Vehicle control apparatus

Abstract

A vehicle control apparatus performs an in-excess determination control by monitoring a drive power in-excess indicator at a time when a temporary in-excess state occurs which indicates that a drive power excess amount exceeds a predetermined value. As such, when a vehicle-dynamic safety parameter fulfills a prescribed condition, the vehicle control apparatus lowers an indicator threshold for determining an excess drive power continuation time from an original value to a lowered value. As a result, the excess drive power continuation time is determined as exceeding the indicator threshold, which indicates that a drive power of a vehicle is in excess, and a fail-safe instruction signal output is brought forward from an original timing to an earlier timing. Therefore, when a degree of dangerousness of a vehicle behavior is estimated to be relatively high, a fail-safe action is promptly taken.

Claims

1. A vehicle control apparatus comprising: an actuator configured to control a drive of a vehicle; a main calculator programmed to calculate an instructed drive power based on a requested drive power of the vehicle and programmed to instruct the actuator to operate according to the instructed drive power; and a monitor section programmed to monitor at least one of (i) the instructed drive power and (ii) an actual drive power that is output from the actuator according to the instructed drive power, wherein based on a drive power difference amount calculated by deducting the requested drive power from either the actual drive power or the instructed drive power, the vehicle control apparatus is programmed to perform a difference determination control that executes a fail-safe action regarding a drive of the vehicle by (i) monitoring a drive power difference indicator started at a time when the drive power difference amount differs from a predetermined value, and (ii) determining that the drive power difference amount is too large when the drive power difference indicator differs from a preset value of an indicator threshold for longer than a predetermined period of time, wherein the drive power difference indicator is an absolute value of the drive power difference amount, the vehicle control apparatus is programmed to, when performing the difference determination control, lower the indicator threshold when a vehicle-dynamic safety parameter that reflects a travel safety related vehicle behavior fulfills a prescribed condition, the vehicle control apparatus is programmed to determine whether the vehicle-dynamic safety parameter fulfills the prescribed condition after the determination that the drive power difference amount is too large, and the vehicle control apparatus is programmed to lower the indicator threshold after the determination that the drive power difference amount is too large.

2. The vehicle control apparatus of claim 1, wherein the vehicle-dynamic safety parameter is at least one of an amount of depression of a brake pedal, an amount of depression of an accelerator pedal, a steer angle of a steering wheel, a steering speed of the steering wheel, a steering angle of a front tire or a rear tire, a vehicle speed, an acceleration of the vehicle, a yaw angular velocity, a yaw angular acceleration, a difference between wheel speeds, a road surface friction coefficient, or a shift position.

3. The vehicle control apparatus of claim 1, wherein a lowering amount of the indicator threshold of the drive power difference indicator is changed according to a value of the vehicle-dynamic safety parameter.

4. The vehicle control apparatus of claim 3, wherein the vehicle-dynamic safety parameter represents a high degree of dangerous vehicle behavior when the value of the vehicle-dynamic safety parameter is large, the indicator threshold is lowered when the value of the vehicle-dynamic safety parameter is equal to or greater than a specified value, and the lowering amount of the indicator threshold is increased in proportion to an increase of the value of the vehicle-dynamic safety parameter.

5. A vehicle control apparatus comprising: an actuator configured to control a drive of a vehicle; a main calculator programmed to calculate an instructed drive power based on a requested drive power of the vehicle and programmed to instruct the actuator to operate according to the instructed drive power; and a monitor section programmed to monitor at least one of (i) the instructed drive power and (ii) an actual drive power that is output from the actuator according to the instructed drive power, wherein based on a drive power difference amount calculated by deducting the requested drive power from either the actual drive power or the instructed drive power, the vehicle control apparatus is programmed to perform a difference determination control that executes a fail-safe action regarding a drive of the vehicle when (i) a drive power difference indicator started at a time when the drive power difference amount differs from a predetermined value, and (ii) by determining that the drive power difference amount is too large when the drive power difference indicator differs from a preset value of an indicator threshold, wherein the drive power difference indicator is a time integration value of the drive power difference amount, the vehicle control apparatus is programmed to, when performing the difference determination control, lower the indicator threshold when a vehicle-dynamic safety parameter that reflects a travel safety related vehicle behavior fulfills a prescribed condition, the vehicle control apparatus is programmed to determine whether the vehicle-dynamic safety parameter fulfills the prescribed condition after the determination that the drive power difference is too large, and the vehicle control apparatus is programmed to lower the indicator threshold after the determination that the drive power difference amount is too large.

