JP4007038B2 - Electronic control device for vehicle - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an electronic control device for a vehicle, and more particularly to a technique for suitably monitoring control output data.
[0002]
[Prior art]
In recent years, the control function of a vehicle electronic control device (vehicle-mounted ECU) tends to become more sophisticated and complicated, and software for realizing the control is also becoming larger. For example, transmission ECUs equipped with a shift control function for automatic transmissions have been proposed to realize complex multiple shift control by direct pressure control of linear solenoids and multi-stages as the transmission structure is improved. The software is designed by an oriented method. In this connection, direct pressure control refers to control in which a shift is performed while controlling the engagement pressure of a friction engagement device in an automatic transmission. Multiple shift control is different from that in which the throttle opening changes during shift control. This refers to a control for making a new shift determination in the middle of the already started shift control when the shift determination is established.
[0003]
[Problems to be solved by the invention]
As described above, the control software is increasing in scale, but there is a demand for shortening the development period. In such a situation, it is conceivable that an item that cannot be completely confirmed in terms of quality, an unexpected operation in terms of specifications, or a microcomputer processing runaway due to RAM destruction or the like may occur. When the microcomputer runs away, a resetting or the like is performed by a known watchdog monitoring function or the like. In this case, the processing of the microcomputer can return to the normal control by operating from the initial state.
[0004]
However, in the transmission ECU, when the shift output data is fixed or an unexpected shift output occurs due to RAM corruption or the like, the watchdog pulse (WD pulse) is output correctly, so that it cannot be expected to return by the monitoring function. . In addition, if abnormalities in RAM corruption are detected, it may be possible to reset the microcomputer. However, in this case, all controls are performed from the initial state, which affects other controls that were operating normally. Will reach. In other words, the contents that have been controlled so far, for example, data such as learning, are all reset, and drivability and other monitoring functions may be adversely affected.
[0005]
The present invention has been made paying attention to the above-described problem, and the object of the present invention is to enable the return to the normal control without affecting other controls when the control output data is abnormal. An electronic control device for a vehicle that can be used is provided.
[0006]
[Means for Solving the Problems]
The electronic control device for a vehicle according to claim 1 calculates control output data related to vehicle travel control, and outputs the control output data to an actuator via an output memory area, and outputs from the control unit And a monitoring unit for monitoring the control output data. In particular, when the monitoring unit determines that the control output data output from the control unit is abnormal, the monitoring unit notifies the control unit that an abnormality has occurred. When the control unit receives the notification of occurrence of abnormality, it first initializes the control output data in the output memory area, and then if the abnormal state continues even after a predetermined time has passed, the control output next Initialization is performed including other memory areas related to data operations . In the present invention, when control output data is abnormal, only the data related to control output data is initialized, so that other normal parts are not initialized. Therefore, it is possible to return to the normal control without affecting other controls.
[0007]
In particular, in the present invention , since the data is initialized stepwise by the control unit , the memory area to be initialized can be specified with the minimum necessary, and the initialization can be optimally performed.
[0008]
According to the second aspect of the present invention, the control unit stops outputting the watchdog pulse if the abnormal state continues even after a predetermined time has elapsed after receiving the notification of the occurrence of the abnormality. As the watchdog pulse output stops, the control unit is reset by the watchdog monitoring circuit. In other words, if the abnormality continues even if the control output data is initialized after the abnormality occurs, it is considered that normal recovery cannot be expected as it is. In such a case, normal recovery by reset is intended.
[0009]
According to a third aspect of the present invention, the monitoring unit calculates control output data or equivalent data separately by the same method as the control unit, and compares the calculated data with the control output data. Judge abnormalities in data. Thereby, abnormality of control output data can be determined easily.
[0010]
In the invention according to claim 4 , since the monitoring unit is configured by the same CPU as the control unit, the monitoring unit can also grasp the state of the map and the control process. Therefore, it is possible to determine the abnormality of the control output data more accurately than in the case of the external monitoring configuration.
