JP2003294129A - Electronic control device for vehicle - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To restore normal control without having effects on other control when control output data have abnormality. <P>SOLUTION: An ECU 10 is provided with a control microcomputer 11 as the center of automatic speed change control, and a monitor microcomputer 12 to monitor the control microcomputer 11. The control microcomputer 11 computes solenoid output related to automatic speed change control, and outputs the solenoid output through an output memory zone to a solenoid. The monitor microcomputer 12 monitors the solenoid output outputted from the control microcomputer 11, and notifies the control microcomputer 11 of generation of abnormality when the solenoid output is determined to be abnormality. The control microcomputer 11 follows the notification of generation of abnormality for initialization related to the solenoid output. <P>COPYRIGHT: (C)2004,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a vehicle electronic control device, and more particularly to a technique for suitably monitoring control output data.

[0002]

2. Description of the Related Art In recent years, electronic control devices for vehicles (vehicle-mounted E
The control function of CU) tends to be more sophisticated and complicated, and the software for realizing the control is also increasing in scale. For example, in a transmission ECU having a shift control function of an automatic transmission, it has been proposed that a direct pressure control of a linear solenoid or a complex multiple shift control by increasing the number of stages is realized along with the improvement of the transmission structure. Software is designed by an oriented method. Incidentally, the direct pressure control is a control for shifting while controlling the engagement pressure of the friction engagement device in the automatic transmission, and the multiple shift control is different from the one in which the throttle opening changes during the shift control. When the shift determination is established, it means a control for making a new shift determination during the shift control that has already started.

[0003]

As described above, while the scale of control software is increasing, there is a demand for shortening the development period. Under such circumstances, it is conceivable that an item that cannot be completely confirmed in terms of quality, an unexpected operation due to specifications, or a runaway of microcomputer processing due to RAM destruction or the like may occur. If the microcomputer itself goes out of control, measures such as resetting are taken by the well-known watchdog monitoring function. In this case, the processing of the microcomputer can return to the normal control by operating from the initial state.

However, the transmission ECU
In the case where the shift output data is fixed or an unexpected shift output is generated due to the garbled RAM or the like, the watchdog pulse (WD pulse) is correctly output, and therefore the recovery by the monitoring function cannot be expected. In addition, if an abnormality such as RAM corruption can be detected, it is possible to reset the microcomputer, but in this case, all controls are performed from the initial state, which affects other controls that were operating normally. Will be reached. That is, all the contents that have been controlled up to that point, such as learning data, will be reset, which may adversely affect drivability and other monitoring functions.

The present invention has been made in view of the above problems, and an object thereof is to be able to return to normal control without affecting other controls when control output data is abnormal. It is to provide an electronic control device for a vehicle that can do so.

[0006]

According to a first aspect of the present invention, there is provided an electronic control unit for a vehicle, which calculates control output data relating to vehicle traveling control and outputs the control output data to an actuator via an output memory area. The control unit includes a control unit and a monitoring unit that monitors control output data output from the control unit. Then, in particular, when the monitoring unit determines that the control output data output from the control unit is abnormal, the monitoring unit notifies the control unit that an abnormality has occurred. The control unit initializes the control output data according to the notification of the abnormality occurrence. In the present invention,
When the control output data is abnormal, only the data related to the control output data is initialized, so that even other normal parts are not initialized. Therefore, it is possible to return to the normal control without affecting other controls.

In the second aspect of the invention, when the control unit receives the notification of the abnormality occurrence, the control unit first initializes the control output data in the output memory area, and then the abnormality is detected even after a predetermined time elapses. If the state continues, then initialization is performed including another memory area involved in the calculation of control output data.
In this case, since the data is initialized step by step, it is possible to specify the memory area to be initialized by the minimum necessary amount and perform the initialization optimally.