6. The vehicle control apparatus of claim 5, wherein the vehicle-dynamic safety parameter is at least one of an amount of depression of a brake pedal, an amount of depression of an accelerator pedal, a steer angle of a steering wheel, a steering speed of the steering wheel, a steering angle of a front tire or a rear tire, a vehicle speed, an acceleration of the vehicle, a yaw angular velocity, a yaw angular acceleration, a difference between wheel speeds, a road surface friction coefficient, or a shift position.

7. The vehicle control apparatus of claim 5, wherein a lowering amount of the indicator threshold of the drive power difference indicator is changed according to a value of the vehicle-dynamic safety parameter.

8. The vehicle control apparatus of claim 7, wherein the vehicle-dynamic safety parameter represents a high degree of dangerous vehicle behavior when the value of the vehicle-dynamic safety parameter is large, the indicator threshold is lowered when the value of the vehicle-dynamic safety parameter is equal to or greater than a specified value, and the lowering amount of the indicator threshold is increased in proportion to an increase of the value of the vehicle-dynamic safety parameter.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

(1) Objects, features, and advantages of the present disclosure will become more apparent from the following detailed description made with reference to the accompanying drawings, in which:

(2) FIG. 1 is a block diagram of a vehicle control apparatus in an embodiment of the present disclosure;

(3) FIG. 2 is a flowchart of a drive power monitoring process in the embodiment of the present disclosure;

(4) FIG. 3A is a time chart of an in-excess determination control in which a drive power in-excess state is continuing in a first embodiment of the present disclosure;

(5) FIG. 3B is a time chart illustrating a fulfillment of the vehicle-dynamic safety parameter in which the drive power in-excess state is continuing in the first embodiment of the present disclosure;

(6) FIG. 3C is a time chart illustrating a drive power excess amount in which the drive power in-excess state is continuing in the first embodiment of the present disclosure;

(7) FIG. 3D is a time chart illustrating an excess drive power continuation time in which the drive power in-excess state is continuing in the first embodiment of the present disclosure;

(8) FIG. 3E is a time chart illustrating a fail-safe instruction signal in which the drive power in-excess state is continuing in the first embodiment of the present disclosure;

(9) FIG. 4A is a time chart of the in-excess determination control in which a temporary in-excess state returns to a normal state in the first embodiment of the present disclosure;

(10) FIG. 4B is a time chart illustrating a fulfillment of the vehicle-dynamic safety parameter in which the temporary in-excess state returns to the normal state in the first embodiment of the present disclosure;

(11) FIG. 4C is a time chart illustrating a drive power excess amount in which the temporary in-excess state returns to the normal state in the first embodiment of the present disclosure;

(12) FIG. 4D is a time chart illustrating an excess drive power continuation time in which the temporary in-excess state returns to the normal state in the first embodiment of the present disclosure;

(13) FIG. 4E is a time chart illustrating a fail-safe instruction signal in which the temporary in-excess state returns to the normal state in the first embodiment of the present disclosure;

(14) FIG. 5A is a characteristic diagram between a positive correlation type vehicle-dynamic safety parameter and a threshold lowered amount in which the amount of lowering may be asymptotic;

(15) FIG. 5B is a characteristic diagram between the positive correlation type vehicle-dynamic safety parameter and the threshold lowered amount in which the amount of lowering may be linear;

(16) FIG. 5C is a characteristic diagram between the positive correlation type vehicle-dynamic safety parameter and the threshold lowered amount in which the amount is set to a standard value;

(17) FIG. 6A is a time chart of the in-excess determination control in which the drive power in-excess state is continuing in a second embodiment of the present disclosure;

(18) FIG. 6B is a time chart illustrating a fulfillment of the vehicle-dynamic safety parameter in which the drive power in-excess state is continuing in the second embodiment of the present disclosure;

