Vehicle control system

Provided is a vehicle control system that appropriately performs synchronization control for a plurality of control systems. A monitoring circuit generates a command signal when only a first reset signal is input. The monitoring circuit generates a command signal when the state in which only the first reset signal is input is changed to the state in which the input of the first reset signal is stopped. With the command signal, a second clock signal is output to a timer generator as a second timing signal. With the command signal, the second clock signal generated by a second synchronization signal generating circuit is output to a first synchronization signal generating circuit, and a third clock signal generated by the first synchronization signal generating circuit is output to a timer generator as a first timing signal.

INCORPORATION BY REFERENCE

The disclosure of Japanese Patent Application No. 2017-077434 filed on Apr. 10, 2017 including the specification, drawings and abstract, is incorporated herein by reference in its entirety.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates to a vehicle control system.

2. Description of the Related Art

For example, a vehicle control system described in International Publication No. 2010/061918 (WO 2010/061918) is known as a vehicle control system configured to control an operation of a control target by a plurality of control systems. WO 2010/061918 discloses a motor control system including two control systems (computation controllers and drive circuits) configured to supply driving electric power to a motor that is the control target. In the motor control system, in order that the two control systems can supply the driving electric power to the motor in synchronization with each other, the computation controller of the first control system includes a synchronization signal transmitting circuit configured to transmit a synchronization signal serving as a reference to synchronization between the two control systems, and the computation controller of the second control system includes a synchronization signal receiving circuit configured to receive the synchronization signal transmitted from the synchronization signal transmitting circuit. The synchronization signal transmitting circuit of the first control system transmits the synchronization signal to the synchronization signal receiving circuit of the second control system every time a pulse generated by a clock (hereinafter referred to as “clock pulse”) is detected a predetermined number of times. When the synchronization signal receiving circuit of the second control system receives the synchronization signal, a control operation of the second control system is synchronized with a processing timing of a control operation of the first control system.

In the motor control system described above, for example, each control system is supplied with electric power by being connected to a power supply configured to convert electric power from an on-board battery into a voltage value suitable for the control system. There is a case where the synchronization signal is not transmitted to the second control system because the voltage value of the power supply connected to the first control system is lower than a voltage value necessary for the first control system to operate and therefore only the operation of the first control system is stopped. In order that the motor control system may continuously control the motor to meet a demand for improvement in the safety of the motor control system, only the second control system may control the motor by determining a processing timing of the control operation of the second control system based on a clock pulse of the second control system. While the second control system is controlling the motor at the processing timing of the control operation that is determined based on the clock pulse of the second control system, the voltage value of the power supply connected to the first control system may recover its normal value and the control operation of the first control system may operate again. Since the first control system operates, the synchronization signal transmitting circuit transmits the synchronization signal toward the second control system.

Due to the state in which the second control system determines the processing timing based on the clock pulse of the second control system, the processing timing of the control operation of the second control system may deviate when the synchronization signal is input from the first control system. Furthermore, pulsation of a torque of the motor may occur to cause a driver's feeling of discomfort.

SUMMARY OF THE INVENTION

It is one object of the present invention to provide a vehicle control system that appropriately performs synchronization control for a plurality of control systems when an operation status of a control system configured to output a synchronization signal serving as a reference to synchronization between the control systems is changed from a stopped state to an operating state.

A vehicle control system according to one aspect of the present invention includes:

a plurality of control circuits configured to control an operation of a control target in cooperation with each other; and

at least one monitoring circuit configured to detect operation statuses of the control circuits.

Each of the control circuits is configured to generate a synchronization signal for synchronizing operations of the control circuits. Control operations of the control circuits are synchronized based on the synchronization signal generated by a first control circuit out of the control circuits.

When the monitoring circuit detects that the operation status of the first control circuit is changed from a stopped state to an operating state while a remaining control circuit except the first control circuit continues to perform the control operation, the monitoring circuit is configured to synchronize the control operation of the first control circuit with the control operation of the remaining control circuit that is operating continuously based on the synchronization signal generated by the remaining control circuit that is operating continuously.

When the operation status of the first control circuit is brought into the stopped state, the remaining control circuit except the first control circuit out of the control circuits may continuously control the operation of the control target. However, the timing of the control operation of the remaining control circuit may deviate when the operation status of the first control circuit is changed from the stopped state to the operating state while the remaining control circuit is operating.

In this respect, with the configuration described above, when the operation status of the first control circuit is changed from the stopped state to the operating state while the remaining control circuit is operating continuously, the control operation of the first control circuit is synchronized with the control operation of the remaining control circuit based on the synchronization signal of the remaining control circuit. Thus, it is possible to appropriately perform the synchronization control for the control circuits when the operation status of the first control circuit is changed from the stopped state to the operating state while the remaining control circuit is operating.

DETAILED DESCRIPTION OF EMBODIMENTS

A vehicle control system according to a first embodiment of the present invention is described below. As illustrated inFIG. 1, the vehicle control system of this embodiment is a motor control system (hereinafter referred to as “ECU”) configured to control an operation of a motor11that is a control target. An ECU10controls driving of the motor11to apply a motor torque to, for example, a steering mechanism of a vehicle, thereby executing power steering control for assisting a driver's steering operation.

A three-phase brushless motor is employed as the motor11. The motor11includes motor coil groups for two systems each having three phases (U phase, V phase, and W phase). That is, the motor11includes a motor coil group A and a motor coil group B for two systems, which are electrically independent of each other. The motor coil group A and the motor coil group B have similar configurations. The motor11further includes a rotation angle sensor12configured to detect a rotation angle θ as a condition amount indicating an operation condition (rotation condition) of the motor11.