According to the third aspect of the present invention, the control unit stops the output of the watchdog pulse if the abnormal state continues even after a lapse of a predetermined time after receiving the notification of the abnormal state. When the output of the watchdog pulse is stopped, the control unit is reset by the watchdog monitoring circuit. In other words, if the control output data and the like are initialized after the occurrence of the abnormality and the abnormality continues, it is considered that normal recovery cannot be expected as it is. In such a case, normal operation will be restored by resetting.

According to a fourth aspect of the present invention, the monitoring unit calculates control output data or data equivalent thereto by the same method as the control unit, and compares the calculated control output data with the calculated data to thereby control the control unit. The control output data of is judged to be abnormal. Thereby, the abnormality of the control output data can be easily determined.

According to the fifth aspect of the present invention, since the monitoring unit is composed of the same CPU as the control unit, the monitoring unit can grasp the map and the state of control processing. Therefore, it becomes possible to more accurately determine the abnormality of the control output data as compared with the case of the external monitoring configuration.

In a sixth aspect of the present invention, when the control section receives the notification of the abnormality occurrence, the control output data at that time is initialized, and the alternative data of the control output calculated separately is output to the output memory. Output to the actuator via a memory area different from the area. If the control output data in the output memory area is destroyed, the alternative data of the control output is separately calculated and output through another memory area as described above, and the vehicle control is interrupted each time. There is no such thing. Therefore, suitable vehicle control can be continued even when an abnormality occurs.

According to the seventh aspect of the invention, it is determined that the control output data output from the control unit is abnormal, and when the state continues for a predetermined time, the control unit outputs the control output according to the notification of the abnormality occurrence. Initialize data. In this case, an accurate abnormality determination can be performed by determining that the abnormality continues.

[0013]

BEST MODE FOR CARRYING OUT THE INVENTION (First Embodiment) A first embodiment of the present invention will be described below with reference to the drawings. In the present embodiment, the present invention is embodied in a vehicle ECU for realizing vehicle travel control, and particularly this ECU has a shift control function for automatically controlling a shift of an in-vehicle transmission. In-vehicle transmission has multiple solenoids (actuators) selectively ON or OF
When the hydraulic pressure is set to F, the hydraulic path is changed accordingly, and the shift speed is automatically switched.

FIG. 1 is a block diagram showing the outline of this control system. In FIG. 1, an ECU 10 includes a control microcomputer 11 that forms the center of automatic shift control, and a control microcomputer 11
And a monitoring microcomputer 12 for monitoring the. Each of the microcomputers 11 and 12 is composed of a well-known logical operation circuit having a CPU, a ROM, a RAM, etc. In this embodiment, the control microcomputer 11 corresponds to a “control unit” and the monitoring microcomputer 12 corresponds to a “monitoring unit”. To do.

The control microcomputer 11 is provided with various control functions such as automatic shift control, electronic throttle control, cruise control and the like, as well as a failure diagnosis function (diagnosis function) and a communication function. Especially for automatic shift control, the control microcomputer 11
Inputs vehicle operation information (sensor detection signal) such as throttle opening and vehicle speed, and uses the gear shift characteristic map of FIG. 2 to set the control gear (shift gear) according to the throttle opening and vehicle speed at that time. decide. Then, the solenoid output is determined according to the control shift speed, and the solenoid output is output as S1, S2, and S3, respectively. in this case,
The solenoid outputs S1 to S3 correspond to "control output data", and the outputs S1 to S3 are output to each solenoid via an output memory area (RAM) (not shown) in the control microcomputer 11. The throttle opening and vehicle speed detection signals are also input to the monitoring microcomputer 12.

The monitoring microcomputer 12 has a function of calculating the control shift speed by the same method as that of the control microcomputer 11, and uses the shift characteristic map of FIG. 2 to control the shift according to the throttle opening and the vehicle speed. Determine the stage. Further, the monitoring microcomputer 12 takes in the solenoid outputs S1 to S3 output from the control microcomputer 11, and outputs the solenoid output S1.
The abnormalities 1 to S3 are monitored as needed. When an abnormality on the control microcomputer 11 side is detected, the monitoring microcomputer 12 outputs an initialization signal to the control microcomputer 11 in order to initialize specific RAM data in the control microcomputer 11.