(19) FIG. 6C is a time chart illustrating a drive power excess amount E in which the drive power in-excess state is continuing in the second embodiment of the present disclosure;

(20) FIG. 6D is a time chart illustrating a fail-safe instruction signal in which the drive power in-excess state is continuing in the second embodiment of the present disclosure;

(21) FIG. 7A is a time chart of the in-excess determination control in which the drive power in-excess state is continuing in a third embodiment of the present disclosure;

(22) FIG. 7B is a time chart illustrating a fulfillment of the vehicle-dynamic safety parameter in which the drive power in-excess state is continuing in the third embodiment of the present disclosure;

(23) FIG. 7C is a time chart illustrating a drive power excess amount in which the drive power in-excess state is continuing in the third embodiment of the present disclosure;

(24) FIG. 7D is a time chart illustrating an excess drive power continuation time in which the drive power in-excess state is continuing in the third embodiment of the present disclosure;

(25) FIG. 7E is a time chart illustrating a fail-safe instruction signal in which the drive power in-excess state is continuing in the third embodiment of the present disclosure; and

(26) FIG. 8 is a block diagram of a vehicle control apparatus in other embodiments of the present disclosure.

DETAILED DESCRIPTION

(27) Hereafter, multiple embodiments of the present disclosure are described with reference to the drawing. In those embodiments, like parts have like numbers, for the brevity of description.

(28) (Base Configuration)

(29) The base configuration of a vehicle control apparatus and a drive power monitoring process performed by the vehicle control apparatus in an embodiment of the present disclosure (i.e., in a base embodiment serving as a basis of the first, second, third and other embodiments) are described with reference to FIG. 1 and FIG. 2.

(30) This vehicle control apparatus is applicable to any type of vehicle that is equipped with a drive power source that is variably controllable in an engine driven vehicle, in an electric vehicle, in a hybrid vehicle or the like.

(31) As shown in FIG. 1, a vehicle controller 10 receives an input of a requested drive power concerning the drive of the vehicle, and outputs an instructed drive power to an actuator 20, which is a control object under control of such an instruction. The requested drive power is inputted based on an accelerator signal from an accelerator sensor, a brake signal from a brake switch, a shift signal from a shift switch, a speed signal about a speed of the vehicle, etc., for example.

(32) Further, a vehicle-dynamic safety parameter is also inputted to the controller 10, and the vehicle controller 10 outputs a fail-safe instruction signal to the actuator 20.

(33) The vehicle controller 10 is provided with a main calculator 11 and a monitor section 12. The main calculator 11 calculates the instructed drive power based on the requested drive power, and sends an instruction to the actuator 20. The vehicle controller 10 may be implemented as an ECU provided with a microcomputer, for example. The vehicle controller 10 may also be implemented in any physical form. That is, the main calculator 11 and the monitor section 12 may be mounted on the same substrate, or may respectively be mounted on different substrates.

(34) The actuator 20 includes a device that is used to drive the vehicle. That is, the actuator 20 may be a drive power source of the vehicle, e.g., an engine, a motor-generator, a driver directly driving the engine/motor-generator which may be an injector for the engine or an inverter for the motor-generator, and/or other sensors for detecting a crank angle, a rotation angle, an output torque and the like and for providing feedback therefrom. In general, according to the instructed drive power, which is calculated by the main calculator 11 of the vehicle controller 10, the actuator 20 converts a fuel energy and/or an electrical energy for generating an actual drive power of the vehicle.

(35) Further, regarding the vehicle controller 10, the monitor section 12 obtains the requested drive power, and monitors at least one of the instructed drive power which is calculated by the main calculator 11, or the actual drive power which is output by the actuator 20. The long broken line arrows in FIG. 1 indicate that at least one of those drive powers is input to the monitor section 12.

(36) The monitor section 12 compares (a) the requested drive power with (b) the actual drive power or the instructed drive power. In an ideal control situation, (a) may be equated with (b). However, the actual drive power may be diverted from the instructed drive power due to a power loss of the actuator 20 and/or a control abnormality of a drive power source ECU, etc., and the instructed drive power may be diverted from the requested drive power due to a calculation abnormality of the main calculator 11, or the like. Especially, diversion of the actual drive power and the instructed drive power diverting to a larger side relative to the requested drive power may increase a probability of causing a dangerous state of the vehicle behavior.

