Control apparatus and reset method of control apparatus

A first and a second control modules of a control apparatus of the present disclosure mutually monitor a state of the other end and send a reset request signal to a monitoring module when the other end should be reset. The monitoring module sends a reset signal to one of the first and second control modules when the monitoring module receives the reset request signal indicating that the one of the first and second control modules should be reset from the other and the monitoring module does not send the reset signal to the other. The monitoring module prohibits a reset of one of the first and second control modules when the monitoring module receives the reset request signal indicating that the one of the first and second control modules should be reset from the other and the monitoring module sends the reset signal to the other.

CROSS-REFERENCE TO RELATED APPLICATION

The present disclosure claims priority to Japanese Patent Application No. 2019-031814 filed on Feb. 25, 2019, which is incorporated herein by reference in its entirety including specification, drawings and claims.

TECHNICAL FIELD

The present disclosure relates to a control apparatus that includes a first control module configured to control a first equipment, a second control module configured to control the first equipment or a second equipment different from the first equipment, and a monitoring module configured to monitor the first and second control modules, and to a reset method of the control apparatus.

BACKGROUND

A conventionally known control apparatus includes a sub-microcomputer with a function of outputting a trigger signal, a main microcomputer triggered by the trigger signal so as to perform a specific computation processing and send an computation result to the sub-microcomputer, and a watchdog timer (computer monitoring means) to which the trigger signal is input (as described in, for example, Japanese Patent No. 6081239). In the control apparatus, the sub-microcomputer monitors a state of the main microcomputer based on the computation result from the main microcomputer and outputs a reset signal so as to reset the main microcomputer when the computation result is abnormal. The watchdog timer resets both the sub-microcomputer and the main microcomputer when a cycle of the trigger signal from the sub-microcomputer is not within a normal range. Further, the main microcomputer terminates its operation when the cycle of the trigger signal from the sub-microcomputer is not within the normal range.

A conventionally known double microcomputer system includes first and second microcomputers (CPUs) respectively storing the same program and controlling a common control target in accordance with separate clock sources of substantially the same clock speed, a first watchdog pulse cutoff circuit, a first watchdog timer circuit, a second watchdog pulse cutoff circuit, and a second watchdog timer circuit (as described in, for example, Japanese Patent No. 2593915). The first watchdog timer circuit of the double microcomputer system monitors watchdog pulses from the first microcomputer. The second watchdog timer circuit monitors watchdog pulses from the second microcomputer. Further, the first watchdog pulse cutoff circuit cuts off a supply of the watchdog pulses from the first microcomputer to the first watchdog timer circuit in response to a watchdog test signal from the second microcomputer. The second watchdog pulse cutoff circuit cuts off a supply of the watchdog pulses from the second microcomputer to the second watchdog timer circuit in response to a watchdog test signal from the first microcomputer. Each of the first and second watchdog timer circuits outputs a reset signal to the first or second microcomputer when the supply of the watchdog pulses from the first or second microcomputer is cut off.

SUMMARY

However, in the control apparatus disclosed in Japanese Patent No. 6081239, the main microcomputer may be reset due to a malfunction of the sub-microcomputer even though it operates normally when an abnormality occurs in the sub-microcomputer. Further, when one of the first and second microcomputers of the double microcomputer system disclosed in Japanese Patent No. 2593915 normally operates and an abnormality occurs in the other, the normally operating one of the first and second microcomputers may be reset in response to the watchdog test signal erroneously output from the other of the first and second microcomputers.

A main object of the present disclosure is to suppress a normal one of first and second control modules included in a control apparatus to be reset when the one of the first and second control modules normally operates and an abnormality occurs in the other.

A control apparatus of the present disclosure includes a first control module configured to control a first equipment, a second control module configured to control the first equipment or a second equipment different from the first equipment, and a monitoring module configured to monitor the first and second control modules and to send a reset signal to each of the first and second control modules. The first and second control modules mutually monitor a state of the other end and send a reset request signal to the monitoring module when the other end should be reset. The monitoring module sends the reset signal to one of the first and second control modules when the monitoring module receives the reset request signal indicating that the one of the first and second control modules should be reset from the other of the first and second control modules and the monitoring module does not send the reset signal to the other of the first and second control modules. The monitoring module prohibits a reset of one of the first and second control modules when the monitoring module receives the reset request signal indicating that the one of the first and second control modules should be reset from the other of the first and second control modules and the monitoring module sends the reset signal to the other of the first and second control modules.

DESCRIPTION OF EMBODIMENTS

The following describes some embodiments of the disclosure with reference to drawings.