Further, the ECU 10 is provided with a WD circuit 13 as a "watchdog monitoring circuit". The control microcomputer 11 outputs a WD pulse to the WD circuit 13, and the WD circuit 13 controls the control microcomputer 11 when the WD pulse from the control microcomputer 11 is not inverted for a predetermined time or longer.
A reset signal is output to.

Next, the initialization procedure by the control microcomputer 11 and the monitoring procedure by the monitoring microcomputer 12 will be described. Here, FIG. 3 is a flowchart showing the output abnormality determination processing by the monitoring microcomputer 12, and FIG. 4 is a flowchart showing the data initialization processing by the control microcomputer 11. These respective processes are executed by the respective microcomputers 11 and 12 in a predetermined time cycle (for example, 16 ms cycle).

In FIG. 3, step 101 reads the current vehicle speed and throttle opening, and step 102
Then, the control speed is calculated from the relationship between the vehicle speed and the throttle opening. After that, in step 103, the solenoid outputs S1 to S3 output from the control microcomputer 11 are output.
In step 104, the actual shift speed (actual shift speed) is calculated from the read solenoid outputs S1 to S3.

After that, in step 105, it is determined whether or not the control shift speed and the actual shift speed match. Solenoid outputs S1 to S3 are fixed due to microcomputer failure or RAM destruction due to external / internal factors, or the output S1
If S3 is unintended, step 105 is NO. If step 105 is NO, it is considered that the solenoid output is abnormal, and the routine proceeds to step 106. In step 106, an initialization signal requesting initialization of the solenoid outputs S1 to S3 is output to the control microcomputer 11. On the other hand, if step 105 is YES, it is considered that the solenoid output is normal, and this processing is terminated.

On the other hand, in FIG. 4, in step 201, the initialization signal from the monitoring microcomputer 12 is acquired, and in the following step 202, it is determined whether or not the initialization request is made by the initialization signal. If there is an initialization request, the routine proceeds to step 203, where the RAM area for the solenoid outputs S1 to S3 is initialized. In step 203 above,
In addition to the configuration in which only the solenoid outputs S1 to S3 are initialized,
Instead of or in addition to this, the solenoid outputs S1 to
Another RAM area related to the calculation of S3, that is, another calculation data used in the automatic shift control may be initialized.

According to this embodiment described in detail above, the solenoid outputs S1 to S3 output from the control microcomputer 11 are described.
Is abnormal, the specific data (solenoid output S1 to
Since only S3) is initialized, other normal parts are not initialized. Therefore, it is possible to quickly return to normal control without affecting other controls.

In the processing of FIG. 3 by the monitoring microcomputer 12, when the control gear shift ≠ the actual gear shift and the state continues for a predetermined time (several 100 ms to several sec), an initialization signal output indicating an initialization request (step 106) may be implemented. Also, the judgment of the passage of a predetermined time is
The configuration may be implemented on the control microcomputer 11 side (processing in FIG. 4). In any case, when the solenoid output becomes abnormal and the state continues for a predetermined time, the control microcomputer 11 may initialize the solenoid outputs S1 to S3.

(Second Embodiment) Next, a second embodiment of the present invention will be described focusing on the differences from the above-described first embodiment. In the present embodiment, when the solenoid outputs S1 to S3 are abnormal, the solenoid is driven by the substitute data.

FIG. 5 is a flow chart showing the data initialization processing in the present embodiment, and this processing is carried out by the control microcomputer 11 in place of FIG. In FIG. 5, in step 301, an initialization signal from the monitoring microcomputer 12 is acquired, and in the following step 302, it is determined whether or not an initialization request is made by the initialization signal. At this time, as described above, if the solenoid output is abnormal, an initialization request will be made.