(37) Therefore, by outputting a fail-safe instruction signal to the actuator 20, the monitor section 12 outputs an instruction for taking a fail-safe action that stops or restricts the drive of the actuator 20 or the like when the actual drive power or the instructed drive power becomes excessive relative to the requested drive power.

(38) Further, the vehicle-dynamic safety parameter which reflects a travel safety related vehicle behavior is inputted to the monitor section 12. For example, in case of having an excessive drive power for a rear-wheel drive vehicle, if the amount of depression of the brake pedal by the driver of the vehicle is large, the vehicle is put in a dangerous state, in which the vehicle may spin or the vehicle's wheels may spin. In this case, the amount of depression of the brake pedal corresponds to the vehicle-dynamic safety parameter.

(39) Such a vehicle-dynamic safety parameter is classified into three types, i.e., a positive correlation type, a negative correlation type, and a mode selection type.

(40) A positive correlation type vehicle-dynamic safety parameter is a parameter of representing a high degree of dangerous vehicle behavior when a parameter value is large/high, such as the amount of depression of the brake pedal. The positive correlation type vehicle-dynamic safety parameter may be, other than the brake depression amount, the amount of depression of the accelerator pedal, a steer angle of the steering wheel, a steering speed of the steering wheel, a steer angle of front/rear tire, a vehicle speed, an acceleration of the vehicle, a yaw angular velocity, a yaw angular acceleration, a difference between rotations speeds of respective wheels, and the like.

(41) As for the negative correlation type vehicle-dynamic safety parameter, a high degree of dangerous vehicle behavior is represented by a parameter value that is small/low, in contrast. For example, a road surface friction coefficient represents a greater degree of dangerousness when its value is smaller, i.e., representing a slippery state in which the tire may easily slip, and represents a smaller degree of dangerousness when its value is large, serving as a negative correlation type vehicle-dynamic safety parameter.

(42) As for the mode selection type vehicle-dynamic safety parameter, a specific mode among other selectable modes represents a higher degree of dangerous ness of the vehicle behavior. For example, when the vehicle is in the drive power in-excess mode, the shift position of N (Neutral) may represent a lower degree of dangerousness because the drive power will not be transmitted to the tires/wheels, and the shift position of D or the like may represent a higher degree of dangerousness because the drive power will be transmitted to the tire/wheels. In other words, the shift position serves as a mode selection type vehicle-dynamic safety parameter.

(43) In the present disclosure, the monitor section 12 obtains the above-described vehicle-dynamic safety parameters, and the vehicle controller 10 performs a drive power monitoring control based on the obtained parameters.

(44) Next, a drive power monitoring process performed by the vehicle controller 10 is described with reference to a flowchart in FIG. 2. The sign S in the following description of the flowchart indicates a step.

(45) In S01, the requested drive power concerning the drive of the vehicle is obtained from an accelerator signal, a brake signal, a shift signal, a speed signal, etc., In S02, the main calculator 11 calculates the instructed drive power based on the requested drive power.

(46) In S03, either the actual drive power which is obtained from the actuator 20 by the monitor section 12 or the instructed drive power which is calculated by the main calculator 11 is monitored. As mentioned above, the monitor section 12 may monitor the actual drive power or the instructed drive power. The same following process is usable for monitoring either the actual drive power or the instructed drive power.

(47) In S04, it is determined whether the actual drive power or the instructed drive power exceeds a value which is calculated as a sum of a specified threshold value greater than zero and the requested drive power. In the following, a value which is calculated by deducting the requested drive power either from the actual drive power or the instructed drive power is designated as a drive power excess amount E. Thus, the process in S04 may be re-stated as it is determined whether the drive power excess amount E exceeds a threshold value . The threshold value is set as a somewhat greater value that is greater than an operation error or an overshoot range which is expected as a tolerance, for example.

(48) Even when it is determined that the drive power excess amount E has exceeded the threshold value in S04 as YES, it may possibly be a temporary phenomenon with a possibility of immediately returning to normal, or it may possibly be a misdetection due to a disturbance noise or the like. In such a case, vehicle functions may be hindered if the unnecessary fail-safe action is performed.

