DE19947025A1 - Motor vehicle drive system control method involves engaging safety measure if demand to produce control state is generated and transition cannot take place - Google Patents

Abstract

The method involves generating a control demand for an automated coupling arrangement or/and an automated gearbox arrangement based on information representing the vehicle operating state to bring it into or hold it in a control state, checking whether a transition of the coupling and/or gearbox is possible to the control state and engaging a safety measure if a demand to produce the control state is generated and the transition cannot take place.

Description

The present invention relates to a method for driving a Drive system of a vehicle, which drive system an automati based coupling arrangement and / or an automated transmission arrangement as well as a control device for controlling the automated Coupling arrangement and / or the automated transmission arrangement according to an operating state of the vehicle.

With such procedures for controlling various com components or assemblies of a drive system based on the current operating state of a vehicle receives the Control device from various sensor inputs Information about the operating state of a vehicle information is determined based on such sensor inputs or parts of information that know the current operating status to draw. Control measures are then taken based on this information men triggered, for example to perform gearshifts or disengaging and engaging the clutch.

In order to control the gearbox or clutch incorrectly avoid, are different over in such drive systems monitoring mechanisms for monitoring the sensors or provided by actuator arrangement, which in the transmission or generate the movement processes in the clutch.

It is the object of the present invention to provide a method for driving to provide a drive system of a vehicle, which for this purpose in the  Is able to take security against an operating state to further increase unsuitable control measures.

According to the present invention, this object is achieved by a method for controlling a drive system of a vehicle, which drive system comprises an automated clutch arrangement and / or an automated transmission arrangement and a control device for controlling the automated clutch arrangement or / and the automated transmission arrangement in accordance with an operating state of the vehicle, the method comprising the following measures:

• a) based on the operating state of the vehicle Information, generation of a control target for the automated Clutch arrangement and / or the automated transmission arrangement, in order to bring them into a control state or to keep them in this position,
• b) based on the operating state of the vehicle Information, check whether a transition and / or one of the To tax specification corresponding type of transition from automated Coupling arrangement and / or the automated transmission order in a control state is permissible,
• c) if, according to measure a), a control target for receipt of the control state is generated and in accordance with measure b) Transition or / and a type of control corresponding to the control specification Transition to this position is not permitted, take one Security measure.

In addition to the surveillance aspect discussed above of the various sensors or the sensor inputs or the actuating movement of various actuator arrangements the present invention provides a certainty that before Management or implementation of a control measure this control measure name is checked. Errors in the generation of the  Control measure, for example calculation errors in a processor, be recognized and avoided that a possibly wrong one Control measure the vehicle in a safety-critical situation brings.

To further increase security with the procedure according to the invention increase, it is proposed that the action to be taken in accordance with measure c) Safety measure the bringing or holding of the to be controlled Arrangement in a / for the operating state of the vehicle critical position.

It can be provided, for example, that when the automated clutch arrangement an uncritical control state indented or substantially indented actuating state of the same, when the operating state of the vehicle is a state in which a Drive unit is not running, and / or a disengaged or in essence Chen disengaged control state is when the operating state of the vehicle is a state in which the drive unit is running, and / or an Condition with limited positioning speed is when the vehicle is running and the clutch arrangement is adjusted in the direction of the engagement position.

It can also be provided that when automated Gear arrangement an uncritical control state a neutral position Gear arrangement or a switching state with the at or before generation the drive specification is in gear when the operating state of the vehicle is a state in which the vehicle is in motion, or / and a switching state with the before or before generation of the control The gear is in use when the operating state of the vehicle is a state in which the vehicle is not substantially in Is movement.  

To prevent the recurrence of a condition in which the system is due to the implementation of a program for generating the control target problems occurring repeatedly in a safety-critical state could occur, it is proposed that the steps c) Security measure to be taken for a specified number Query cycles or / and a predetermined period of time is retained. Furthermore, a high security against a repeated attempt in to enter a potentially critical situation that the security measure to be taken in step c) is as long as is retained until, according to measure a), the control target for Obtaining the respective control status is generated and according to measure b) the transition and / or the type of control corresponding to the control specification Transition to the respective control status is permitted. In particular it is. advantageous here if the security measure to be taken in step c) for a predetermined number of query cycles and / or a predetermined one The duration remains unchanged, if not previously according to measure b) Transition or / and the type of control corresponding to the control specification Transition to the respective control status is permitted.