FIG. 1is a schematic configuration diagram illustrating a vehicle1that includes a motor electronic control unit (hereinafter referred to as “MGECU”)50or the control apparatus according to the present disclosure. The vehicle1shown inFIG. 1includes an engine2, a motor generator MG1mainly operated as a generator, a motor generator MG2mainly outputting a driving power and a regenerative braking force, a single pinion planetary gear3, a power storage device (battery)4, a power control unit (PCU)5connected to the power storage device4and configured to drive the motor generators MG1and MG2, and a hybrid electronic control unit (hereinafter referred to as “HVECU”)10configured to control the entire vehicle1.

The engine2is an internal combustion engine configured to generate power by explosive combustion of a mixture of a hydrocarbon fuel and the air. The engine2is controlled by an engine electronic control unit (hereinafter referred to as “engine ECU”)20. The motor generators MG1and MG2are respectively configured as a synchronous motor generator (three-phase AC motor). The planetary gear3includes a sun gear coupled to the motor generator MG1(rotor), a ring gear connected to an output shaft and coupled to the motor generator MG2(rotor), and a planet carrier that rotatably supports a plurality of pinion gears and is coupled to a crankshaft of the engine2. The output shaft is coupled to left and right drive wheels DW via a differential gear DF and drive shafts DS. The power storage device4is, for example, a lithium ion secondary battery or a nickel hydrogen secondary battery. The power control unit5includes a first inverter5aconfigured to drive the motor generator MG1, a second inverter5bconfigured to drive the motor generator MG2, a boost converter (not shown) and the like. The power control unit5is controlled by the MGECU50.

As shown in the figure, the HVECU10, the engine ECU20and the MGECU50are respectively connected to a common communication line (multiplex communication bus) BM that is a CAN bus including two communication lines (wire harnesses) of Lo and Hi, and exchanges information (communication frame) each other via the common communication line BM by CAN communication. The MGECU50(same in the engine ECU20) is individually connected to the HVECU10via a dedicated communication line (local communication bus) BL which is a CAN bus including two communication lines (wire harnesses) of Lo and Hi. The MGECU50exchanges information (communication frame) with the HVECU10via the dedicated communication line BL.

The MGECU50is configured to control the power control unit5in cooperation with the HVECU10and the engine ECU20. As shown inFIG. 1, the MGECU50includes a first microcomputer51as a first control module that controls the first inverter5acorresponding to the motor generator MG1(first equipment), a second microcomputer52as a second control module that controls the second inverter5bcorresponding to the motor generator MG2(second equipment), the boost converter (not shown) and the like, and a monitoring unit (monitoring module)53that monitors the first and second microcomputers51and52.

The first microcomputer51of the MGECU50includes a first CPU, a ROM, a RAM, an input-output interface, various drive circuits, various logic ICs and the like (not shown). Further, the second microcomputer52includes a second CPU, a ROM, a RAM, an input-output interface, various drive circuits, various logic ICs and the like (not shown). The first microcomputer51(first CPU) and the second microcomputer52(second CPU) are respectively connected to the common communication line BM and the dedicated communication line BL. The first and second microcomputers51and52are connected to each other via a first signal line for sending signals from the first microcomputer51to the second microcomputer52and a second signal line for sending signals from the second microcomputer52to the first microcomputer51. The first and second microcomputers51and52exchange information with each other via the first and second signal lines. Further, the first microcomputer51is connected to the monitoring unit53via a first pulse signal line and a first reset request signal line. The second microcomputer52is connected to the monitoring unit53via a second pulse signal line and a second reset request signal line. The first microcomputer51sends a watchdog pulse signal (run pulse signal) to the monitoring unit53via the first pulse signal line and the second microcomputer52sends a watchdog pulse signal (run pulse signal) to the monitoring unit53via the second pulse signal line.

The first microcomputer51determines whether or not an abnormality has occurred in the second microcomputer52based on a part of the information (for example, computation result or the like) sent from the second microcomputer52via the second signal line. When determining that the abnormality occurs in the second microcomputer52, the first microcomputer51sends a reset request signal indicating that the second microcomputer52should be reset to the monitoring unit53via the first reset request signal line. Further, the second microcomputer52determines whether or not an abnormality has occurred in the first microcomputer51based on a part of the information (for example, computation result or the like) sent from the first microcomputer51via the first signal line. When determining that the abnormality occurs in the first microcomputer51, the second microcomputer52sends a reset request signal indicating that the first microcomputer51should be reset to the monitoring unit53via the second reset request signal line. That is, the first and second microcomputers51and52mutually monitor a state of the other end and sends the reset request signal to the monitoring unit53when the other end should be reset.

In the present embodiment, the monitoring unit53is a single microcomputer (third microcomputer) that includes a third CPU, a ROM, a RAM, an input-output interface, various logic ICs and the like (not shown). As shown inFIG. 1, a monitoring unit53includes a first abnormality determining module55, a second abnormality determining module56, a first reset request determining module57, a second reset request determining module58and a reset processing module59as functional blocks (modules) constructed by cooperation of hardware such as the third CPU, the ROM, the RAM, the logic ICs, etc. and software such as various programs installed in the ROM.