(49) Thus, the vehicle controller 10 of the present embodiment performs an in-excess determination control in the following steps of S05-S09 which determines whether it is actually necessary to perform the fail-safe action, based on a recognition that a state of determination in S04 is a temporary in-excess state.

(50) On the other hand, in case of NO determination in S04, the processing is ended.

(51) In the in-excess determination control, the drive power in-excess indicator is monitored, and when the drive power in-excess indicator exceeds a predetermined indicator threshold, it is definitively determined that the drive power is in excess. In other words, the drive power in-excess indicator is confirmation information confirming that a current situation indicates a high probability of the vehicle actually having an in-excess drive power, which may more practically be described in the following embodiments. That is, for example, in the first embodiment, an excess drive power continuation time during which a drive power in-excess state (i.e., a state of the drive power excess amount E exceeding the threshold value ) continues is used as a drive power in-excess indicator.

(52) The in-excess determination control is started in S05. For example, when adopting the excess drive power continuation time as the drive power in-excess indicator, the count of such continuation time is started in S05. The indicator threshold is set to a value so that the prescribed condition of the vehicle-dynamic safety parameter is not fulfilled in this step with such set value.

(53) Next, in S06, it is determined whether the vehicle-dynamic safety parameter which is obtained by the monitor section 12 fulfills the prescribed condition. The vehicle-dynamic safety parameter used for this determination may be a single vehicle-dynamic safety parameter, or may be a combination of two or more vehicle-dynamic safety parameters.

(54) The prescribed condition of the vehicle-dynamic safety parameter is set up it be fulfilled when the degree of dangerous vehicle behavior is relatively high, i.e., when it is assumed that a quick fail-safe action is required. For example, as for the positive correlation type vehicle-dynamic safety parameter, the prescribed condition is configured to be fulfilled when the parameter value exceeds a specified value, and as for the negative correlation type vehicle-dynamic safety parameter, the prescribed condition is configured to be fulfilled when the parameter value falls below the specified value. Further, as for the mode selection type vehicle-dynamic safety parameter, the prescribed condition is configured to be fulfilled when the specific mode is selected.

(55) Then, the vehicle controller 10 of the present embodiment lowers an indicator threshold in S07 in case that the determination in S06 is YES, which may be a characteristic feature of the present disclosure. When the determination in S06 is NO, step S07 is skipped.

(56) In such manner, the monitoring of the drive power in-excess indicator continues, and when the drive power in-excess indicator exceed the indicator threshold (S08:YES), it is determined that the drive power is in excess, and the fail-safe instruction signal is output to the actuator 20 (S09). The actuator 20 which has received the fail-safe instruction signal performs the fail-safe action of stopping or restricting a drive of the actuator 20.

(57) The routine execution of the drive power monitoring process concludes in this manner. On the other hand, when the drive power in-excess indicator does not exceed the indicator threshold (S08:NO), the fail-safe instruction signal is not output.

(58) Next, the drive power in-excess indicator in the in-excess determination control that is performed by the vehicle controller 10 is described with reference to a time chart in each of the following embodiments.

(59) (First Embodiment)

(60) The in-excess determination control in the first embodiment of the present disclosure is described with reference to FIGS. 3A/B/C/D/E and FIGS. 4 A/B/C/D/E.

(61) The time charts in FIGS. 3 A/B/C/D/E and FIGS. 4 A/B/C/D/E set a horizontal axis as having a common time scale, and vertical axes of charts 3A/4A are about an execution (ON) or a stop (OFF) of the in-excess determination control, of charts 3B/4B are about a fulfillment of the vehicle-dynamic safety parameter (ON:Fulfilling, OFF:Non-fulfilling) of charts 3C/4C are about a drive power excess amount E, of charts 3D/4D are about an excess drive power continuation time, and of charts 3E/4E are about a fail-safe instruction signal, respectively. The excess drive power continuation time in FIGS. 3D/4D is the drive power in-excess indicator of the first embodiment.