If there is an initialization request, in step 303, alternative data of the control gear is calculated, and then in step 30.
At 4, the substitute data of the control gear is stored in SRAM (standby RAM) or the like. Then, step 305
Then, the corresponding RAM area is initialized with respect to the solenoid outputs S1 to S3 at that time. In the following step 306, the substitute data in the SRAM is transferred to the solenoid outputs S1 to S3.
Output as.

Here, the memory area for storing the alternative data may be any memory area other than the memory area to be initialized in step 305, a RAM area other than the output memory area,
It may be an EEPROM or the like.

According to the present embodiment, when the solenoid outputs S1 to S3 become abnormal in the output memory area, the alternative data is separately calculated and output through another memory area. The automatic shift control is not interrupted. Therefore, it is possible to continue the preferable automatic shift control even when an abnormality occurs.

Further, in this case, it is possible to realize a structure that does not cause unnecessary shift control. For example, when the multiple shift control is performed, it is possible to prevent the control other than the shift control from entering the multiple shift control after the reset at the high speed gear stage, and to quickly return to the normal control.

(Third Embodiment) Next, in a third embodiment, a configuration will be described in which the initialization of the solenoid outputs S1 to S3 and the data related thereto is carried out stepwise.

FIG. 6 is a flow chart showing the data initialization processing in the present embodiment, and this processing is carried out by the control microcomputer 11 in place of the above-mentioned FIG. 4 and FIG. In FIG. 6, first, in steps 401 and 402, similarly to the above, an initialization signal from the monitoring microcomputer 12 is acquired,
The initialization signal is used to determine whether or not an initialization request has been made. If there is no initialization request, step 403
Then, the initialization flag F1 is cleared (F1 = 0).

If there is an initialization request, the process proceeds to step 404, and since the initialization flag F1 is initially cleared, the process further proceeds to step 405. In step 405, the corresponding RAM area (output memory area) related to the solenoid outputs S1 to S3 is initialized, and in the following step 406, the initialization flag F1 is set (F1 = 1).

If the set state continues after the initialization flag F1 is set, that is, if the initialization flag F1 is not cleared even when the solenoid output is initialized, the elapse of a predetermined time is awaited in step 407. . Then, when a predetermined time has passed since the initialization flag F1 was set, that is, when a predetermined time has passed after the solenoid outputs S1 to S3 were initialized, the process proceeds to step 408, and is related to the calculation of the solenoid outputs S1 to S3. Initialize the corresponding RAM area including data.

According to the third embodiment described above, since the data initialization is performed stepwise, it is necessary to specify the memory area to be initialized by the minimum necessary amount and perform the initialization optimally. You can

(Fourth Embodiment) Next, in a fourth embodiment, a configuration in which initialization processing of solenoid outputs S1 to S3 and data related thereto and reset processing by the WD circuit 13 are combined. explain.

FIG. 7 is a flow chart showing the data initialization processing in the present embodiment, and this processing is carried out by the control microcomputer 11 in place of FIGS. 4 to 6. In FIG. 7, first, in steps 501 and 502, similarly to the above, an initialization signal from the monitoring microcomputer 12 is acquired,
The initialization signal is used to determine whether or not an initialization request has been made. If there is no initialization request, step 503
And the initialization flags F1 and F2 are cleared (F1 =
0, F2 = 0).

If there is an initialization request, the process proceeds to step 504, and since both the initialization flags F1 and F2 are initially cleared, the process further proceeds to steps 504 → 505 → 506.
In step 506, the corresponding RAM area (output memory area) related to the solenoid outputs S1 to S3 is initialized, and in the following step 507, the initialization flag F1 is set (F1 = 1).

If the set state continues after the initialization flag F1 is set, that is, if the initialization flag F1 is not cleared even when the solenoid output is initialized, the elapse of a predetermined time is awaited in step 508. . Then, when a predetermined time has passed since the initialization flag F1 was set, that is, when a predetermined time has passed after the solenoid outputs S1 to S3 were initialized, the process proceeds to step 509, and is related to the calculation of the solenoid outputs S1 to S3. Initialize the corresponding RAM area including data. Further, in step 510, the initialization flag F2 is set (F2 =
1).