[0011]
In the invention according to claim 5, when the control unit receives notification of occurrence of abnormality, the control unit initializes the control output data at that time, and substitutes the alternative data of the control output calculated separately from the output memory area. Output to the actuator via different memory areas. If the control output data in the output memory area is destroyed, substitute data for the control output is separately calculated and output through another memory area as described above, so that vehicle control is interrupted each time. Never happen. Therefore, suitable vehicle control can be continued even when an abnormality occurs.
[0012]
According to the sixth aspect of the present invention, when it is determined that the control output data output from the control unit is abnormal and the state continues for a predetermined time, the control unit performs initial processing regarding the control output data according to the notification of the occurrence of the abnormality. Do. In this case, it is possible to accurately determine the abnormality by determining that the abnormality continues.
[0013]
DETAILED DESCRIPTION OF THE INVENTION
(First embodiment)
Hereinafter, a first embodiment of the present invention will be described with reference to the drawings. In the present embodiment, the present invention is embodied in a vehicle ECU for realizing vehicle travel control. In particular, the ECU includes a shift control function for automatically controlling the shift of an in-vehicle transmission. In the in-vehicle transmission, a plurality of solenoids (actuators) are selectively turned on or off, and the hydraulic path is changed accordingly, and the gear position is automatically switched.
[0014]
FIG. 1 is a configuration diagram showing an outline of the present control system. In FIG. 1, the ECU 10 includes a control microcomputer 11 that forms the center of automatic transmission control, and a monitoring microcomputer 12 that monitors the control microcomputer 11. Each of the microcomputers 11 and 12 includes a well-known logical operation circuit having a CPU, ROM, RAM, and the like. In this embodiment, the control microcomputer 11 corresponds to a “control unit”, and the monitoring microcomputer 12 corresponds to a “monitoring unit”. To do.
[0015]
The control microcomputer 11 includes various control functions such as automatic shift control, electronic throttle control, and cruise control, as well as a failure diagnosis function (diagnostic function), a communication function, and the like. In particular, regarding automatic shift control, the control microcomputer 11 inputs vehicle operation information (sensor detection signal) such as throttle opening and vehicle speed, and uses the shift characteristic map of FIG. To determine the control gear stage (shift gear stage). Then, the solenoid output is determined according to the control shift speed, and the solenoid output is output as S1, S2, and S3, respectively. In this case, the solenoid outputs S <b> 1 to S <b> 3 correspond to “control output data”, and the outputs S <b> 1 to S <b> 3 are output to each solenoid via an output memory area (RAM) (not shown) in the control microcomputer 11. The throttle opening and vehicle speed detection signals are also input to the monitoring microcomputer 12.
[0016]
The monitoring microcomputer 12 has a function of calculating the control shift speed by the same method as the control microcomputer 11, and determines the control shift speed according to the throttle opening and the vehicle speed at that time using the shift characteristic map of FIG. To do. The monitoring microcomputer 12 takes in the solenoid outputs S1 to S3 output from the control microcomputer 11, and monitors the abnormality of the solenoid outputs S1 to S3 as needed. When an abnormality is detected on the control microcomputer 11 side, the monitoring microcomputer 12 outputs an initialization signal to the control microcomputer 11 in order to initialize specific RAM data in the control microcomputer 11.
[0017]
Further, the ECU 10 is provided with a WD circuit 13 as a “watchdog monitoring circuit”. The control microcomputer 11 outputs a WD pulse to the WD circuit 13, and the WD circuit 13 outputs a reset signal to the control microcomputer 11 when the WD pulse from the control microcomputer 11 has not been inverted for a predetermined time or more.
[0018]
Next, the initialization procedure by the control microcomputer 11 and the monitoring procedure by the monitoring microcomputer 12 will be described. Here, FIG. 3 is a flowchart showing an output abnormality determination process by the monitoring microcomputer 12, and FIG. 4 is a flowchart showing a data initialization process by the control microcomputer 11. Each of these processes is executed by the microcomputers 11 and 12 at a predetermined time period (for example, 16 ms period).