The ECU10includes a first ECU20serving as a first control circuit, a second ECU30serving as a remaining control circuit, a first reset signal generating circuit40, and a second reset signal generating circuit50. The first ECU20controls electric power supply to the motor coil group A. The first ECU20is connected to a first power supply26configured to convert electric power from an on-board battery provided on the outside into a voltage value suitable for the first ECU20. The first ECU20operates by being supplied with the electric power from the first power supply26. A voltage sensor27is provided between the first ECU20and the first power supply26. The voltage sensor27detects a voltage value V1of the first power supply26. The second ECU30controls electric power supply to the motor coil group B. The second ECU30is connected to a second power supply36configured to convert electric power from the on-board battery provided on the outside into a voltage value suitable for the second ECU30. The second ECU30operates by being supplied with the electric power from the second power supply36. A voltage sensor37is provided between the second ECU30and the second power supply36. The voltage sensor37detects a voltage value V2of the second power supply36. The first reset signal generating circuit40monitors the voltage value V1detected by the voltage sensor27. The first reset signal generating circuit40generates a first reset signal Rs1for keeping a control operation of the first ECU20in a stopped state until the voltage value V1is stabilized. The second reset signal generating circuit50monitors the voltage value V2detected by the voltage sensor37. The second reset signal generating circuit50generates a second reset signal Rs2for keeping a control operation of the second ECU30in a stopped state until the voltage value V2is stabilized. The phrase “the voltage values V1and V2are stabilized” means that the voltage values V1and V2of the first power supply26and the second power supply36are constantly kept within a predetermined range in which the first ECU20and the second ECU30can be operated normally. The first reset signal generating circuit40and the second reset signal generating circuit50have the same configuration.

In the ECU10, the first ECU20and the second ECU30communicate with each other to synchronize their control operations. The ECU10includes the first ECU20and the second ECU30to achieve redundancy for the control system relating to the driving of the motor11. For example, when the first ECU20has such an abnormality that the first ECU20cannot continue to control the electric power supply to the motor11, the control performed by the first ECU20on the electric power supply to the motor11is stopped, and the electric power supply to the motor11is controlled only by the second ECU30. When the second ECU30has such an abnormality that the second ECU30cannot continue to control the electric power supply to the motor11, the control performed by the second ECU30on the electric power supply to the motor11is stopped, and the electric power supply to the motor11is controlled only by the first ECU20.

Next, the configurations of the first ECU20and the second ECU30are described. The first ECU20and the second ECU30have similar configurations. The first ECU20includes an oscillator21, a first microcomputer22, and a first drive circuit25.

The oscillator21is formed of a crystal element or the like. The oscillator21generates a clock (triangular wave) of a fundamental frequency for determining a timing of a control operation of the first microcomputer22.

The first drive circuit25includes an inverter25aand a current sensor25b. The inverter25aincludes a plurality of switching elements such as FETs corresponding to the three phases (U phase, V phase, and W phase). The inverter25ais provided such that three sets of switching arms each having two FETs connected in series are formed by being connected in parallel between a positive terminal and a negative terminal of the on-board battery. The current sensor25bdetects a current value I1of each phase in an electric power supply path between the inverter25aand the motor coil group A of the motor11.

The first microcomputer22generates a control signal Sm1for operating the motor11based on the clock generated by the oscillator21, the current value I1detected by the current sensor25b, and the rotation angle θ detected by the rotation angle sensor12of the motor11. The first microcomputer22is connected to the first power supply26.

Next, the configuration of the first microcomputer22is described in detail. The first microcomputer22includes a first synchronization signal generating circuit23and a first computation circuit24. The first synchronization signal generating circuit23generates a first clock signal CK1(triangular wave) serving as a synchronization signal, and a first timing signal T1(triangular wave). The first clock signal CK1is generated based on the clock generated by the oscillator21. The first timing signal T1is used for adjusting a timing of a control operation of the first computation circuit24. When the first ECU20operates normally, the first synchronization signal generating circuit23outputs the first clock signal CK1to the second ECU30.

The first synchronization signal generating circuit23includes a clock generator23a, a clock output device23b, a clock corrector23c, and a switching device23d. The clock generator23ais a multiplier, and generates the first clock signal CK1by multiplying the clock generated by the oscillator21by a predetermined multiple. The clock output device23boutputs the first clock signal CK1generated by the clock generator23ato the second ECU30.

The clock corrector23cgenerates a third clock signal CK3in consideration of the first clock signal CK1generated by the clock generator23aand a second clock signal CK2described later, which serves as a synchronization signal and is output from the second ECU30.

The switching device23dis provided from the viewpoint of outputting the first clock signal CK1generated by the clock generator23aor the third clock signal CK3generated by the clock corrector23cto a timer generator24aas the first timing signal T1. When the first microcomputer22operates normally, the switching device23doutputs the first clock signal CK1to the timer generator24aas the first timing signal T1. When a command signal S2generated by a monitoring circuit38described later is input to the switching device23d, the switching device23dswitches a switch to output the third clock signal CK3generated by the clock corrector23cto the timer generator24aas the first timing signal T1.

The first computation circuit24generates the control signal Sm1based on the rotation angle θ detected by the rotation angle sensor12and the current value I1detected by the current sensor25b. The first computation circuit24determines a timing to generate the control signal Sm1based on the first timing signal T1.

The first computation circuit24includes the timer generator24a, an AD converter24b, and a motor current controller24c. The timer generator24aincludes a publicly-known frequency divider and a publicly-known up/down counter. The timer generator24acauses the up/down counter to count up or down the first timing signal T1whose frequency is divided by the frequency divider. When the first timing signal T1reaches a predetermined count value, the timer generator24aoutputs an operation trigger Tr1to the AD converter24band the motor current controller24c.

The AD converter24bconverts an analog signal of the current value I1detected by the current sensor25band the rotation angle θ detected by the rotation angle sensor12into a digital signal Ds1(AD conversion) based on the operation trigger Tr1. The AD converter24boutputs the digital signal Ds1to the motor current controller24c.

The motor current controller24ccomputes a command value for operating the motor coil group A of the motor11from the digital signal Ds1of the current value I1and the rotation angle θ based on the operation trigger Tr1. The motor current controller24cgenerates the control signal Sm1(PWM signal) based on the command value.