To the computing or processing effort in one Processor as low as possible when generating control specifications it is proposed that measure b) and / or the Measure c) is only taken when the execution of the control default leads to a safety-critical state. That is, it is Situation in which the vehicle after execution or implementation of a Control can reach, no danger to the safety of the vehicle end or various components that may be damaging Situation, so this can generally be accepted as the driver after entering this new state can recognize the error and by itself can take countermeasures, if not a new one already run a program to generate the control target leads to the correct result.  

For example, can be provided in the method according to the invention be that the automated clutch arrangement to be controlled Measure b) or / and measure c) is taken if the Execution of the control specification can lead to starting the vehicle or / and the execution of the control specification when the vehicle is stationary can lead to an unbraked state of the same, or / and the Execution of the control specification after the slip state has ended negative drive wheel slip back to such a slip state can lead.

It is also possible that when automated transmissions are to be controlled regulation measure b) and / or measure c) is taken if the execution of the control requirement after a change of direction can pull, and / or the execution of the control specification to one Turning up a drive unit can lead and / or the execution the control specification when the vehicle is at a standstill State of the same.

The present invention will hereinafter be described with reference to the accompanying Drawings in detail based on preferred embodiments described. Show it:

Fig. 1 is a schematic view of a drive system in wel the procedure of the invention can be used chem;

Fig. 2-7 respectively to the sequence of the method according to the invention in different driving situations, in which Figs 2-4 show. By carrying out the method according to the invention in conjunction with an automated clutch arrangement, and Figs. 5-7, the process of the invention in conjunction with show an automated transmission arrangement.

First, a drive system is generally described with reference to FIG. 1, in which the safety concept according to the invention can be used in the generation or implementation of control measures. The drive system 10 comprises a drive unit 12 , for example an internal combustion engine 12 , which is connected via a drive shaft 14 to an input side 16 of an automated clutch arrangement 20 , for example a friction clutch. An output side 22 of the clutch arrangement 20 is in drive connection with an automated transmission arrangement 26 via a transmission input shaft 24 . Its output shaft 28 drives wheels 32 , 34 via a differential 30 . The drive unit 12 , the clutch arrangement 20 and the transmission arrangement 26 are under the control of a control device 36 . This control device 36 is in data exchange with a power control arrangement 38 of the drive unit in order to control or regulate the power output or the speed of the drive unit 12 by supplying control signals or commands to the power control arrangement 38 . It should be noted that the power control arrangement 38 includes any area of a drive unit in which an influence on its speed or power output can be exerted, for example the injection system, the throttle system, the ignition system, the cam system, etc. Of course, the power control arrangement 38 provides information to the Control device 36 , which denotes the power control state of the drive unit 12 .

Furthermore, the control device 36 is connected to an actuator arrangement 40 of the automated clutch arrangement 20 in order to adjust the clutch arrangement 20 between an engaged and a disengaged clutch position by supplying corresponding actuating signals. Actuator arrangement 40 can also supply information to control device 36 , which designates the current actuating state of the clutch arrangement.

Furthermore, the control device 36 supplies control signals to an actuator arrangement 42 of the transmission arrangement 26 . These control signals lead to switching operations within the gearbox arrangement 26 . Here too, the control device 36 is again supplied with information which denotes the current actuating state of the gear arrangement 26 . The control device 36 also receives information I from various sensors, based on which information the control device 36 can determine the overall operating state of the vehicle. For example, a speed sensor 44 is provided which detects the speed of the drive shaft 14 . It should be pointed out that, as far as the detection of the rotational speed is concerned, this naturally also includes the detection of any information characterizing the rotational speed, which is then processed, for example, in the control device 36 for actually determining the rotational speed per se. Furthermore, a speed sensor 46 is provided, which detects the speed of the transmission input shaft 24 , and a speed sensor 48 , which detects the speed of the transmission output shaft 28 . Furthermore, speed sensors 50 , 52 are provided, which detect the speed of the driven wheels 32 , 34 or of these driving shafts 54 , 56 . The vehicle speed can be calculated based on these two sensor outputs or based on the output of the speed sensor 48 ; ie these sensor outputs from sensors 48 , 50 , 52 contain information about the vehicle speed.

Furthermore, a switching sensor 58 is provided, which detects an actuation of a switching lever 60 and provides corresponding information I for the Ansteuervor direction 36 . Based on this information, recognizes the driving device 36, which shift will carry a driver, and then generates the appropriate time and, if appropriate taking into account the further the driving state information representing an appropriate drive command for the transmission assembly 26th It should be noted that instead of detecting the shift lever actuation, the switching operation can also be carried out in the manner of an automatic transmission based on the driving situation.