The first abnormality determining module55is a watchdog counter connected to the first microcomputer51via the first pulse signal line. The first abnormality determining module55determines whether or not the abnormality occurs in the first microcomputer51based on the watchdog pulse signal from the first microcomputer51. That is, the first abnormality determining module55monitors the watchdog pulse signal from the first microcomputer51and sets a first watchdog monitoring flag Fw1to Hi (high) level when it determines that the watchdog pulse signal from the first microcomputer51is not interrupted for a predetermined time or more and no abnormality occurs in the first microcomputer51. Further, the first abnormality determining module55sets the first watchdog monitoring flag Fw1to Lo (low) level when it determines that the watchdog pulse signal from the first microcomputer51is interrupted for the predetermined time or more and the abnormality occurs in the first microcomputer51.

The second abnormality determining module56is a watchdog counter connected to the second microcomputer52via the second pulse signal line. The second abnormality determining module56determines whether or not the abnormality occurs in the second microcomputer52based on the watchdog pulse signal from the second microcomputer52. That is, the second abnormality determining module56monitors the watchdog pulse signal from the second microcomputer52and sets a second watchdog monitoring flag Fw2to Hi level when it determines that the watchdog pulse signal from the second microcomputer52is not interrupted for the predetermined time or more and no abnormality occurs in the second microcomputer52. Further, the second abnormality determining module56sets the second watchdog monitoring flag Fw2to Lo level when it determines that the watchdog pulse signal from the second microcomputer52is interrupted for the predetermined time or more and the abnormality occurs in the second microcomputer52. The first and second abnormality determining modules55and56are not limited to the above-described timeout type watchdog counter. The first and second abnormality determining modules55and56may be either a window type watchdog counter or a period monitoring type watchdog counter.

The first reset request determining module57is connected to the second microcomputer52via the above second reset request signal line and determines whether or not the reset request signal indicating that the first microcomputer51should be reset is sent to the monitoring unit53from the second microcomputer52. The first reset request determining module57sets a first reset request flag Frq1to Lo level when it determines that a format of the signal sent from the second microcomputer52via the second reset request signal line does not match a predetermined reset request format and the reset request signal is not sent from the second microcomputer52. When the format of the signal sent from the second microcomputer52matches the reset request format, the first reset request determining module57determines that the reset request signal is sent from the second microcomputer52. Then, the first reset request determining module57sets the first reset request flag Frq1to Hi level while the format of the signal from the second microcomputer52matches the reset request format.

The second reset request determining module58is connected to the first microcomputer51via the above first reset request signal line and determines whether or not the reset request signal indicating that the second microcomputer52should be reset is sent to the monitoring unit53from the first microcomputer51. The second reset request determining module58sets a second reset request flag Frq2to Lo level when it determines that a format of the signal sent from the first microcomputer51via the first reset request signal line does not match a predetermined reset request format and the reset request signal is not sent from the first microcomputer51. When the format of the signal sent from the first microcomputer51matches the reset request format, the second reset request determining module58determines that the reset request signal is sent from the first microcomputer51. Then, the second reset request determining module58sets the second reset request flag Frq2to Hi level while the format of the signal from the first microcomputer51matches the reset request format. The format of the reset request signal may be voluntarily defined.

The reset processing module59is capable of sending either a reset signal or a reset prohibition signal to each of the first and second microcomputers51and52in accordance with the states of the first and second microcomputers51and52. As shown inFIG. 1, the reset processing module59includes a first reset processing module59aprogrammed to set a first reset prohibition flag Frp1corresponding to the first microcomputer51, and a second reset processing module59bprogrammed to set a second reset prohibition flag Frp2corresponding to the second microcomputer52. In the present embodiment, the reset processing module59, that is, the first and second reset processing modules59aand59bare constructed by the third CPU of the monitoring unit53that executes programs stored in the ROM.

The first reset processing module59aacquires the first watchdog monitoring flag Fw1set by the first abnormality determining module55, the first reset request flag Frq1set by the first reset request determination module57, and the second reset prohibition flag Frp2set by the second reset processing module59band sets the first reset prohibition flag Frp1to Hi or Lo level in accordance with levels of these flags. When the first reset prohibition flag Frp1is set to Hi level, the reset prohibition signal of Hi level is sent to the first microcomputer51from the first reset processing module59a(monitoring unit53) so as to prohibit a reset of the first microcomputer51. The first microcomputer51continues to operate without resetting itself when it receives the reset prohibition signal. On the other hand, when the first reset prohibition flag Frp1is set to Lo level, the reset signal of Lo level is sent to the first microcomputer51from the first reset processing module59a(monitoring unit53). The first microcomputer51resets itself and stops its operation when it receives the reset signal.