[0019]
In FIG. 3, at step 101, the current vehicle speed and throttle opening are read, and at step 102, the control shift speed is calculated from the relationship between these vehicle speed and throttle opening. Thereafter, in step 103, the solenoid outputs S1 to S3 output from the control microcomputer 11 are read, and in the subsequent step 104, the actual shift speed (actual shift speed) is calculated from the read solenoid outputs S1 to S3.
[0020]
Thereafter, in step 105, it is determined whether or not the control shift speed and the actual shift speed match. If the solenoid outputs S1 to S3 are fixed or the outputs S1 to S3 are not intended due to microcomputer abnormality or RAM destruction due to external or internal factors, Step 105 is NO. If step 105 is NO, it is considered that the solenoid output is abnormal, and the process proceeds to step 106. In step 106, an initialization signal for requesting initialization of the solenoid outputs S1 to S3 is output to the control microcomputer 11. On the other hand, if step 105 is YES, it is considered that the solenoid output is normal, and this processing is terminated as it is.
[0021]
On the other hand, in FIG. 4, in step 201, an initialization signal is acquired from the monitoring microcomputer 12, and in the subsequent step 202, it is determined whether or not an initialization request is made based on the initialization signal. If there is an initialization request, the process proceeds to step 203 to initialize the corresponding RAM area for the solenoid outputs S1 to S3. In step 203 described above, only the solenoid outputs S1 to S3 are initialized, and instead of or in addition to this, another RAM area related to the calculation of the solenoid outputs S1 to S3, that is, automatic shift control is used. It may be configured to initialize other calculation data.
[0022]
According to the present embodiment described in detail above, only specific data (solenoid outputs S1 to S3) is initialized when the solenoid outputs S1 to S3 output from the control microcomputer 11 are abnormal. Even the part is never initialized. Therefore, it is possible to quickly return to the normal control without affecting other controls.
[0023]
In the process of FIG. 3 performed by the monitoring microcomputer 12, when the control shift speed is not equal to the actual shift speed and the state continues for a predetermined time (several hundred ms to several seconds), an initialization signal output (step 106) indicating an initialization request is output. It is good also as a structure to implement. Further, the determination that the predetermined time has elapsed may be performed on the control microcomputer 11 side (the process in FIG. 4). In any case, it is preferable that the control microcomputer 11 initializes the solenoid outputs S1 to S3 when the solenoid output abnormality occurs and the state continues for a predetermined time.
[0024]
(Second Embodiment)
Next, a second embodiment of the present invention will be described focusing on the differences from the first embodiment described above. In the present embodiment, the solenoid is driven by the substitute data when the solenoid outputs S1 to S3 are abnormal.
[0025]
FIG. 5 is a flowchart showing the data initialization process in the present embodiment. This process is executed by the control microcomputer 11 in place of FIG. In FIG. 5, in step 301, an initialization signal is acquired from the monitoring microcomputer 12, and in the subsequent step 302, it is determined whether or not an initialization request is made based on the initialization signal. At this time, if the solenoid output is abnormal as described above, an initialization request is made.
[0026]
If there is an initialization request, the alternative data for the control gear is calculated in step 303, and in the subsequent step 304, the alternative data for the control gear is stored in an SRAM (standby RAM) or the like. Thereafter, in step 305, the corresponding RAM area is initialized with respect to the solenoid outputs S1 to S3 at that time. In the subsequent step 306, the substitute data in the SRAM is output as solenoid outputs S1 to S3.
[0027]
Here, the memory area for storing alternative data may be other than the memory area to be initialized in step 305, and may be a RAM area other than the output memory area, an EEPROM, or the like.