In the drive system 10 , an accelerator or accelerator pedal 62 is also provided with an associated accelerator pedal sensor 64 , the output signal of which represents the extent of actuation of the accelerator pedal. A brake pedal 66 is also provided, to which a sensor 68 is also assigned. The output signal of this brake pedal sensor 68 represents the actuation amount of the brake pedal 66 .

Based on all of these sensor inputs and possibly further sensor inputs, for example from an ambient temperature sensor, a coolant temperature sensor, a yaw motion sensor and the like, the control device 36 generates various control commands or control specifications, which then occur in the various units or components to be controlled, i.e. the power control arrangement 38 , the actuator arrangement 40 and the actuator arrangement 42 can be implemented, ie lead to steep operations in the drive unit 12 , in the clutch arrangement 20 or in the transmission arrangement 26 . These control specifications are determined in the control device 36 in a processor in which a corresponding control program runs, which receives the various sensor inputs I as input and which generates a control specification as an output, which either as a control command goes directly to the various setting ranges 38 , 40 , 42 is passed, or which is subsequently converted into a respective control command in the control device 36 and only then directed to the control areas.

However, a situation can occur in which, despite correctly functioning sensors and systems to be controlled correctly, when performing the calculation or determination process to obtain the control specifications in the processor, a calculation error occurs, for example due to access to an incorrect value, so that a generated control specification can lead to the implementation of a control measure which is not suitable for the current driving situation or which in principle bears the risk that a vehicle with such a drive system 10 will get into a safety-critical situation or into a situation in which the damage to various components of the system cannot be excluded. In order to counter this danger, it is provided according to the invention that at least in a few driving situations, which are explained in more detail below, it is determined whether starting from a driving situation that is currently present or a current operating state of the vehicle, an entry into an operating state that would be generated by executing a control specification, is permissible. For this purpose, essentially two procedures are initially carried out in the control device 36 . A procedure referred to below as level 1 is used to generate a control specification in a normal manner based on various parameters or inputs of sensors representing the driving situation. The other procedure, hereinafter referred to as level 2 , is used to check whether, based on the current situation, a transition to another driving situation, as would occur by executing the control specification, is permissible. A comparison is then carried out, namely that on the one hand it is stated that level 1 has generated a specific control requirement and on the other hand that there is a check result in level 2 which either decides in the same direction as level 1 or not . If there is a discrepancy between Level 1 and Level 2 , this is an indication that at least one of the two procedures has resulted in incorrect program execution, incorrect calculation or the like, although it is initially not clear whether the error is in Level 1 or is in level 2 . It is therefore decided in such a situation that the system is brought into an uncritical state or is kept so that potentially critical situations cannot occur.

Level 1 and Level 2 can be supplied with the same sensor inputs to obtain their results, ie both levels can use the same information that characterizes the driving situation to determine how they would react based on the current situation. The determination processes carried out in the two levels can differ from one another, so that increased security is provided against the fact that the same calculation error occurs in both levels, with the result that both levels could decide in the same direction again and an error was therefore not recognized could be. Furthermore, it is possible for the two levels to be provided with different information, with each level then using various determination processes to identify the driving situation and decide which action to take. For example, to determine the driving situation when information about the vehicle speed is required, the output of the sensor 48 could be made available to one of the two levels, and based on this output, this level can then be taken into account by taking into account the wheel diameter of the transmission ratio in the differential, etc. Calculate vehicle speed. The other of the two levels could be supplied with the sensor output from at least one of the sensors 50 , 52 for determining the vehicle speed, or also the sensor output from the sensor 46 and the sensor 44 as well as further information relating to the transmission ratio of a currently engaged gear stage of the transmission arrangement 26 represents. This also allows conclusions to be drawn about the speed of the transmission output shaft 28 and, if appropriate, taking into account the wheel diameter of the vehicle speed. This means that on the basis of different information and with algorithms then adapted to the respective information, both levels would have to come to the same driving speed, and if a control measure were only to be taken as a function of the driving speed, level 1 would have to generate a control specification representing the measure and Level 2 should confirm that the implementation of this measure is permitted. If there is a discrepancy, a calculation error has occurred in one of the levels, as already stated, and care must be taken to ensure that a critical situation that may have been created by carrying out the control measure cannot occur.