The second reset processing module59bacquires the second watchdog monitoring flag Fw2set by the second abnormality determining module56, the second reset request flag Frq2set by the second reset request determination module58, and the first reset prohibition flag Frp1set by the first reset processing module59aand sets the second reset prohibition flag Frp2to Hi or Lo level in accordance with levels of these flags. When the second reset prohibition flag Frp2is set to Hi level, the reset prohibition signal of Hi level is sent to the second microcomputer52from the second reset processing module59b(monitoring unit53) so as to prohibit a reset of the second microcomputer52. The second microcomputer52continues to operate without resetting itself when it receives the reset prohibition signal. On the other hand, when the second reset prohibition flag Frp2is set to Lo level, the reset signal of Lo level is sent to the second microcomputer52from the second reset processing module59b(monitoring unit53). The second microcomputer52resets itself and stops its operation when it receives the reset signal.

The following describes reset procedures of the first and second microcomputers51and52by the monitoring unit53of the MGECU50with reference toFIGS. 2 and 3.FIG. 2is a flowchart exemplifying a first reset permissibility routine executed by the first reset processing module59aof the monitoring unit53.FIG. 3is a flowchart exemplifying a second reset permissibility routine executed by the second reset processing module59bof the monitoring unit53. The first and second reset permissibility routines are repeatedly executed at predetermined time intervals by the first or second reset processing module59aor59bwhile a system of the vehicle1is activated.

At a start of the first reset permissibility routine ofFIG. 2, the first reset processing module59aacquires the first watchdog monitoring flag Fw1, the second reset prohibition flag Frp2and the first reset request flag Frq1(Step S100). Then, the first reset processing module59adetermines whether the first watchdog monitoring flag Fw1is set to Hi level or not (Step S110). When determining that the first watchdog monitoring flag Fw1is set to Hi level and no abnormality occurs in the first microcomputer51(Step S110: YES), the first reset processing module59adetermines whether or not the second reset prohibition flag Frp2is set to the Hi level by the second reset processing module59b(Step S120). When determining that the second reset prohibition flag Frp2is set to Hi level and the second microcomputer52is not reset (Step S120: YES), the first reset processing module59adetermines whether the first reset request flag Frq1is set to Hi level or not (Step S130).

When determining that the first reset request flag Frq1is set to Hi level (Step S130: YES), the first reset processing module59asets the first reset prohibition flag Frp1to the Lo level and sends the reset signal of Lo level to the first microcomputer51(Step S140). Then, the first reset processing module59atemporarily terminates the first reset permissibility routine. As described above, the first microcomputer51resets itself and stops its operation when it receives the reset signal from the first reset processing module59a(monitoring unit53). That is, the first microcomputer51is reset in response to a request from the second microcomputer52when the watchdog pulse signal from the first microcomputer51is normal, but the reset of the first microcomputer51is requested by the second microcomputer52that is not reset and normally works (is considered to normally work).

When determining the first watchdog monitoring flag Fw1is set to Lo level and the abnormality occurs in the first microcomputer51(Step S110: NO), the first reset processing module59asets the first reset prohibition flag Frp1to Lo level irrespective of the levels of the second reset prohibition flag Frp2and the first reset request flag Frq1and sends the reset signal of the Lo level to the first microcomputer51(Step S140). Then, the first reset processing module59atemporarily terminates the first reset permissibility routine. That is, when determined that the abnormality occurs in the first microcomputer51based on the watchdog pulse signal from the first microcomputer51, the first microcomputer51is reset irrespective of the state of the second microcomputer52.

On the other hand, when determining that the second reset prohibition flag Frp2is set to Lo level and the reset signal is sent to the second microcomputer52from the second reset processing module59b(Step S120: NO), the first reset processing module59asets the first reset prohibition flag Frp1to Hi level so as to prohibit the reset of the first microcomputer51and sends the reset prohibition signal of Hi level to the first microcomputer51(Step S150). Then, the first reset processing module59atemporarily terminates the first reset permissibility routine. That is, when the watchdog pulse signal from the first microcomputer51is normal, but the second microcomputer52requests the reset of the first microcomputer51while the reset signal is sent from the second reset processing module59b, the reset of the first microcomputer51is prohibited irrespective of the request from the second microcomputer52and the first microcomputer51continues to operate. Thus, the reset of the normal first microcomputer51is suppressed even if the reset request signal indicating that the first microcomputer51should be reset is erroneously sent to the monitoring unit53from the second microcomputer52after an occurrence of the abnormality and before a completion of the reset of the second microcomputer52.