[0028]
According to the present embodiment, when the solenoid outputs S1 to S3 become abnormal in the output memory area, the alternative data is separately calculated and output via another memory area. Will not be interrupted. Therefore, a suitable automatic shift control can be continued even when an abnormality occurs.
[0029]
In this case, a configuration that does not cause unnecessary shift control can be realized. For example, when performing multiple shift control, it is possible to prevent control other than the shift control from entering the multiple shift control after resetting at a high gear, and to quickly return to normal control.
[0030]
(Third embodiment)
Next, in the third embodiment, a description will be given of a configuration in which initialization is performed in stages for the solenoid outputs S1 to S3 and related data.
[0031]
FIG. 6 is a flowchart showing the data initialization process in the present embodiment. This process is executed by the control microcomputer 11 in place of FIG. 4 and FIG. In FIG. 6, first, in steps 401 and 402, an initialization signal is acquired from the monitoring microcomputer 12 as described above, and it is determined whether or not an initialization request is made based on the initialization signal. If there is no initialization request, the process proceeds to step 403 and the initialization flag F1 is cleared (F1 = 0).
[0032]
If there is an initialization request, the process proceeds to step 404. Since the initialization flag F1 is initially cleared, the process further proceeds to step 405. In step 405, the corresponding RAM area (output memory area) relating to the solenoid outputs S1 to S3 is initialized, and in the subsequent step 406, an initialization flag F1 is set (F1 = 1).
[0033]
If the set state continues after the initialization flag F1 is set, that is, if the initialization flag F1 is not cleared even if the solenoid output is initialized, the elapse of a predetermined time is waited in step 407. Then, when a predetermined time elapses from the setting of the initialization flag F1, that is, when a predetermined time elapses after the solenoid outputs S1 to S3 are initialized, the process proceeds to step 408, and is related to the calculation of the solenoid outputs S1 to S3. The RAM area including data is initialized.
[0034]
As described above, according to the third embodiment, since the initialization of data is performed in stages, the memory area to be initialized can be specified with the minimum necessary, and the initialization can be optimally performed.
[0035]
(Fourth embodiment)
Next, in the fourth embodiment, a configuration in which the initialization processing of the solenoid outputs S1 to S3 and related data and the reset processing by the WD circuit 13 are combined will be described.
[0036]
FIG. 7 is a flowchart showing the data initialization process in the present embodiment. This process is executed by the control microcomputer 11 in place of the above-described FIGS. In FIG. 7, first, in steps 501 and 502, an initialization signal is obtained from the monitoring microcomputer 12 as described above, and it is determined whether or not an initialization request is made based on the initialization signal. If there is no initialization request, the process proceeds to step 503 to clear the initialization flags F1 and F2 (F1 = 0, F2 = 0).
[0037]
If there is an initialization request, the process proceeds to step 504. Since both initialization flags F1 and F2 are initially cleared, the process further proceeds from step 504 to 505 to 506. In step 506, the corresponding RAM area (output memory area) relating to the solenoid outputs S1 to S3 is initialized, and in the subsequent step 507, an initialization flag F1 is set (F1 = 1).
[0038]
If the set state continues after the initialization flag F1 is set, that is, if the initialization flag F1 is not cleared even if the solenoid output is initialized, the elapse of a predetermined time is waited in step 508. Then, when a predetermined time elapses from the setting of the initialization flag F1, that is, when a predetermined time elapses after the solenoid outputs S1 to S3 are initialized, the process proceeds to step 509, which is related to the calculation of the solenoid outputs S1 to S3. The RAM area including data is initialized. In step 510, an initialization flag F2 is set (F2 = 1).
[0039]
After the initialization flag F2 is set, the elapse of a predetermined time is awaited in step 511. Then, when a predetermined time has elapsed from the setting of the initialization flag F2, the process proceeds to step 512, and the output of the WD pulse is stopped. As the WD output is stopped, the control microcomputer 11 is reset by the WD circuit 13.