The operation trigger Tr1defines a computation timing in the motor current controller24c, and an AD conversion timing in the AD converter24b. Both timings are synchronized.

The second ECU30includes an oscillator31, a second microcomputer32, and a second drive circuit35. The oscillator31is formed of a crystal element or the like. The oscillator31generates a clock (triangular wave) of a fundamental frequency for determining a timing of a control operation of the second microcomputer32.

The second drive circuit35includes an inverter35aand a current sensor35b. The inverter35aincludes a plurality of switching elements such as FETs corresponding to the three phases (U phase, V phase, and W phase). The inverter35ais provided such that three sets of switching arms each having two FETs connected in series are formed by being connected in parallel between the positive terminal and the negative terminal of the on-board battery. The current sensor35bdetects a current value12of each phase in an electric power supply path between the inverter35aand the motor coil group B.

The second microcomputer32generates a control signal Sm2for driving the motor11based on the clock generated by the oscillator31, the current value12detected by the current sensor35b, and the rotation angle θ detected by the rotation angle sensor12of the motor11. The second microcomputer32is connected to the second power supply36.

Next, the configuration of the second microcomputer32is described in detail. The second microcomputer32includes a second synchronization signal generating circuit33, a second computation circuit34, and the monitoring circuit38.

The second synchronization signal generating circuit33generates the second clock signal CK2(triangular wave) serving as a synchronization signal, and a second timing signal T2(triangular wave). The second clock signal CK2is generated based on the clock generated by the oscillator31. The second timing signal T2is used for adjusting a timing of a control operation of the second computation circuit34. When the first microcomputer22operates normally, the second synchronization signal generating circuit33does not output the second clock signal CK2to the first synchronization signal generating circuit23. That is, when the first microcomputer22operates normally, the control operation of the second microcomputer32is synchronized with the control operation of the first ECU20based on the first clock signal CK1generated by the first synchronization signal generating circuit23of the first microcomputer22. Therefore, the second synchronization signal generating circuit33of the second microcomputer32generates the second timing signal T2in consideration of the first clock signal CK1generated by the first synchronization signal generating circuit23and the second clock signal CK2generated by the second synchronization signal generating circuit33.

The second synchronization signal generating circuit33includes a clock generator33a, a clock output device33b, a clock corrector33c, and a switching device33d. When the first microcomputer22operates normally, the clock output device33bof the second synchronization signal generating circuit33does not output the second clock signal CK2generated by the clock generator33ato the clock corrector23cof the first synchronization signal generating circuit23. When the command signal S2generated by the monitoring circuit38described later is input to the clock output device33b, the clock output device33boutputs the second clock signal CK2generated by the clock generator33ato the clock corrector23cof the first synchronization signal generating circuit23.

The clock corrector33cgenerates a fourth clock signal CK4in consideration of the second clock signal CK2generated by the clock generator33aand the first clock signal CK1output from the clock output device23bof the first synchronization signal generating circuit23.

The generation of the third clock signal CK3and the fourth clock signal CK4is described in detail. Oscillating elements (for example, crystal elements) of the oscillators21and31have a small individual difference. The individual difference causes variations in the clocks of the fundamental frequencies that are output from the oscillators21and31. Furthermore, a deviation may occur between the first clock signal CK1and the second clock signal CK2that are generated by the clock generators23aand33ato which the clocks are input from the oscillators21and31. The clock deviation caused by the oscillators21and31is not eliminated, but may affect the count values of the timer generators24aand34ato finally cause a temporal deviation between the timings of the control operations of the first ECU20and the second ECU30. Therefore, the clock corrector23cperforms correction so that the first clock signal CK1coincides with the second clock signal CK2, thereby generating the third clock signal CK3in which the temporal deviation between the first clock signal CK1and the second clock signal CK2is suppressed. The clock corrector33cperforms correction so that the second clock signal CK2coincides with the first clock signal CK1, thereby generating the fourth clock signal CK4in which the temporal deviation between the first clock signal CK1and the second clock signal CK2is suppressed.

The switching device33dis provided from the viewpoint of outputting the second clock signal CK2generated by the clock generator33aor the fourth clock signal CK4generated by the clock corrector33cto the timer generator34aas the second timing signal T2. When the first microcomputer22operates normally, the switching device33doutputs the fourth clock signal CK4to the timer generator34aas the second timing signal T2. When a command signal S1generated by the monitoring circuit38described later is input to the switching device33d, the switching device33dswitches a switch to output the second clock signal CK2generated by the clock generator33ato the timer generator34aas the second timing signal T2.

The second computation circuit34includes the timer generator34a, an AD converter34b, and a motor current controller34c. The timer generator34acauses an up/down counter to count up or down the second timing signal T2whose frequency is divided by a frequency divider. When the second timing signal T2reaches a predetermined count value, the timer generator34aoutputs an operation trigger Tr2to the AD converter34band the motor current controller34c.

The AD converter34bconverts an analog signal of the current value12detected by the current sensor35band the rotation angle θ detected by the rotation angle sensor12into a digital signal Ds2(AD conversion) based on the operation trigger Tr2. The AD converter34bthen outputs the digital signal Ds2to the motor current controller34c.

The motor current controller34ccomputes a command value for operating the motor coil group B of the motor11from the digital signal Ds2of the current value12and the rotation angle θ based on the operation trigger Tr2. The motor current controller34cgenerates the control signal Sm2(PWM signal) based on the command value.

The monitoring circuit38monitors the first reset signal Rs1generated by the first reset signal generating circuit40and the second reset signal Rs2generated by the second reset signal generating circuit50.