Further, when determining that the first reset request flag Frq1is set to Lo level (Step S130: NO), the first reset processing module59asets the first reset prohibition flag Frp1to Hi level so as to prohibit the reset of the first microcomputer51and sends the reset prohibition signal of Hi level to the first microcomputer51(Step S150). Then, the first reset processing module59atemporarily terminates the first reset permissibility routine. That is, when the watchdog pulse signal from the first microcomputer51is normal and the second microcomputer52does not request the reset of the first microcomputer51, the reset of the first microcomputer51is prohibited and the first microcomputer51continues to operate.

The following describes the second reset permissibility routine shown inFIG. 3. At a start of the second reset permissibility routine, the second reset processing module59bacquires the second watchdog monitoring flag Fw2, the first reset prohibition flag Frp1and the second reset request flag Frq2(Step S200). Then, the second reset processing module59bdetermines whether the second watchdog monitoring flag Fw2is set to Hi level or not (Step S210). When determining that the second watchdog monitoring flag Fw2is set to Hi level and no abnormality occurs in the second microcomputer52(Step S210: YES), the second reset processing module59bdetermines whether or not the first reset prohibition flag Frp1is set to the Hi level by the first reset processing module59a(Step S220). When determining that the first reset prohibition flag Frp1is set to Hi level and the first microcomputer51is not reset (Step S220: YES), the second reset processing module59bdetermines whether the second reset request flag Frq2is set to Hi level or not (Step S230).

When determining that the second reset request flag Frq2is set to Hi level (Step S230: YES), the second reset processing module59bsets the second reset prohibition flag Frp2to the Lo level and sends the reset signal of Lo level to the second microcomputer52(Step S240). Then, the second reset processing module59btemporarily terminates the second reset permissibility routine. As described above, the second microcomputer52resets itself and stops its operation when it receives the reset signal from the second reset processing module59b(monitoring unit53). That is, the second microcomputer52is reset in response to a request from the first microcomputer51when the watchdog pulse signal from the second microcomputer52is normal, but the reset of the second microcomputer52is requested by the first microcomputer51that is not reset and normally works (is considered to normally work).

When determining the second watchdog monitoring flag Fw2is set to Lo level and the abnormality occurs in the second microcomputer52(Step S210: NO), the second reset processing module59bsets the second reset prohibition flag Frp2to Lo level irrespective of the levels of the first reset prohibition flag Frp1and the second reset request flag Frq2and sends the reset signal of the Lo level to the second microcomputer52(Step S240). Then, the second reset processing module59btemporarily terminates the second reset permissibility routine. That is, when determined that the abnormality occurs in the second microcomputer52based on the watchdog pulse signal from the second microcomputer52, the second microcomputer52is reset irrespective of the state of the first microcomputer51.

On the other hand, when determining that the first reset prohibition flag Frp1is set to Lo level and the reset signal is sent to the first microcomputer51from the first reset processing module59a(Step S220: NO), the second reset processing module59bsets the second reset prohibition flag Frp2to Hi level so as to prohibit the reset of the second microcomputer52and sends the reset prohibition signal of Hi level to the second microcomputer52(Step S250). Then, the second reset processing module59btemporarily terminates the second reset permissibility routine. That is, when the watchdog pulse signal from the second microcomputer52is normal, but the first microcomputer51requests the reset of the second microcomputer52while the reset signal is sent from the first reset processing module59a, the reset of the second microcomputer52is prohibited irrespective of the request from the first microcomputer51and the second microcomputer52continues to operate. Thus, the reset of the normal second microcomputer52is suppressed even if the reset request signal indicating that the second microcomputer52should be reset is erroneously sent to the monitoring unit53from the first microcomputer51after an occurrence of the abnormality and before a completion of the reset of the first microcomputer51.

Further, when determining that the second reset request flag Frq2is set to Lo level (Step S230: NO), the second reset processing module59bsets the second reset prohibition flag Frp2to Hi level so as to prohibit the reset of the second microcomputer52and sends the reset prohibition signal of Hi level to the second microcomputer52(Step S250). Then, the second reset processing module59btemporarily terminates the first reset permissibility routine. That is, when the watchdog pulse signal from the second microcomputer52is normal and the first microcomputer51does not request the reset of the second microcomputer52, the reset of the second microcomputer52is prohibited and the second microcomputer52continues to operate.

As described above, the monitoring unit53of the MGECU50sends the reset signal to one of the first and second microcomputers51and52on condition that it does not send the reset signal to the other of the first and second microcomputers51and52when the monitoring unit53receives the reset request signal indicating that one of the first and second microcomputers51and52should be reset from the other of the first and second microcomputers51and52(Steps S120-S140inFIG. 2, Steps S220-S240inFIG. 3). That is, even if the reset request signal indicating that one of the first and second microcomputers51and52should be reset is sent from the other of the first and second microcomputers51and52to the monitoring unit53, the reset of the one of the first and second microcomputers51and52is prohibited when the monitoring unit53sends the reset signal to the other of the first and second microcomputers51and52(Step S150inFIG. 2, Step S250inFIG. 3). Thus, the reset of the normal one of the first and second microcomputers51and52is suppressed when the one of the first and second microcomputers51and52normally operates and the abnormality occurs in the other.