The implementation of the two procedures for determining a control specification on the one hand and for determining whether it is permissible to take a specific control measure based on the current driving situation can be carried out in different time stages. In an advantageous embodiment, the procedure is such that it is first determined in level 1 based on the current driving situation whether and which control measures are to be taken. If it is then determined that these are measures that could lead to potentially critical driving situations, level 2 is activated, i.e. only then does level 2 begin to evaluate the driving situation based on the information made available to it, in order to decide whether the situation is ultimately control measure or control specification determined in level 1 can be taken. If level 2 comes to the decision that the control specification may not be implemented, it is concluded that there is an error situation and a safety measure, which will be explained below, is initiated. Nevertheless, it is possible that at the same time or before carrying out Level 1, Level 2 uses the information provided to determine whether different control measures could be implemented based on the current driving situation or which control measures they are. If a control specification is then generated in level 1 , this can then be compared with an already created list of permissible control specifications from level 2 . If this list contains the control specification provided by Level 1 , then correct calculations are made and the control specification implemented. If not, then an error situation is concluded again so that security measures are taken. It should be pointed out that the two procedures of the method according to the invention can run in different processors, for example a main processor and a monitoring processor, which are connected to one another, for example, via a serial interface.

The method according to the invention is described in detail below on the basis of various driving situations. Thus, FIG. 2 shows the implementation of the method according to the invention in a starting situation of the vehicle. That is, it is first checked in a step S1 whether the vehicle is already running or is still standing. If it is decided that the vehicle is running, the processing proceeds to a step S2, in which a count value "debouncing" is counted down step by step, and then comes to the end or a new execution of the program. If it is decided in step S1 that the vehicle is not running, then in a step S3 it is checked whether, based on the information characterizing the driving situation made available to it, level 1 has decided that the clutch should be closed, that is, generates a control specification has that would lead to the clutch closing. If this is not the case, a potentially critical situation cannot occur because the clutch should not be closed when the vehicle is at level 1 . The processing then goes back to the end via step S2. If it has been determined in step S3 that level 1 has generated a control specification for closing the clutch, then level 2 is activated or checked in step S4 whether, according to level 2, the current situation is a situation which allows starting. For this purpose it can be checked in level 2 , for example, whether the engine, ie the drive unit 12 , is running, the accelerator pedal is actuated, the transmission is shifted, ie a gear is engaged or is in synchronization, and whether this gear is a starting gear. All of these questions asked in level 2 can be answered based on the various sensor outputs that are made available to level 2 . Level 2 then receives, for example, information about the vehicle speed, for example from the sensors 48 , 50 or 52 , information about the engine speed, for example from the sensor 44 , information about the accelerator pedal position from the sensor 64 , information about the transmission status by data exchange with the actuator arrangement 42 , Information about the gear engaged, also by data exchange with the actuator arrangement 42 , and possibly information about the current clutch position. This or at least part of this information is of course available at level 1 for determining the control specification, but, as already explained above, various information for determining the vehicle speed or engine speed etc. is provided in level 1 and level 2, for example or be used in it.

If level 2 now decides that the conditions permitting the start-up are all fulfilled, then step S2 goes back to the end of the processing. However, if Level 2 comes to the conclusion that the situation is not such that starting off is permitted, for example because, in Level 2's view, the "starting gear engaged" condition is not met, a situation arises in which Level 1 and Level 2 Decide in different directions, although if the calculation was carried out correctly both should have come to the same result. It is then proceeded to a step S5 in which a safety measure is taken which ensures that entry into the potentially safety-critical driving situation starting cannot occur. In this driving situation, in which the vehicle is standing, but the drive unit may be running, the safety measure is predetermined in that the clutch arrangement is brought into a disengaged position, so that no torque can be transmitted via the drive train.

After step S5 has been carried out, the debounce count is incremented in step S6 and a check is made in step S7 to determine whether the debounce count is greater than a "THRESHOLD" threshold. If the debouncing count value is not greater than the threshold value, the processing proceeds to the end or is repeated. Since the procedure shown in FIG. 2 is carried out with a given clocking, for example every 10 ms, if the error situation persists per working cycle, that is to say every 10 ms, the debouncing count is counted up so that it starts, for example, from a value from zero, after a predetermined number of working cycles and thus also after a predetermined time will reach the threshold value THRESHOLD. If a normal situation occurs before the threshold value is reached, ie a situation in which both levels decide in the same direction, the counting up of the debouncing count is ended and the debouncing count is reduced again by a decrement. In other words, if the normal situation lasts longer, the debounce count value is removed from the threshold and brought back to an initial value, for example from zero. During this time, the control specification determined in level 1 is actually implemented, ie the safety measure taken in step S5 is canceled.