A technical significance of the first reset signal Rs1and the second reset signal Rs2is described. As illustrated inFIG. 2, when electric power starts to be supplied from the first power supply26and the second power supply36to the first ECU20and the second ECU30, the voltage values V1and V2are gradually increased. After an elapse of a predetermined time from the time when the electric power starts to be supplied from the first power supply26and the second power supply36to the first ECU20and the second ECU30, the voltage values V1and V2are constantly kept within a predetermined range in which the first ECU20and the second ECU30can be operated normally. It is assumed that the first ECU20and the second ECU30are operated in a state in which the voltage values V1and V2of the first ECU20and the second ECU30are values in the vicinity of a threshold L that is a minimum value at which the first ECU20and the second ECU30can be operated. In this case, for some reasons, the voltage values V1and V2of the first power supply26and the second power supply36may be lower than the threshold L that is a minimum value at which the first ECU20and the second ECU30can be operated. Along with this phenomenon, the control operations of the first ECU20and the second ECU30are stopped and, accordingly, the control operation of the ECU10may be unstable.

Therefore, the first reset signal Rs1and the second reset signal Rs2are set from the viewpoint of keeping the control operations of the first ECU20and the second ECU30in a stopped state until the voltage values V1and V2of the first power supply26and the second power supply36are constantly kept within the predetermined range in which the first ECU20and the second ECU30can be operated normally. When the first reset signal generating circuit40and the second reset signal generating circuit50determine that the voltage values V1and V2are constantly kept within the predetermined range in which the first ECU20and the second ECU30can be operated normally, the first reset signal generating circuit40and the second reset signal generating circuit50stop generating the first reset signal Rs1and the second reset signal Rs2, thereby starting the control operations of the first ECU20and the second ECU30. The threshold L is set as a lower limit value of the predetermined range in which the first ECU20and the second ECU30can be operated normally.

As illustrated inFIG. 1, the monitoring circuit38generates the command signals S1and S2in accordance with input statuses of the first reset signal Rs1and the second reset signal Rs2. The command signals S1and S2are set from the viewpoint of synchronizing the control operation of the first ECU20with the control operation of the second ECU30based on the second clock signal CK2generated by the second ECU30(second microcomputer32). Specifically, the command signal S1is a signal for selecting the second clock signal CK2generated by the second synchronization signal generating circuit33as the second timing signal T2. The command signal S2is a signal for outputting the second clock signal CK2from the second synchronization signal generating circuit33to the first synchronization signal generating circuit23. Further, the command signal S2is a signal for outputting the third clock signal CK3generated by the first synchronization signal generating circuit23to the timer generator24aas the first timing signal T1.

A relationship between the input statuses of the first reset signal Rs1and the second reset signal Rs2and the command signals S1and S2is described in detail. When the ECU10operates normally, the first reset signal Rs1and the second reset signal Rs2are not input to the monitoring circuit38.

First, it is assumed that the state in which the first reset signal Rs1and the second reset signal Rs2are not input to the monitoring circuit38is changed to the state in which the control operation of the second microcomputer32is brought into a stopped state and then returns to an operating state. In this case, the monitoring circuit38does not generate the command signals S1and S2. That is, when the state in which the second reset signal Rs2is input to the monitoring circuit38is changed to the state in which the input of the second reset signal Rs2is stopped, the monitoring circuit38does not generate the command signals S1and S2. Description is given below of the reason why the command signals S1and S2are not generated when the control operation of the second microcomputer32returns from the stopped state to the operating state.

As illustrated inFIG. 2, when the ECU10operates normally, the control operations of the first microcomputer22and the second microcomputer32are synchronized based on the first clock signal CK1generated by the first microcomputer22. For some reasons, the voltage values V1and V2of the first power supply26and the second power supply36may be changed (in the descending arrow direction inFIG. 2) to the vicinity of the threshold L that is a minimum value at which the first ECU20and the second ECU30can be operated. Along with the change in the voltage values V1and V2, the first reset signal generating circuit40may determine that the voltage value V1of the first power supply26is constantly kept within the predetermined range in which the first microcomputer22can be operated normally, and the second reset signal generating circuit50may determine that the voltage value V2of the second power supply36is not constantly kept within the predetermined range in which the second microcomputer32can be operated normally. In this case, the first reset signal generating circuit40does not generate the first reset signal Rs1, and only the second reset signal generating circuit50generates the second reset signal Rs2. That is, the control operation of the second ECU30may be brought into the stopped state.

The reason may be as follows. The first reset signal generating circuit40and the second reset signal generating circuit50have the same configuration, but have variations in their hardware or the like. That is, even if the voltage values V1and V2are changed but are constantly kept within the predetermined range in which the first ECU20and the second ECU30can be operated normally, only the second reset signal generating circuit50determines that the voltage value V2is not constantly kept within the predetermined range in which the second ECU30can be operated normally, and only the second reset signal generating circuit50generates the second reset signal Rs2because the thresholds L set in the first reset signal generating circuit40and the second reset signal generating circuit50have a slight variation.

In this case, as illustrated inFIG. 1, the control operation of the second microcomputer32is stopped by the second reset signal Rs2, and the first microcomputer22performs the control operation based on the first clock signal CK1generated by the first microcomputer22. The second reset signal generating circuit50then determines that the voltage value V2is constantly kept again within the predetermined range in which the second microcomputer32can be operated normally. Therefore, the generation of the second reset signal Rs2is stopped. That is, the input of the second reset signal Rs2to the monitoring circuit38is stopped. When the second microcomputer32starts to operate normally again, the control operation of the second microcomputer32is synchronized with the control operation of the first microcomputer22based on the first clock signal CK1generated by the first microcomputer22. Therefore, the condition that the state in which the second reset signal Rs2is input to the monitoring circuit38is changed to the state in which the input of the second reset signal Rs2is stopped indicates that the control operation of the second microcomputer32is appropriately synchronized with the control operation of the first microcomputer22based on the first clock signal CK1of the first microcomputer22. Thus, the monitoring circuit38does not generate the command signals S1and S2, but synchronizes the control operation of the second microcomputer32with the control operation of the first microcomputer22based on the first clock signal CK1generated by the first microcomputer22.