Further, the monitoring unit53includes the first abnormality determining module55that determines whether or not the abnormality occurs in the first microcomputer51based on the watchdog pulse signal form the first microcomputer51, the second abnormality determining module56that determines whether or not the abnormality occurs in the second microcomputer52based on the watchdog pulse signal form the second microcomputer52, and the reset processing module59. The reset processing module59includes the first reset processing module59acorresponding to the first microcomputer51and the second reset processing module59bcorresponding to the second microcomputer52. The first reset processing module59asends the reset signal to the first microcomputer51when the first abnormality determining module55determines that the abnormality occurs in the first microcomputer51and when the reset request signal indicating that the first microcomputer51should be reset is sent to the monitoring unit53from the second microcomputer52and the reset signal is not sent to the second microcomputer52. The second reset processing module59bsends the reset signal to the second microcomputer52when the second abnormality determining module56determines that the abnormality occurs in the second microcomputer52and when the reset request signal indicating that the second microcomputer52should be reset is sent to the monitoring unit53from the first microcomputer51and the reset signal is not sent to the first microcomputer51. This configuration enables the first and second microcomputers51and52to be independently monitored by the first and second abnormality determining modules55and56, such that the reset of both the first and second microcomputers51and52is favorably suppressed when the abnormality occurs in any one of the first and second microcomputers51and52.

In the above embodiment, the monitoring unit53is a single microcomputer and at least a part of functions of the monitoring unit53or the reset processing module59are executed using software. Thus, a development lead time or development costs of the MGECU50including the monitoring unit53is reduced. The MGECU50may be provided with a multi-core processor instead of the three microcomputers. That is, the MGECU50may include the multi-core processor performs functions of the processor of the first microcomputer51, the processor of the second microcomputer52and the processor of the monitoring unit53.

FIG. 4is a block diagram illustrating a MGECU50B or another control apparatus according to the present disclosure. Among components of the MGECU50B, the same components to those of the MGECU50described above are expressed by the same reference signs and their repeated descriptions are omitted.

In the MGECU50B shown inFIG. 4, instead of the watchdog pulse signal, a predetermined signal is periodically sent to a monitoring unit53B from the first microcomputer51via a first communication line L1. Further, instead of the watchdog pulse signal, a predetermined signal is periodically sent to the monitoring unit53B from the second microcomputer52via a second communication line L2. The monitoring unit53B includes a first abnormality determining module55B that determines whether or not the abnormality occurs in the first microcomputer51based on the signal periodically sent to the monitoring unit53B from the first microcomputer51via the first communication line L1, and a second abnormality determining module56B that determines whether or not the abnormality occurs in the second microcomputer52based on a signal periodically sent to the monitoring unit53B from the second microcomputer52via the second communication line L2.

The first and second abnormality determining modules55B and56B respectively monitor a communication cycle of the signal periodically sent from the first or second microcomputer51or52. Each of the first and second abnormality determining modules55B and56B sets the first or second watchdog monitoring flag Fw1or Fw2to the Hi (high) level when it determines that the communication cycle matches a predetermined reference cycle and no abnormality occurs in the first or second microcomputer51or52. Further, each of the first and second abnormality determining modules55B and56B sets the first or second watchdog monitoring flag Fw1or Fw2to the Lo (low) level when it determines that the communication cycle does not match the reference cycle and the abnormality occurs in the first or second microcomputer51or52.

In the MGECU50B, the first microcomputer51sends the reset request signal indicating that the second microcomputer52should be reset to the monitoring unit53B via the first communication line L1. The second microcomputer52sends the reset request signal indicating that the first microcomputer51should be reset to the monitoring unit53B via the second communication line L2. Further, first and second reset request determining modules57B and58B of the monitoring unit53B receive the reset request signal sent to the monitoring unit53B via the first or second communication line L1, L2and communication lines in the monitoring unit53B and execute same processing as the above first and second reset request determination modules57and58. The MGECU50B enables a communication line for sending the reset request signal from the first microcomputer51to the monitoring unit53B and a communication line for sending the reset request signal from the second microcomputer52to the monitoring unit53B to be omitted. Accordingly, reliability of the MGECU50B is favorably improved by reducing a risk of an occurrence of a communication line abnormality.

FIG. 5is a block diagram illustrating another monitoring unit53C adaptable to the control apparatus according to the present disclosure.

