the input signal in the example, if the input signal itself is abnormal, a predetermined fail-safe process may be executed. For example, if either the main shift sensor or the sub-shift sensor is abnormal or if either the main select sensor or the sub-select sensor is abnormal inFIG. 9, the input accepting portions66sand68smay obtain the input value based on the input signal from the other sensor.

The above description is merely an embodiment and the present invention may be implemented in variously modified and improved forms based on the knowledge of those skilled in the art.

NOMENCLATURE OF ELEMENTS

14: drive wheels

30: shift operation device

60: electronic control device (vehicle control device)