Next, it is assumed that the state in which the first reset signal Rs1and the second reset signal Rs2are not input to the monitoring circuit38is changed to the state in which the control operation of the first microcomputer22is brought into a stopped state and then returns to an operating state. In this case, the monitoring circuit38generates the command signals S1and S2. That is, when the input of the first reset signal Rs1is stopped after the first reset signal Rs1is input to the monitoring circuit38, the monitoring circuit38generates the command signals S1and S2. Description is given below of the reason why the command signals S1and S2are generated when the control operation of the first microcomputer22returns from the stopped state to the operating state.

When the ECU10operates normally, the control operations of the first microcomputer22and the second microcomputer32are synchronized based on the first clock signal CK1generated by the first microcomputer22. The voltage values V1and V2of the first power supply26and the second power supply36may be changed for some reasons. Along with the change in the voltage values V1and V2, the first reset signal generating circuit40may determine that the voltage value V1of the first power supply26is not constantly kept within the predetermined range in which the first microcomputer22can be operated normally, and the second reset signal generating circuit50may determine that the voltage value V2of the second power supply36is constantly kept within the predetermined range in which the second microcomputer32can be operated normally. In this case, only the first reset signal generating circuit40generates the first reset signal Rs1, and the second reset signal generating circuit50does not generate the second reset signal Rs2. That is, the control operation of the first microcomputer22may be brought into the stopped state.

The reason may be as follows. The first reset signal generating circuit40and the second reset signal generating circuit50have the same configuration, but have variations in their hardware or the like. That is, even if the voltage values V1and V2are changed but are constantly kept within the predetermined range in which the first ECU20and the second ECU30can be operated normally, only the first reset signal generating circuit40determines that the voltage value V1is not constantly kept within the predetermined range in which the first ECU20can be operated normally, and only the first reset signal generating circuit40generates the first reset signal Rs1because the thresholds L set in the first reset signal generating circuit40and the second reset signal generating circuit50have a slight variation.

In this case, the control operation of the first microcomputer22is stopped by the first reset signal Rs1, and the second microcomputer32needs to perform the control operation based on the second clock signal CK2generated by the second microcomputer32.

Thereafter, the first reset signal generating circuit40determines that the voltage value V1is constantly kept again within the predetermined range in which the first microcomputer22can be operated normally. Therefore, the generation of the first reset signal Rs1is stopped. That is, the input of the first reset signal Rs1to the monitoring circuit38is stopped. When the first microcomputer22starts to operate normally again, the control operation of the first microcomputer22needs to be synchronized with the control operation of the second microcomputer32based on the second clock signal CK2generated by the second microcomputer32. This is because the control operation of the second microcomputer32may deviate when the first clock signal CK1is input from the first microcomputer22while the second microcomputer32is operating normally based on the second clock signal CK2. Therefore, the condition that the state in which the first reset signal Rs1is input to the monitoring circuit38is changed to the state in which the input of the first reset signal Rs1is stopped indicates that the first microcomputer22needs to be synchronized based on the second clock signal CK2of the second microcomputer32.

That is, the monitoring circuit38determines that the control operation of the first microcomputer22returns from the stopped state to the operating state while the second microcomputer32is performing the control operation. Therefore, the monitoring circuit38generates the command signals S1and S2to synchronize the control operation of the first microcomputer22with the control operation of the second microcomputer32based on the second clock signal CK2of the second microcomputer32. Specifically, the monitoring circuit38generates the command signal S1when only the first reset signal Rs1is input to the monitoring circuit38. When the state in which only the first reset signal Rs1is input to the monitoring circuit38is changed to the state in which the input of the first reset signal Rs1is stopped, the monitoring circuit38generates the command signal S2. The reason why the monitoring circuit38generates the command signal S1when only the first reset signal Rs1is input to the monitoring circuit38is that the second microcomputer32needs to perform the control operation until the first microcomputer22operates normally. The first clock signal CK1is not input to the second microcomputer32until the first microcomputer22operates normally. That is, the reason is that the control operation of the second microcomputer32remains stopped as long as the fourth clock signal CK4is set as the second timing signal T2in the second microcomputer32until the first microcomputer22operates normally.

With the command signal S1, the second clock signal CK2generated by the second synchronization signal generating circuit33is set as the second timing signal T2. With the command signal S2, the second clock signal CK2generated by the second synchronization signal generating circuit33is output to the first synchronization signal generating circuit23. In addition, the third clock signal CK3generated by the first synchronization signal generating circuit23is output to the timer generator24aas the first timing signal T1. Thus, the control operation of the first microcomputer22can be synchronized with the control operation of the second microcomputer32based on the second clock signal CK2generated by the second microcomputer32.

Based on the above-mentioned relationship between the input statuses of the first reset signal Rs1and the second reset signal Rs2in the monitoring circuit38and the command signals S1and S2, the generation of the command signals S1and S2by the monitoring circuit38is triggered under the condition that the state in which only the first reset signal Rs1is input to the monitoring circuit38is changed to the state in which the input of the first reset signal Rs1is stopped. Under this condition, when the control operation of the first microcomputer22returns from the stopped state to the operating state while the second microcomputer32continues to perform the control operation normally, the control operation of the first microcomputer22can be synchronized with the control operation of the second microcomputer32based on the second clock signal CK2generated by the second microcomputer32.

Next, the operation of the ECU10is described. When an ignition switch mounted on a vehicle is turned on, the first power supply26and the second power supply36start to supply electric power to the first microcomputer22and the second microcomputer32. At this time, the first reset signal generating circuit40and the second reset signal generating circuit50monitor the voltage values V1and V2of the first power supply26and the second power supply36, and output the first reset signal Rs1and the second reset signal Rs2to the first microcomputer22and the second microcomputer32until the voltage values V1and V2are stabilized. Thus, the control operations are kept in a stopped state. The monitoring circuit38of the second microcomputer32monitors the first reset signal Rs1and the second reset signal Rs2.