In the monitoring units53cshown inFIG. 5, each of first and second abnormality determining modules55C and56C outputs a signal of Hi level when it determines that the watchdog pulse signal from the first or second microcomputer51or52is not interrupted for a predetermined time or more and no abnormality occurs in the first or second microcomputer51or52. Further, each of the first and second abnormality determining module55C and56C outputs a signal of Lo level when it determines that the watchdog pulse signal from the first or second microcomputer51or52is interrupted for the predetermined time or more and the abnormality occurs in the first or second microcomputer51or52. In the monitoring unit53C, each of first and second reset request determining module57C and58C outputs a signal of Lo level when it determines that the format of the signal sent from the first or second microcomputer51or52does not match a predetermined reset request format and the reset request signal is not sent from the first or second microcomputer51or52. When the format of the signal sent from the first or second microcomputer51or52matches the reset request format, the first and second reset request determining modules57C and58C determine that the reset request signal is sent from the first or second microcomputer51or52. Then, the first and second reset request determining module57C and58C output a signal of Hi level while the format of the signal from the first or second microcomputer51or52matches the reset request format.

In the monitoring unit53C, the first reset processing module59aof a reset processing module59C is configured of a logic circuit including a NAND gate G1and an AND gate G2. The second reset processing module59bof the reset processing module59C is configured of a logic circuit including a NAND gate G3and an AND gate G4. The NAND gate G1of the first reset processing module59areceives the signal from the first reset request determining module57C and an output signal of the second reset processing module59b(AND gate G4), that is, the reset prohibition signal of Hi level or the reset signal of Lo level. The NAND gate G1outputs a signal of Lo level only when Levels of both the signal from first reset request determining module57C and the output signal of second reset processing module59b(AND gate G4) are Hi level. Otherwise, the NAND gate G1outputs a signal of Hi level. The AND gate G2of the first reset processing module59areceives the signal from the first abnormality determining module55C and the output signal of the NAND gate G1. The AND gate G2outputs the reset prohibition signal of Hi level only when levels of both the signal from the first abnormality determining module55C and the output signal of the NAND gate G1are Hi level. Otherwise, the AND gate G2outputs the reset signal of Lo level.

The NAND gate G3of the second reset processing module59breceives the signal from the second reset request determining module58C and an output signal of the first reset processing module59a(AND gate G2), that is, the reset prohibition signal of Hi level or the reset signal of Lo level. The NAND gate G3outputs a signal of Lo level only when Levels of both the signal from second reset request determining module58C and the output signal of first reset processing module59a(AND gate G2) are Hi level. Otherwise, the NAND gate G3outputs a signal of Hi level. The AND gate G4of the second reset processing module59breceives the signal from the second abnormality determining module56C and the output signal of the NAND gate G3. The AND gate G4outputs the reset prohibition signal of Hi level only when levels of both the signal from the second abnormality determining module56C and the output signal of the NAND gate G3are Hi level. Otherwise, the AND gate G4outputs the reset signal of Lo level.

FIG. 6shows a truth table of the logic circuit that configures the first reset processing module59aof the monitoring unit53C.FIG. 7shows a truth table of the logic circuit that configures the second reset processing module59bof the monitoring unit53C. As seen from these figures, same advantages as those of the above MGECU50can be obtained in the MGECU50C including the monitoring unit53C. The monitoring unit53C may be configured by an ASIC so as to include the first and second reset processing module59aand59brespectively configured of the logic circuit. This configuration enables a cost (price) of the MGECU50C including the monitoring unit53C to be reduced. The logic circuits for the first and second reset processing module59aand59bare not limited to the above-described circuits. The monitoring unit53C may be adapted to the the MGECU50B.

The above first microcomputer51, the second microcomputer52, and the monitoring unit (third microcomputer)53or53B of the MGECU50or50B are included in the same ECU, but not limited thereto. That is, the first microcomputer51, the second microcomputer52and the monitoring unit (third microcomputer)53or53B may be distributed to three different ECUs. Thus, the invention of the present disclosure may be applied to an ECU that controls a first equipment, an ECU that controls the first equipment or a second equipment different from the first equipment, and an ECU that includes a monitoring unit. Each of the MGECUs50,50B and50C includes the first microcomputer51that controls the motor generator MG1and the second microcomputer52that controls the motor generator MG2that is different from the motor generator MG1, but not limited thereto. That is, the first and second microcomputers51and52may control an identical equipment. Further, the vehicle including the control apparatus of the present disclosure may be a one-motor hybrid vehicle, a series hybrid vehicle, a plug-in hybrid vehicle, an electric vehicle, or a vehicle including only an engine (internal combustion engine) as a driving power source.