[0040]
As described above, according to the fourth embodiment, even if initialization of the solenoid output or the like is performed after the occurrence of an abnormality, the abnormality continues, and if normal recovery cannot be expected as it is, normal recovery by reset can be achieved.
[0041]
In the process of FIG. 7, the configuration (steps 506 and 509) for performing initialization for the solenoid outputs S1 to S3 and related data in a stepwise manner is eliminated, and only one of the initializations is performed and the initialization is performed. Thereafter, the output of the WD pulse may be stopped when a predetermined time has elapsed.
[0042]
In addition to the above, the present invention can be embodied in the following forms.
In the above embodiment, the control unit and the monitoring unit are configured to be realized by individual microcomputers (CPUs). However, the control unit and the monitoring unit are configured to be realized by the same microcomputer (CPU). Also good. In this case, the monitoring unit can also grasp the map and the state of the control process. Therefore, it is possible to determine the abnormality of the solenoid output (control output data) more accurately than in the case of the external monitoring configuration.
[0043]
Further, in the case of monitoring the automatic shift control inside the microcomputer, the configuration using the OS (operating system) can be performed by a task different from the automatic shift control. It is also possible to monitor the lock detection of the task itself for which automatic shift control is being performed. In this case, the map can be shared, and a resource-saving configuration is possible.
[0044]
In the above embodiment, an example in which the output to the solenoid in the automatic shift control is set as “control output data” and the initialization process is performed on the solenoid output has been described. It is also possible to perform the digitization process. For example, in the electronic throttle control, the output to the throttle drive motor can be set as “control output data”, and the initialization process can be performed on the motor output.
[Brief description of the drawings]
FIG. 1 is a configuration diagram showing an outline of a vehicle control system in an embodiment of the invention.
FIG. 2 is a diagram showing a shift characteristic map.
FIG. 3 is a flowchart showing output abnormality determination processing.
FIG. 4 is a flowchart showing data initialization processing.
FIG. 5 is a flowchart showing data initialization processing in the second embodiment.
FIG. 6 is a flowchart showing data initialization processing in the third embodiment.
FIG. 7 is a flowchart showing data initialization processing in the fourth embodiment.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 10 ... ECU, 11 ... Control microcomputer, 12 ... Monitoring microcomputer, 13 ... WD circuit.

Claims (6)

A control unit that calculates control output data related to vehicle travel control and outputs the control output data to an actuator via an output memory area, and a monitoring unit that monitors control output data output from the control unit An electronic control device for a vehicle,
When the monitoring unit determines that the control output data output from the control unit is abnormal, the monitoring unit notifies the control unit that an abnormality has occurred , and when the control unit receives the notification of the occurrence of the abnormality, first the output memory Initialize the control output data in the area, and then initialize it including the other memory area related to the calculation of the control output data if the abnormal state continues even after the predetermined time elapses An electronic control device for a vehicle. A watchdog pulse that is inverted at a predetermined period is input from the control unit, and includes a watchdog monitoring circuit that resets the control unit when the periodicity is lost. The vehicular electronic control device according to claim 1, wherein if the abnormal state continues even after a predetermined time has elapsed, the output of the watch dog pulse is stopped. The monitoring unit calculates control output data or equivalent data separately by the same method as the control unit, and determines abnormality in the control output data of the control unit by comparing with the calculated data. Or the electronic control apparatus for vehicles of 2. The vehicular electronic control device according to any one of claims 1 to 3, wherein the monitoring unit is configured by the same CPU as the control unit. When the controller receives a notification of the occurrence of an abnormality, it initializes the control output data at that time, and outputs alternative data for the separately calculated control output to the actuator via a memory area different from the output memory area The vehicle electronic control device according to any one of claims 1 to 4. 6. The control unit according to claim 1, wherein when the control output data output from the control unit is determined to be abnormal and the state continues for a predetermined time, the control unit initializes the control output data according to the notification of the occurrence of the abnormality. The vehicle electronic control device according to any one of the above.

Images