Due to the variations in the hardware or the like of the first reset signal generating circuit40and the second reset signal generating circuit50, only the first reset signal generating circuit40may determine that the voltage value V1is not constantly kept within the predetermined range in which the first ECU20can be operated normally. In this case, the first reset signal generating circuit40generates the first reset signal Rs1, and the control operation of the first ECU20is brought into the stopped state. Only the first reset signal Rs1is input to the monitoring circuit38, and therefore the monitoring circuit38detects that the first microcomputer22is in the stopped state. When the monitoring circuit38detects that the control operation of the first microcomputer22is in the stopped state, the monitoring circuit38outputs the command signal S1to the switching device33dof the second synchronization signal generating circuit33of the second microcomputer32. When the command signal S1is input to the switching device33d, the switching device33dswitches the switch to output the second clock signal CK2generated by the clock generator33ato the second computation circuit34as the second timing signal T2.

When the first ECU20can be operated normally afterwards, that is, when the input of the first reset signal Rs1to the monitoring circuit38is stopped afterwards, the monitoring circuit38outputs the command signal S2to the clock output device33bof the second microcomputer32and the switching device23dof the first synchronization signal generating circuit23of the first microcomputer22. When the command signal S2is input to the clock output device33b, the clock output device33boutputs the second clock signal CK2generated by the clock generator33ato the clock corrector23cof the first synchronization signal generating circuit23. The clock corrector23coutputs, to the switching device23d, the third clock signal CK3obtained by performing correction so that the first clock signal CK1generated by the clock generator23acoincides with the second clock signal CK2. When the command signal S2is input to the switching device23d, the switching device23dswitches the switch to output the third clock signal CK3generated by the clock corrector23cto the first computation circuit24as the first timing signal T1.

As described above in detail, according to this embodiment, when the state in which only the first reset signal Rs1is input to the monitoring circuit38is changed to the state in which the input of the first reset signal Rs1is stopped, the monitoring circuit38detects that the control operation of the first microcomputer22returns from the stopped state to the operating state. Therefore, when the control operation of the first microcomputer22returns to the operating state while only the second microcomputer32is operating normally, the monitoring circuit38can synchronize the control operation of the first microcomputer22with the control operation of the second microcomputer32based on the second clock signal CK2generated by the second microcomputer32. Thus, it is possible to appropriately perform the synchronization control for the first ECU20and the second ECU30when the control operation of the first ECU20configured to output the first clock signal CK1serving as a reference to synchronization between the first ECU20and the second ECU30is brought into the stopped state and then returns to the operating state.

A vehicle control system according to a second embodiment is described below. Components similar to those of the first embodiment are described by assigning the same reference symbols. The second embodiment is different from the first embodiment in that an initial activation state of the ECU10is also taken into consideration.

It is assumed that the ECU10is in the initial activation state. The initial activation state refers to an initial state in which the ignition switch of the vehicle is turned on. As illustrated inFIG. 1, when the ignition switch of the vehicle is turned on, electric power starts to be supplied from the first and second power supplies26and36to the first microcomputer22and the second microcomputer32. Therefore, the first reset signal Rs1and the second reset signal Rs2are simultaneously input from the first reset signal generating circuit40and the second reset signal generating circuit50to the monitoring circuit38.

When the input of the first reset signal Rs1and the input of the second reset signal Rs2are simultaneously stopped afterwards, the monitoring circuit38does not generate the command signals S1and S2. Description is given below of the reason why the monitoring circuit38does not generate the command signals S1and S2when the input of the first reset signal Rs1and the input of the second reset signal Rs2are simultaneously stopped.

When the electric power starts to be supplied from the first power supply26and the second power supply36to the first microcomputer22and the second microcomputer32, the first reset signal generating circuit40and the second reset signal generating circuit50generate the first reset signal Rs1and the second reset signal Rs2until the voltage values V1and V2are stabilized. Therefore, the control operations of the first microcomputer22and the second microcomputer32are brought into a stopped state. When the voltage values V1and V2are stabilized and the first microcomputer22and the second microcomputer32are brought into an operating state, the control operation of the second microcomputer32is synchronized with the control operation of the first microcomputer22based on the first clock signal CK1generated by the first microcomputer22. Therefore, the condition that the first reset signal Rs1and the second reset signal Rs2are simultaneously input to the monitoring circuit38and then the input of the first reset signal Rs1and the input of the second reset signal Rs2are simultaneously stopped indicates that the first microcomputer22and the second microcomputer32are normally activated in the so-called initial activation state of the ECU10. Thus, the monitoring circuit38does not generate the command signals S1and S2, but synchronizes the control operation of the second microcomputer32with the control operation of the first microcomputer22based on the first clock signal CK1generated by the first microcomputer22.

When the state in which the first reset signal Rs1and the second reset signal Rs2are simultaneously input to the monitoring circuit38is changed to the state in which the input of the first reset signal Rs1is stopped first and the input of the second reset signal Rs2is stopped next, the monitoring circuit38does not generate the command signals S1and S2. Description is given below of the reason why the monitoring circuit38does not generate the command signals S1and S2when the state in which the first reset signal Rs1and the second reset signal Rs2are simultaneously input is changed to the state in which the input of the first reset signal Rs1is stopped first and the input of the second reset signal Rs2is stopped next.

The condition that the input of the first reset signal Rs1to the monitoring circuit38is stopped first and the input of the second reset signal Rs2to the monitoring circuit38is stopped next indicates that the first microcomputer22starts the control operation earlier than the second microcomputer32. Specifically, the voltage values V1and V2of the first microcomputer22and the second microcomputer32are gradually increased. The first reset signal generating circuit40may determine that the voltage value V1is constantly kept within the predetermined range in which the first microcomputer22can be operated normally, and the second reset signal generating circuit50may determine that the voltage value V2is not constantly kept within the predetermined range in which the second microcomputer32can be operated normally. In this case, the first reset signal generating circuit40stops generating the first reset signal Rs1first, and the second reset signal generating circuit50stops generating the second reset signal Rs2next. That is, the control operation of the second ECU30may be started later than the control operation of the first ECU20.