As has been described above, a control apparatus of the present disclosure includes a first control module configured to control a first equipment, a second control module configured to control the first equipment or a second equipment different from the first equipment, and a monitoring module configured to monitor the first and second control modules and to send a reset signal to each of the first and second control modules. The first and second control modules mutually monitor a state of the other end and send a reset request signal to the monitoring module when the other end should be reset. The monitoring module sends the reset signal to one of the first and second control modules when the monitoring module receives the reset request signal indicating that the one of the first and second control modules should be reset from the other of the first and second control modules and the monitoring module does not send the reset signal to the other of the first and second control modules. The monitoring module prohibits a reset of one of the first and second control modules when the monitoring module receives the reset request signal indicating that the one of the first and second control modules should be reset from the other of the first and second control modules and the monitoring module sends the reset signal to the other of the first and second control modules.

The monitoring module of the control apparatus of the present disclosure sends the reset signal to one of the first and second control modules on condition that the monitoring module does not send the reset signal to the other of the first and second control modules when the monitoring module receives the reset request signal indicating that the one of the first and second control modules should be reset from the other of the first and second control modules. That is, even if the reset request signal indicating that the one of the first and second control modules should be reset is transmitted from the other of the first and second control modules to the monitoring module, the reset of the one of the first and second control modules is prohibited when the monitoring module sends the reset signal to the other of the first and second control modules. Thus, the control apparatus suppresses the normal one of the first and second control modules to be reset when the one of the first and second control modules normally operates and an abnormality occurs in the other.

The monitoring module may include a first abnormality determining module configured to determine whether or not an abnormality occurs in the first control module based on a signal from the first control module, a second abnormality determining module configured to determine whether or not an abnormality occurs in the second control module based on a signal from the second control module, a first reset processing module configured to send the reset signal to the first control module when the first abnormality determining module determines that the abnormality occurs in the first control module and when the reset request signal indicating that the first control module should be reset is sent to the monitoring module from the second control module and the reset signal is not sent to the second control module, and a second reset processing module configured to send the reset signal to the second control module when the second abnormality determining module determines that the abnormality occurs in the second control module and when the reset request signal indicating that the second control module should be reset is sent to the monitoring module from the first control module and the reset signal is not sent to the first control module. This enables the first and second control modules to be independently monitored by the first and second abnormality determining modules, such that the reset of both the first and second control modules is favorably suppressed when the abnormality occurs in any one of the first and second control modules.

The monitoring module may include a first reset request determining module configured to determine whether or not the reset request signal indicating that the second control module should be reset is sent to the monitoring module from the first control module, and a second reset request determining module configured to determine whether or not the reset request signal indicating that the first control module should be reset is sent to the monitoring module from the second control module.

Each of the signal sent to the first abnormality determining module from the first control module and the signal sent to the second abnormality determining module from the second control module may be a watchdog pulse signal.

The first abnormality determining module may determine whether or not the abnormality occurs in the first control module based on a signal periodically sent to the monitoring module from the first control module via a first communication line. The second abnormality determining module may determine whether or not the abnormality occurs in the second control module based on a signal periodically sent to the monitoring module from the second control module via a second communication line. The first control module may send the reset request signal indicating that the second control module should be reset to the monitoring module via the first communication line. The second control module may send the reset request signal indicating that the first control module should be reset to the monitoring module via the second communication line. This configuration enables a communication line for sending the reset request signal from the first control module to the monitoring module and a communication line for sending the reset request signal from the second control module to the monitoring module to be omitted and favorably improves reliability of the control apparatus by reducing a risk of an occurrence of a communication line abnormality.

The monitoring module may be configured by an ASIC. This enables a cost of the control apparatus including the monitoring module to be reduced.

The monitoring module may be a single microcomputer. That is, at least a part of functions of the monitoring module may be executed using software, such that a development lead time or development costs of the control apparatus including the monitoring module is reduced.

A multi-core processor may perform functions of a processor of the first control module, a processor of the second control module and a processor of the monitoring module.

A reset method of the present disclosure is a reset method of a control apparatus that includes a first control module configured to control a first equipment and a second control module configured to control the first equipment or a second equipment different from the first equipment, the first and second control modules mutually monitoring a state of the other end and output a reset request signal when the other end should be reset. The method includes sending the reset signal to one of the first and second control modules when the other of the first and second control modules outputs the reset request signal indicating that the one of the first and second control modules should be reset and the reset signal is not sent to the other of the first and second control modules, and prohibiting a reset of one of the first and second control modules when the other of the first and second control modules outputs the reset request signal indicating that the one of the first and second control modules should be reset and the reset signal is sent to the other of the first and second control modules.

The method suppresses the normal one of the first and second control modules to be reset when the one of the first and second control modules normally operates and an abnormality occurs in the other.

The disclosure is not limited to the above embodiments in any sense but may be changed, altered or modified in various ways within the scope of extension of the disclosure. Additionally, the embodiments described above are only concrete examples of some aspect of the disclosure described in Summary and are not intended to limit the elements of the disclosure described in Summary.

INDUSTRIAL APPLICABILITY

The technique of the present disclosure is applicable to, for example, the manufacturing industry of the control apparatus.