If, however, the threshold value THRESHOLD is exceeded in step S7 due to a prolonged stopping of the error situation, then a transition is made to step S8, in which the software is reset, ie the programs representing or executing levels 1 and 2 are restarted in order to possibly be incorrect delete stored storage values and thus establish a defined start state. While the reset is being carried out, the safety measure is retained in step S5, but here the maintenance of this safety measure is independent of the main processor, that is to say also independent of level 1 , by appropriately controlling various hardware components, for example by energizing a valve, based on minimal information, such as, for example, B. the engine speed. For example, it can be provided that the reset is carried out in step S8 if, in the case of a gradual increase or decrease by a value of 1 in each case, starting from an initial value of zero, the count value debouncing exceeds the number 7 .

It can be seen in FIG. 2 that level 2 is only activated here if the control specification according to level 1 can actually lead to a critical situation. In this way, the computation effort can be kept low, since the check from level 2 to the process given in level 1 can be specified. In principle, however, it would also be conceivable, as already stated, to let Level 2 run at the same time or before determining the control specification in Level 1 , and only if Level 1 would command a transition to a potentially critical situation, a comparison between the Perform calculation results from Level 1 and Level 2 .

Furthermore, it should also be pointed out that when checking in level 2 , in the present case of FIG. 2 it is irrelevant in what way level 1 wants to close the clutch, ie at what actuating speed. The only decisive factor is that a critical situation cannot occur when the clutch is engaged if the driving situation of the vehicle does not allow this.

In Fig. 3 a situation is shown, in which again checked in a step S9, whether the vehicle is moving or stopped. If the vehicle is not standing, ie if it is moving, the debouncing count value is counted down again in step S10 and then the end of the procedure is reached. If, however, it is determined in step S9 that the vehicle is stationary, it is checked in step 511 whether the control specification of level 1 determined on the basis of the driving situation means that the clutch is opened. If this is not the case, no potentially critical situation can arise and the end is reached again via step S10. However, if level 1 wants to open the clutch, step S12 checks again whether level 2 also allows the clutch to be opened in this way. For this purpose, it is checked whether, according to Level 2, the holding conditions, ie the conditions for keeping the clutch closed, are fulfilled. For this purpose, level 2 can again determine, based on the vehicle speed, the brake actuation, the actual clutch position, a desired clutch position, the transmission status and the speed of the drive unit, whether the brake is ultimately actuated, whether the clutch is closed, whether there is a gear in the transmission and whether the engine is off. If, for example, level 2 determines that no brake is applied, the clutch is closed, a gear is engaged in the transmission and the drive unit is not running, the result is that opening the clutch is not permitted, ie the clutch is kept closed must, because the vehicle could roll away due to a lack of brake application. A safety measure is therefore then taken in step S13, namely the clutch arrangement 20 is brought into an engagement position so that the braking torque of the non-running drive unit can be used. The debouncing count is then counted up again in step S14, and this count is then compared again with the threshold value THRESHOLD in step S15. If the count value has not yet exceeded the threshold, the process ends again. If the debouncing count value has exceeded the threshold, the software is reset again in step S16.

It can be seen here that when the vehicle is stationary, the safety measure with regard to actuating the clutch means placing or holding the clutch in an engagement position, since this ensures that the vehicle cannot roll away in an undesired manner, provided that a gear is in motion is inserted. If level 2 in step S12 comes to the result that the or a part of the conditions that require holding by the clutch is not fulfilled, ie the brake is actuated, for example, then step S10 ends again, because then Opening the clutch is permitted or keeping the clutch closed does not increase safety. The rolling away of the vehicle is then z. B. prevented by brake actuation.

In the procedure shown in FIG. 4, it is determined at the beginning in a step S17 whether a wheel break has occurred in at least one of the driven wheels 32 , 34 in a previous driving situation and has already been remedied. A wheel breakdown is a situation in which, for example, a negative wheel slip occurs in a driven wheel 32 or / and 34 due to a spontaneous release of the accelerator pedal or when engaging after performing a downshift by the engine braking torque generated. Such a wheel break can be resolved, for example, by disengaging the clutch and thus reducing the engine braking torque. When this is done, a voltage for setting the Ansteuervorgabe is Kupplungsanord generated in the direction of engagement position in Level 1 in a step S18.