As described in the first embodiment, this situation may occur because only the second reset signal generating circuit50generates the second reset signal Rs2due to the variations in the hardware or the like of the first reset signal generating circuit40and the second reset signal generating circuit50. In this case, the first microcomputer22performs the control operation based on the first clock signal CK1generated by the first microcomputer22until the second microcomputer32operates normally. Then, the second reset signal generating circuit50then determines that the voltage value V2is kept within the predetermined range in which the second microcomputer32can be operated normally. Therefore, the generation of the second reset signal Rs2is stopped. That is, the input of the second reset signal Rs2to the monitoring circuit38is stopped. When the input of the second reset signal Rs2to the monitoring circuit38is stopped and the second microcomputer32starts to operate normally, the control operation of the second microcomputer32is synchronized with the control operation of the first microcomputer22based on the first clock signal CK1generated by the first microcomputer22. This is because the first clock signal CK1serving as a reference to synchronization between the control operations of the first microcomputer22and the second microcomputer32is constantly and continuously generated even if the second microcomputer32starts to operate later than the first microcomputer22.

Therefore, the condition that the input of the first reset signal Rs1to the monitoring circuit38is stopped first and the input of the second reset signal Rs2to the monitoring circuit38is stopped next indicates that the control operation of the second microcomputer32is appropriately synchronized with the control operation of the first microcomputer22based on the first clock signal CK1of the first microcomputer22in the so-called initial activation state of the ECU10. Thus, the monitoring circuit38does not generate the command signals S1and S2, but synchronizes the control operation of the second microcomputer32with the control operation of the first microcomputer22based on the first clock signal CK1generated by the first microcomputer22.

When the state in which the first reset signal Rs1and the second reset signal Rs2are simultaneously input to the monitoring circuit38is changed to the state in which the input of the second reset signal Rs2is stopped first and the input of the first reset signal Rs1is stopped next, the monitoring circuit38generates the command signals S1and S2. Description is given below of the reason why the monitoring circuit38generates the command signals S1and S2when the state in which the first reset signal Rs1and the second reset signal Rs2are simultaneously input to the monitoring circuit38is changed to the state in which the input of the second reset signal Rs2is stopped first and the input of the first reset signal Rs1is stopped next.

The condition that the input of the second reset signal Rs2to the monitoring circuit38is stopped first and the input of the first reset signal Rs1to the monitoring circuit38is stopped next indicates that the second microcomputer32starts the control operation earlier than the first microcomputer22. Specifically, the voltage values V1and V2of the first microcomputer22and the second microcomputer32are gradually increased. The second reset signal generating circuit50may determine that the voltage value V2is kept within the predetermined range in which the second microcomputer32can be operated normally, and the first reset signal generating circuit40may determine that the voltage value V1is not kept within the predetermined range in which the first microcomputer22can be operated normally. In this case, the second reset signal generating circuit50stops generating the second reset signal Rs2first, and the first reset signal generating circuit40stops generating the first reset signal Rs1next. That is, the control operation of the first ECU20may be started later than the control operation of the second ECU30.

As described above, this situation may occur, for example, because the first reset signal generating circuit40generates the first reset signal Rs1due to the variations in the hardware or the like of the first reset signal generating circuit40and the second reset signal generating circuit50. In this case, the second microcomputer32needs to perform the control operation based on the second clock signal CK2generated by the second microcomputer32. The first reset signal generating circuit40then determines that the voltage value V1is kept within the predetermined range in which the first microcomputer22can be operated normally. Therefore, the generation of the first reset signal Rs1is stopped. That is, the input of the first reset signal Rs1to the monitoring circuit38is stopped.

When the input of the first reset signal Rs1to the monitoring circuit38is stopped and the first microcomputer22starts to operate normally, the first microcomputer22needs to be synchronized based on the second clock signal CK2generated by the second microcomputer32. This is because the control operation of the second microcomputer32may deviate when the first clock signal CK1is input from the first microcomputer22while the second microcomputer32is operating normally based on the second clock signal CK2. Therefore, the condition that the input of the second reset signal Rs2to the monitoring circuit38is stopped first and the input of the first reset signal Rs1to the monitoring circuit38is stopped next indicates that the first microcomputer22needs to be synchronized based on the second clock signal CK2of the second microcomputer32in the so-called initial activation state of the ECU10. That is, the monitoring circuit38determines that the control operation of the first microcomputer22is changed from the stopped state to the operating state while the second microcomputer32is performing the control operation. Therefore, the monitoring circuit38generates the command signals S1and S2to synchronize the control operation of the first microcomputer22with the control operation of the second microcomputer32based on the second clock signal CK2of the second microcomputer32. Specifically, the monitoring circuit38generates the command signal S1when only the first reset signal Rs1is input to the monitoring circuit38.

When the state in which only the first reset signal Rs1is input to the monitoring circuit38is changed to the state in which the input of the first reset signal Rs1is stopped, the monitoring circuit38generates the command signal S2. The reason why the monitoring circuit38generates the command signal S1when only the first reset signal Rs1is input to the monitoring circuit38is that the second microcomputer32needs to perform the control operation until the first microcomputer22operates normally. That is, the reason is that the control operation of the second microcomputer32remains stopped as long as the fourth clock signal CK4is set as the second timing signal T2in the second microcomputer32until the first microcomputer22operates normally.

With the command signal S1, the second clock signal CK2generated by the second synchronization signal generating circuit33is set as the second timing signal T2. With the command signal S2, the second clock signal CK2generated by the second synchronization signal generating circuit33is output to the first synchronization signal generating circuit23. In addition, the third clock signal CK3generated by the first synchronization signal generating circuit23is output to the timer generator24aas the first timing signal T1. Thus, the control operation of the first microcomputer22can be synchronized with the control operation of the second microcomputer32based on the second clock signal CK2generated by the second microcomputer32.