(62) About the condition fulfillment of the vehicle-dynamic safety parameter, the vehicle-dynamic safety parameter fulfilling the prescribed condition may be described as Vehicle-dynamic safety parameter conditions are ON, and the vehicle-dynamic safety parameter not fulfilling the prescribed condition may be described as Vehicle-dynamic safety parameter conditions are OFF. In each drawing, a thick dashed line shows an OFF transition of vehicle-dynamic safety parameter conditions, and a thick solid line shows an ON transition of vehicle-dynamic safety parameter conditions.

(63) The drive power excess amount E is put in a temporary in-excess state exceeding the threshold value at time t0 in both of FIGS. 3A and 4A, which starts the in-excess determination control.

(64) In FIG. 3C, an excess state in which the drive power excess amount E exceeds the threshold value continues thereafter, and the counter of the excess drive power continuation time increases linearly. The indicator threshold of the excess drive power continuation time in case that the vehicle-dynamic safety parameter conditions are OFF is set as C.sub.OFF. Therefore, when the vehicle-dynamic safety parameter conditions continue to be OFF, at time tf.sub.OFF when the excess drive power continuation time exceeds the indicator threshold C.sub.OFF, it is determined that the drive power is in excess, and the fail-safe instruction signal is output. In this manner, the execution of the in-excess determination control is ended. When the actuator 20 stops due to the fail-safe action, the drive power excess amount E will decrease thereafter.

(65) On the other hand, when the vehicle-dynamic safety parameter conditions are turned to ON at time t1 during the in-excess determination control, the vehicle controller 10 lowers the indicator threshold from C.sub.OFF to C.sub.ON. In such manner, at time tf.sub.ON when the excess drive power continuation time exceeds the indicator threshold C.sub.ON, it is determined that the drive power is in excess, and the fail-safe instruction signal is output. In other word, the output timing of the fail-safe instruction signal is brought forward to time tf.sub.ON from time tf.sub.OFF. Therefore, in a situation in which the degree of dangerous vehicle behavior is relatively high, transition to the fail-safe action is caused at an earlier timing. For example, the fail-safe action is performed before the spin of the rear-wheel-drive vehicle is caused by a depression of the brake pedal in such vehicle.

(66) In FIGS. 4A/B/C/D/E, for the comparison with a situation in FIGS. 3A/B/C/D/E, a situation in which the drive power excess amount E returns to a normal, i.e., falling under the threshold value , soon after the start of the in-excess determination control at time t0 is described. Here, the vehicle-dynamic safety parameter conditions are assumed to be OFF.

(67) After time t0, although the counter of the excess drive power continuation time increases, at time t2 when the drive power excess amount E falls under the threshold value , the increase of the counter stops. Then, if the excess drive power continuation time is not greater than the indicator threshold C.sub.OFF at time t3 that is after a lapse of predetermined monitor time Tw from time t0, the counter is reset, and the in-excess determination control is ended, without outputting the fail-safe instruction signal.

(68) In such manner, the vehicle control apparatus of the present disclosure is capable of (i) preventing the unnecessary fail-safe action that may otherwise be performed and (ii) preventing the deterioration of the vehicle functions when a temporary in-excess state of the drive power returns to normal immediately after such an in-excess state, or when the in-excess state is a misdetection of such a state due to a disturbance noise, or by other faults.

(69) Next, with reference to FIGS. 5A/B/C, how to set a threshold lowered amount is described. That is, how to set an amount of lowering the indicator threshold, i.e., a difference between the indicator threshold value C.sub.OFF and the indicator threshold value C.sub.ON, when the vehicle-dynamic safety parameter conditions are turned ON, is described. Here, a positive correlation type vehicle-dynamic safety parameter is described as an example.

(70) As for the positive correlation type vehicle-dynamic safety parameter, the necessity of performing the fail-safe action at an earlier timing increases when the parameter value is large. Therefore, the positive correlation type vehicle-dynamic safety parameter is configured to fulfill a prescribed condition when the parameter value is equal to or greater than the specified value X, for the lowering of the indicator threshold. That is, when the parameter value is smaller than X, the threshold lowered amount is set to 0, and when the parameter value is equal to X, the threshold lowered amount is set to a standard value st. Further, the threshold lowered amount when the parameter value exceeds X is set according to the following patterns.