In step S19, level 2 determines a maximum infeed speed, ie a maximum closing speed of the clutch arrangement 20 . This maximum delivery speed is set as a threshold value, and it is checked in step S24 whether the delivery speed determined in step S18 in level 1 exceeds this maximum delivery speed level 2 . If this is the case, the delivery speed is then limited to the maximum delivery speed determined in level 2 in a step S20 and the debouncing count is subsequently counted up again in step S21. If this has exceeded the assigned threshold when queried in step S22, the software is reset again in step S23. If this has not been exceeded, the procedure is ended or restarted according to the work cycle. If the delivery speed determined by level 1 has not exceeded the maximum delivery speed of level 2 in step S24, the debounce count value is counted down again in step S25 and the procedure is then ended or the control specification implemented.

In this procedure, which is carried out during a driving situation, the safety measure now consists in limiting the actuating speed of the clutch, so that a wheel break caused by the clutch being coupled in too quickly cannot occur again. For this purpose, level 2 and / or level 1, for example, can be provided with information which describes the coefficient of friction of a road surface. Furthermore, in this driving situation, relevant variables are those variables which recognize the wheel break, for example a comparison of the outputs from sensors 50 , 52 with a comparison of corresponding information from non-driven wheels. Also of importance is the desired clutch position, ie the position in which the clutch is to be brought, and the vehicle speed and the gear selected, since this is an essential factor in the strength of the engine braking torque generated.

FIG. 5 shows a situation in which now with regard to the gear assembly 26, under certain circumstances, safety measures are taken. In Fig. 5 there is shown a situation in which a commanded by Level 1 downshift to a lower gear ratio may possibly cause a critical situation. It is therefore asked in a step S26 whether level 1 commands such a downshifting based on the information available to it. If not, the desired gear, ie a higher gear, is set as the target gear to be engaged in step S27 and the debouncing count is then counted down in step S28 before the procedure or this working cycle is ended. If step S26 recognizes that level 1 commands a downshift, then in a step S29, which is already to be assigned to level 2 , a target rotational speed, which will result after performing the reverse shift on the transmission input side, ie on the transmission input shaft 24 , is based on the Engine speed, ie the speed of the drive shaft 14 detected by the sensor 14 is calculated. In a step S30, the expected target speed of the transmission input shaft 24 is then determined based on the transmission output shaft speed and taking into account the gear step to be taken, and in a step S31 is based on the vehicle speed, for example based on the sensor outputs of the sensors 50 and 52 , The target speed of the transmission input shaft 24 is determined. In a step S32, the maximum value of these three target speeds is taken in order to ultimately achieve the greatest possible security. In step S33, a speed is then also determined in level 2 , ie a speed which the speed at the transmission input shaft 24 must not exceed after the switching operation has been carried out. This maximum speed threshold can either be set as a predefined variable or determined as a function of the driving state, for example also as a function of the current speed of the drive unit 12 . If it is recognized in step S34 that the maximum target speed is greater than this speed threshold, the currently selected gear is set as the target gear in a step S35 as a safety measure, so that ultimately the reverse shifting process is prevented and the transmission remains in its current status. It can thus be avoided that when the clutch arrangement 20 is subsequently engaged, the drive assembly 12 turns up in a speed range which may damage it. The debouncing count is then counted up again in step S36, and it is checked in step S37 whether the threshold for the debouncing count has already been exceeded. If not, the end is reached if the threshold has already been exceeded, then the software reset is carried out again in step S38.

If it was recognized in step S34 that the maximum target speed determined in level 2 is not above the speed threshold, then the desired gear can be set again as the target gear, in this case a lower gear (step S27), followed by debouncing in step after the count value has been counted down S28 the procedure is ended again.

As already mentioned, the speed threshold can be fixed in this case specified value can be set, but this is for different Can distinguish types of drive units. In operating condition Depending on the determination of the speed threshold, this can be done, for example Taking into account an output of a longitudinal acceleration sensor or also a lateral acceleration sensor to prevent that for example when cornering due to a too strong onset Engine braking effect an excessive braking of the vehicle is produced.