According to this embodiment, it is possible to appropriately perform the synchronization control for the first ECU20and the second ECU30, for example, when the ECU10is in the initial activation state as well as when the state in which the ECU10is operating normally is changed to the state in which the control operation of the first ECU20is brought into the stopped state and then returns to the operating state.

A vehicle control system according to a third embodiment is described below. Components similar to those of the first embodiment are described by assigning the same reference symbols.

As illustrated inFIG. 3, the AD converter34bof the second microcomputer32performs conversion to obtain a digital signal Ds3from an analog signal of the voltage value V1detected by the voltage sensor27provided between the first microcomputer22and the first power supply26. Further, the AD converter34bperforms conversion to obtain a digital signal Ds4from an analog signal of the voltage value V2detected by the voltage sensor37provided between the second microcomputer32and the second power supply36. The monitoring circuit38monitors the digital signals Ds3and Ds4. The monitoring circuit38outputs the command signals S1and S2to the second synchronization signal generating circuit33in accordance with input statuses of the digital signals Ds3and Ds4.

The functions of the AD converter34bare described in more detail. When the voltage value V1of the first power supply26is equal to or higher than the threshold that is a minimum value at which the first microcomputer22can be operated, the AD converter34bconverts the voltage value V1into a digital signal Ds3indicating “1”. When the voltage value V1of the first power supply26is lower than the threshold that is a minimum value at which the first microcomputer22can be operated, the AD converter34bconverts the voltage value V1into a digital signal Ds3indicating “0”. The AD converter34bsimilarly converts the voltage value V2of the second power supply36into a digital signal Ds4indicating “1” or “0”. That is, when conversion is performed to obtain the digital signals Ds3and Ds4indicating “0”, the control operations of the first microcomputer22and the second microcomputer32are brought into a stopped state, and when conversion is performed to obtain the digital signals Ds3and Ds4indicating “1”, the control operations of the first microcomputer22and the second microcomputer32are brought into an operating state.

A relationship between the input statuses of the digital signals Ds3and Ds4and the command signals S1and S2is described. It is assumed that the ECU10operates normally. In this case, the digital signal Ds3indicating “1” and the digital signal Ds4indicating “1” are input to the monitoring circuit38.

When the state in which the first microcomputer22and the second microcomputer32operate normally is changed to the state in which the control operation of the first microcomputer22is brought into the stopped state and returns to the operating state, the monitoring circuit38generates the command signals S1and S2. That is, the monitoring circuit38generates the command signals S1and S2when the input of the digital signal Ds3is changed from “1” to “0” and then from “0” to “1” again while the digital signal Ds4indicating “1” is not changed.

The generation of the command signals S1and S2by the monitoring circuit38is triggered under the condition that the input of the digital signal Ds3is changed from “0” to “1” while the digital signal Ds4indicating “1” is input to the monitoring circuit38. Under this condition, when the control operation of the first microcomputer22returns to the operating state while the second microcomputer32is operating, the control operation of the first microcomputer22can be synchronized with the control operation of the second microcomputer32based on the second clock signal CK2generated by the second microcomputer32.

This embodiment may be modified as follows without causing any technical contradiction. The third embodiment is described under the assumption that the ECU10operates normally. For example, the case where the ECU10is in the initial activation state may be taken into consideration.

In this case, the ignition switch of the vehicle is turned on and electric power starts to be supplied from the first power supply26and the second power supply36to the first microcomputer22and the second microcomputer32. Therefore, the digital signal Ds3indicating “0” and the digital signal Ds4indicating “0” are simultaneously input from the AD converter34bto the monitoring circuit38. When the input of the digital signal Ds4is changed from “0” to “1” first and the input of the digital signal Ds3is changed from “0” to “1” next, the monitoring circuit38generates the command signals S1and S2. In this case as well, effects similar to those of the third embodiment are attained.

The monitoring circuit38detects that the control operation of the first microcomputer22is changed from the stopped state to the operating state based on the input statuses of the first reset signal Rs1and the second reset signal Rs2in the first and second embodiments, or based on the input statuses of the digital signals Ds3and Ds4of the voltage values V1and V2in the third embodiment. The present invention is not limited to those cases. For example, the monitoring circuit38may detect that the control operation of the first microcomputer22is changed from the stopped state to the operating state based on the first clock signal CK1output from the clock output device23bof the first microcomputer22. When the control operation of the first microcomputer22is in the stopped state, the first clock signal CK1is not output from the clock output device23b. When the control operation of the first microcomputer22is in the operating state, the first clock signal CK1is output from the clock output device23b. The monitoring circuit38may detect that the control operation of the first microcomputer22is in the stopped state when the input of the first clock signal CK1is stopped, or may detect that the control operation of the first microcomputer22is in the operating state when the first clock signal CK1is input.

In the first to third embodiments, the control target is the single motor11including the motor coil group A and the motor coil group B for two systems, which are electrically independent of each other. The present invention is not limited to this case. For example, the control target may be two motors each including a single motor coil group for one system having the three phases (U phase, V phase, and W phase). Further, the motor11may include three or more motor coil groups for systems each having the three phases (U phase, V phase, and W phase). In this case, it should be noted that the ECU10is provided with control circuits including microcomputers as many as the motor coil groups.

In the first to third embodiments, the ECU10includes the control circuits for two systems, which are the first ECU20and the second ECU30. The present invention is not limited to this case. For example, the ECU10may include control circuits for three or more systems. In this case, at least one of the remaining control circuits except the first ECU20serving as the first control circuit is set so as to have the monitoring circuit38. When it is detected that the control operation of the first ECU20is changed from the stopped state to the operating state, the control operation of the first ECU20is synchronized with the control operation of the remaining control circuits based on the clock signal serving as a synchronization signal generated by the remaining control circuits.

In the first to third embodiments, the monitoring circuit38is provided inside the second microcomputer32. The present invention is not limited to this case. For example, the monitoring circuit38may be provided at any location inside the second ECU30. Even when the control circuits for three or more systems are provided as described above, the monitoring circuit38may be provided at any location inside the control circuit instead of being provided inside the microcomputer.