(71) The first pattern is, as shown in FIGS. 5A and 5B, that the threshold lowered amount is increased in proportion to the increase of the parameter value. However, the maximum lowering amount should not exceed the threshold value C.sub.OFF. Therefore, the amount of lowering may be asymptotic in a curve that approaches to the maximum value max of the threshold lowered amount in FIG. 5A, or the amount of lowering may be linear to the maximum value max which then takes a constant value of max in FIG. 5B. These characteristics lines may be stored as a map. In such manner, the determination criteria for determining whether to perform the fail-safe action may be adjusted more appropriately according to the degree of dangerous vehicle behavior.

(72) The second pattern is, as shown in FIG. 5C, that the threshold lowered amount is uniformly set to the standard value st when the parameter value is equal to or greater than X. Thereby, the calculation load of the vehicle controller 10 is reduced.

(73) The characteristic diagrams for the negative correlation type vehicle-dynamic safety parameter have a right-left reversed shape of the characteristic diagrams for the positive correlation type vehicle-dynamic safety parameter. As for the mode selection type vehicle-dynamic safety parameter, none of FIGS. 5A/B/C is applicable because only one threshold lowered amount corresponds to respective modes.

(74) In the following, other embodiments of the drive power in-excess indicator used in the in-excess determination control are described.

(75) (Second Embodiment)

(76) The in-excess determination control in the second embodiment of the present disclosure is described with reference to the time charts of FIGS. 6A/B/C/D.

(77) FIG. 6C differs from FIG. 3C, and there is no equivalent drawing corresponding to FIG. 3D. That is, FIG. 6D is equivalent to FIG. 3E.

(78) According to the second embodiment, as the drive power in-excess indicator, an absolute value of the drive power excess amount (E) is monitored, instead of monitoring the excess drive power continuation time, which is described in the first embodiment.

(79) According to the first embodiment, one threshold value is set about the drive power excess amount E, and as long as the drive power excess amount E exceeds the threshold value , the excess drive power continuation time is counted. Therefore, the excess drive power continuation time is counted in the same manner for two different cases, i.e., for a case shown by a solid line in FIG. 3C, in which the drive power excess amount E takes substantially a constant value after exceeding the threshold value , and for another case shown by a two dot chain line in FIG. 3C, in which the drive power excess amount E continues to increase after exceeding the threshold value . That means, when the vehicle-dynamic safety parameter conditions are the same, the in-excess determination that determines that the drive power is in excess is made at the same lapse time after exceeding the threshold value , for the output of the fail-safe signal.

(80) In the second embodiment, in addition to the threshold value , a indicator threshold value .sub.OFF at the vehicle-dynamic safety parameter conditions OFF time which is a value greater than the threshold value is set for the drive power excess amount E. Then, as shown in FIG. 6C, the fail-safe instruction signal is output at time tf.sub.OFF at which the drive power excess amount E (i) increases to exceed the threshold value , and (ii) increases further to exceed the indicator threshold value .sub.OFF. In case that the drive power excess amount E does not exceed the indicator threshold value .sub.OFF after a lapse of a predetermined monitor time from time t0, the in-excess determination control may be ended in the same manner as the monitoring scheme shown in FIG. 4A/B/C/D/E in the first embodiment.

(81) If the vehicle-dynamic safety parameter conditions are turned to ON at time t1 after starting the in-excess determination control, the indicator threshold value .sub.OFF will be lowered to a smaller value .sub.ON. In such manner, the drive power excess amount E is determined as exceeding the threshold that has a smaller value, namely, a lighter security condition of the indicator threshold value .sub.ON is used for the in-excess determination of the drive power. Further, as shown in FIG. 6C, when the drive power excess amount E continues to increase, the drive power excess amount E exceeds the smaller indicator threshold value .sub.ON at an earlier timing, for the determination that the drive power is in excess.

(82) As a result, the output timing of the fail-safe instruction signal is brought forward at time tf.sub.ON from time tf.sub.OFF (refer to FIG. 6D). Therefore, the second embodiment achieves the same effect as the first embodiment. Further, the in-excess determination control in the second embodiment is more advantageous in comparison to the one in the first embodiment in that the control not only compares the drive power excess amount E with the threshold value , but also considers an absolute value of the drive power excess amount E in the in-excess determination control.