FIG. 6 shows a situation in which it is determined in a step S39 whether a shift operation commanded by level 1 would result in a change of direction, ie whether, for example, from a first gear to a reverse gear or from a reverse gear to a first gear to be switched. If this is not the case, the desired gear commanded by level 1 can be set as the target gear in step S40. Subsequently, after the counting value debouncing has been counted down, the procedure or the working cycle is ended in a step S41. However, if level 1 would command a change in direction of travel, ie a commanded switching process would result in a change of direction of travel, a check is carried out in a step S42 to determine whether level 2 would agree to this. If level 2 would also allow the direction of travel to change based on the input variables engine speed, actual gear position, gear lever position or actuation, vehicle speed, target speed, target gear and actual gear, this can ultimately be done in step S40. Detects Level 2, however, in step S42, that such a change of direction is not allowed, for example because Level 2 recognizes that the operating element is moved in the other direction, it is checked in a step S43 whether the vehicle is running or not. If the vehicle is not moving, the currently selected gear is specified as the target gear as a safety measure in step S44 and the debouncing count is then counted up in step S45. If it is recognized in step S43 that the vehicle is traveling, then in step S46 a neutral position of the transmission is specified as the target gear and subsequently the counter value debouncing is again counted up in step S45. You can see here that depending on whether the vehicle is driving or not, different safety measures are taken. When the vehicle is not moving, the greatest safety can be obtained by maintaining the gear engaged, so that the vehicle can also be prevented from rolling away unintentionally. When the vehicle is moving, the greatest possible safety can be achieved by the neutral position of the transmission, since it is initially not clear which of the levels made an incorrect decision, and it is therefore also not clear which control measure would ultimately be the right one.

Here, too, it is checked again in a step S47 whether the count value Debouncing has already exceeded the assigned threshold. Unless, then the work cycle is ended, if so, then in one step S48 software reset performed again.

FIG. 7 shows a situation in which incorrect control of the gear arrangement 26 could lead to the vehicle rolling away undesirably. In a step S49, it is first checked whether the vehicle is actually stationary. If this is not the case, the debouncing count value is counted down in a step S50 and the procedure is ended. If the vehicle is stationary, it is checked in step S51 whether a shift command to obtain a neutral shift position should be carried out in accordance with level 1 . If not, a potentially critical situation cannot occur and processing goes to step S50. If level 1 wants to switch to the neutral position, it is checked in a step S52 whether, in the view of level 2, conditions for maintaining a non-neutral switching position are fulfilled, ie the vehicle is to be kept at a standstill by the engine braking effect. For this purpose, Level 2 can, for example, determine whether the current driving situation is a situation in which, for example, due to a lack of brake actuation, based on the input variables speed of the drive unit, vehicle speed, brake actuation, status of the transmission order, gear position, clutch position and gear position to be engaged other measures must be taken to ensure that the vehicle is held by the drive unit. If, for example, level 2 recognizes that the brake is not actuated, but the clutch is closed and a gear is engaged and the drive unit 12 is not running, it recognizes that this is a situation in which the vehicle is caused by the engine braking effect must and can be held, and thus decides that the holding conditions are met. In a step S53, the gear shifting operation commanded in level 1 is therefore prevented or terminated as a safety measure, and in a step S54, the debouncing count is subsequently counted up again. If it has already exceeded the threshold value THRESHOLD in step S55, a software reset is triggered again in step S56 and the procedure is then ended. If the threshold THRESHOLD has not yet been reached, a software reset is not yet carried out.

The preceding illustration of various driving situations in which a check of a commanded control setting can lead to significantly increased safety in operation shows that, depending on the operating state of a system or vehicle, various measures can be taken to then if a discrepancy arises between the command level and the review level to prevent the entry into a potentially critical situation. This occurrence in potentially critical situations can arise, for example, with regard to clutch control

• - Starting by closing the clutch assembly 20 while the drive unit 12 is running (safety measure: disengaging or holding the clutch assembly 20 out )
• - from rolling when the vehicle by disengaging the clutch assembly 20 (Safety: engagement or nonengagement hold the clutch assembly 20)
• - Too fast engagement after wheel break and thus destabilizing the Vehicle (safety measure: limitation of the engagement speed severity).

When controlling the gearbox, potentially critical situations can occur

• - Changing the direction of travel by performing a corresponding switching operation (safety measure: when the vehicle is moving, disengaging or holding out the clutch arrangement 20 or putting the transmission arrangement into a neutral position, when the vehicle is stationary, maintaining an engaged gear stage)
• - Downshift with the consequence of too high transmission input shafts speed (safety measure: preventing the downshift gangs and maintaining the selected gear)
• - Rolling away by laying out a gear step with the vehicle stationary (Safety measure: keeping the gear selected).

In other driving situations in which the implementation or implementation a control target does not enter a potentially critical situation can entail, of course, the invention Surveillance by a second level is also taking place, however not absolutely necessary for safety reasons.  

Furthermore, it should be pointed out that, for example, in situations in which several states or conditions are checked for existence in level 2 , the method according to the invention can also be designed in such a way that the security measure is actually only taken if on the one hand between level 1 and Level 2 there is a discrepancy, and on the other hand, taking the security measure ultimately also increases the overall security of the system. If, for example, in the case in which level 1 commands the clutch to disengage when the drive unit is stationary, it is determined in level 2 that no gear is engaged at all and the gear arrangement is in a neutral position, so it is ultimately against the safety of the system It does not matter whether the clutch is engaged or disengaged, as an engine braking effect cannot be used. In this case, level 2 can release the execution of the control specification, since the existence of a condition which would ultimately be necessary to achieve a higher level of safety has not been realized.

In the various operating situations described above the mentioned counter values or threshold values do not have to be necessary wise be the same. Rather, for any condition in which the Procedure according to the invention can be used, a separate one Value for the count value and / or the threshold value can be set.

Claims (10)

1. A method for controlling a drive system of a vehicle, which drive system ( 10 ) an automated clutch arrangement ( 20 ) and / and an automated transmission arrangement ( 26 ) and a control device ( 36 ) for controlling the automated clutch arrangement ( 20 ) and / or automated transmission arrangement ( 26 ) according to an operating state of the vehicle, the method comprising the following measures:

• a) based on the operating state of the vehicle, representing information, generating a control target for the automated clutch arrangement ( 20 ) and / or the automated transmission arrangement ( 26 ) in order to bring this into an actuating state or to adhere to it,
• b) based on the operating state of the vehicle, representing information, checking whether a transition and / or a type of transition corresponding to the control specification of the transition of the automated clutch arrangement ( 20 ) and / or the automated transmission arrangement ( 26 ) into an actuating state is permissible,
• c) if, in accordance with measure a), a control requirement for maintaining the control state is generated and in accordance with measure b) a transition or / and a type of transition corresponding to the control requirement into this control state is not permitted, take a safety measure.

2. The method according to claim 1, characterized in that the safety measure to be taken according to measure c) comprises bringing or holding the controlled arrangement ( 20 , 26 ) in a / a non-critical operating state of the vehicle. 3. The method according to claim 2, characterized in that in the case of an automated clutch arrangement ( 20 ) to be controlled, an uncritical actuating state is an engaged or essentially engaged actuating state thereof, if the operating state of the vehicle is a state in which a drive unit ( 12 ) is not running , or / and a disengaged or substantially disengaged actuating state when the operating state of the vehicle is a state in which the drive unit ( 12 ) is running, and / or is a state with a limited actuating speed when the vehicle is running and the Coupling arrangement ( 20 ) is adjusted in the direction of the engagement position. 4. The method according to claim 2 or 3, characterized in that when the automated transmission arrangement ( 26 ) is to be controlled, a non-critical control state is a neutral position of the transmission arrangement ( 26 ) or a switching state with the gear stage engaged when or before generation of the control specification, if the operating state of the Vehicle is a state in which the vehicle is in motion, and / or is a gearshift state with the gear selected at or before generation of the control target, if the operating state of the vehicle is a state in which the vehicle is essentially not in motion. 5. The method according to any one of claims 1 to 4, characterized in that the one to be taken in step c) Security measure for a specified number of query cycles or / and a predetermined period of time is retained.   6. The method according to any one of claims 1 to 5, characterized in that the one to be taken in step c) The security measure is maintained until according to Measure a) the control specification for obtaining the respective Control state is generated and according to measure b) the transition or / and the type of transition corresponding to the control specification is permissible in the respective control status. 7. The method according to claim 5 or 6, characterized in that the one to be taken in step c) Security measure for a specified number of query cycles or / and a predetermined period of time is retained if not beforehand according to measure b) the transition and / or the control corresponding type of transition in the respective Control state is permissible. 8. The method according to any one of claims 1 to 7, characterized in that the measure b) and / or the Measure c) is only taken if the execution of the Control specification leads to a safety-critical state. 9. The method according to any one of claims 1 to 8, characterized in that in the case of an automated clutch arrangement ( 20 ) to be controlled, measure b) and / or measure c) is taken when

• - the execution of the control specification can lead to the vehicle being started or / and
• - the execution of the control specification when the vehicle is at a standstill can lead to the same being in an unbraked state, or / and
• - The execution of the control specification after the end of the slip state with negative drive wheel slip can again lead to such a slip state.

10. The method according to any one of claims 1 to 9, characterized in that in the automated transmission arrangement ( 26 ) to be controlled, measure b) and / or measure c) is taken when

• - The execution of the control specification can result in a change of direction, or / and
• - the execution of the control specification can lead to a drive unit turning up, or / and
• - the execution of the control specification when the vehicle is at a standstill can lead to the same being in an unbraked state.