(83) (Third Embodiment)

(84) The in-excess determination control in the third embodiment of the present disclosure is described with reference to the time charts in FIG. 7A/B/C/D/E. FIG. 7D differs from FIG. 3D. According to the third embodiment, as the drive power in-excess indicator, a time integration value of the drive power excess amount E is monitored, instead of monitoring the excess drive power continuation time, which is described in the first embodiment. In FIG. 7D, the time integration value of the drive power excess amount E is abbreviated to an excess amount integrated value.

(85) The excess amount integrated value is, as shown in FIG. 7C, a number which is calculated as an integration of the drive power excess amount E along the time axis starting at time t0 at which the drive power excess amount E has exceeded the threshold value , i.e., a time integration value calculated by using an equation (E.Math.t).

(86) For example, as shown by a solid line in FIG. 7C, an excess amount integrated value increases in a linear shape, when the drive power excess amount E after exceeding the threshold value takes a constant value. Further, when the drive power excess amount E continues to increase after exceeding the threshold value , as shown by a two-dot chain line in FIG. 7C, the excess amount integrated value increases in a parabolic shape.

(87) Then, if the vehicle-dynamic safety parameter conditions are OFF as shown in FIG. 7B, the fail-safe instruction signal is output at time tf.sub.OFF when the excess amount integrated value has exceeded an indicator threshold value .sub.OFF at the vehicle-dynamic safety parameter conditions OFF time.

(88) If vehicle-dynamic safety parameter conditions are turned to ON at time t1 after starting the in-excess determination control, the indicator threshold value .sub.OFF will be lowered to a smaller value .sub.ON. As a result, the excess amount integrated value will exceed the indicator threshold value .sub.ON early, and the output timing of the fail-safe instruction signal is brought forward at time tf.sub.ON from time tf.sub.OFF (refer to FIG. 7E). Therefore, the third embodiment achieves the same effect as the above-mentioned embodiments. Moreover, in the third embodiment, time to determine that the drive power is in excess is set/determined according to the time integration value of the drive power excess amount E after exceeding the threshold value . Therefore, the in-excess determination reflects the behavior of the vehicle after the excess of the drive power excess amount E exceeding the threshold value .

(89) In the second and third embodiments described above, the threshold lowered amount may be changed according to the value of the vehicle-dynamic safety parameter, as described with reference to FIGS. 5A/B/C.

(90) Further, the in-excess determination control may be performed based on a combination of the drive power in-excess determination quantities respectively described in the first to third embodiments.

(91) (Other Embodiments)

(92) In FIG. 1, the main calculator 11 in the vehicle controller 10 and the monitor section 12 are illustrated as separate objects. However, as shown in FIG. 8, a function of the monitor section 12 may be included in the main calculator 11. Further, in FIG. 8, without monitoring a solid line that represents the actual drive power transmitted from the actuator 20, only the instructed drive power which is communicated in an inside of the main calculator 11 may be monitored, as described in the above explanation of FIG. 1.

(93) In FIG. 1, the fail-safe instruction signal is illustrated as a direct input from the vehicle controller 10 to the actuator 20. However, other control device(s) may be used to relay such an input. For example, in a hybrid vehicle, a hybrid ECU, which may correspond to the vehicle control apparatus 10, may control the drive of the engine and/or the motor-generator via various drive power source ECUS such as an engine ECU, a motor-generator ECU that respectively control the engine, the motor-generator and the like.

(94) The vehicle-dynamic safety parameter in the present disclosure may reflect any vehicle behavior as long as the vehicle behavior is related to the travel safety of the vehicle. The technical field about the travel safety is a developing field and is expected to further develop. Therefore, even though not explicitly described in the specification of the present disclosure, it is reserved as not excluded from the present disclosure that a technology developed after the filing of the present disclosure in terms of the vehicle-dynamic safety parameters used therein.

(95) Although the present disclosure has been fully described in connection with preferred embodiment thereof with reference to the accompanying drawings, it is to be noted that various changes and modifications will become apparent to those skilled in the art, and such changes, modifications, and summarized schemes are to be understood as being within the scope of the present disclosure as defined by appended claims.