After the initialization flag F2 is set, a predetermined time is awaited in step 511. Then, when a predetermined time has elapsed from the setting of the initialization flag F2, the process proceeds to step 512, and the output of the WD pulse is stopped.
As the WD output is stopped, the control microcomputer 11 is reset by the WD circuit 13.

According to the fourth embodiment described above, in the case where the abnormality continues even if the initialization of the solenoid output or the like is performed after the abnormality has occurred and normal recovery cannot be expected as it is,
A normal return due to a reset can be achieved.

In the processing shown in FIG. 7, the solenoid outputs S1 to S3 and the data related thereto are initialized in a stepwise manner (steps 506 and 509), and only one of them is initialized. After that initialization,
The configuration may be such that the output of the WD pulse is stopped when a predetermined time has elapsed.

The present invention can be embodied in the following modes other than the above. In the above embodiment, the control unit and the monitoring unit are realized by separate microcomputers (CPUs), but the control unit and the monitoring unit are realized by the same microcomputer (CPU). Is also good. In this case, the monitoring unit can also grasp the map and the state of control processing. Therefore, it is possible to more accurately determine the abnormality of the solenoid output (control output data) as compared with the case of the external monitoring configuration.

In the case where the automatic shift control is monitored inside the microcomputer, the OS (operating system) is used.
In the configuration using, it is possible to perform the automatic shift control as a separate task. It is also possible to monitor the lock detection of the task itself in which the automatic shift control is performed. In this case, the map can be shared and resource-saving can be achieved.

In the above embodiment, the output to the solenoid in the automatic shift control is "control output data",
The example of executing the initialization process for the solenoid output was explained, but assuming the control output data in other control,
The same initialization process may be performed. For example, in the electronic throttle control, the output to the throttle drive motor may be set as "control output data", and the initialization process may be performed on the motor output.

[Brief description of drawings]

FIG. 1 is a configuration diagram showing an outline of a vehicle control system according to an embodiment of the invention.

FIG. 2 is a diagram showing a shift characteristic map.

FIG. 3 is a flowchart showing output abnormality determination processing.

FIG. 4 is a flowchart showing a data initialization process.

FIG. 5 is a flowchart showing a data initialization process in the second embodiment.

FIG. 6 is a flowchart showing a data initialization process according to the third embodiment.

FIG. 7 is a flowchart showing a data initialization process according to the fourth embodiment.

[Explanation of symbols]

10 ... ECU, 11 ... Control microcomputer, 12 ... Monitoring microcomputer, 13 ... WD circuit.

   ─────────────────────────────────────────────────── ─── Continued front page    F term (reference) 3J552 MA01 NA01 NB01 PA51 PB02                       PB08 QB02 QC08 TB17                 5H209 AA10 BB07 CC01 DD04 EE11                       GG05 HH06 HH10 HH33 JJ09

Claims (7)

[Claims] 1. A control unit that calculates control output data relating to vehicle traveling control and outputs the control output data to an actuator via an output memory area, and monitors the control output data output from the control unit. An electronic control device for a vehicle, comprising: a monitoring unit, wherein the monitoring unit notifies the control unit of occurrence of an abnormality when the control output data output from the control unit is determined to be abnormal, and controls the control unit. Is an electronic control unit for a vehicle, wherein control output data is initialized according to a notification of occurrence of an abnormality. 2. The control section, upon receiving the notification of the occurrence of an abnormality, first initializes the control output data in the output memory area, and then the abnormal state continues even after a predetermined time has elapsed. 2. Then, the vehicle electronic control device according to claim 1, wherein initialization is performed including another memory area related to calculation of control output data. 3. A watchdog monitoring circuit for inputting a watchdog pulse, which is inverted at a predetermined cycle, from the control unit and resetting the control unit when the periodicity is lost, and the control unit notifies the occurrence of an abnormality. 3. The electronic control device for a vehicle according to claim 1, wherein the watchdog pulse output is stopped if the abnormal state continues even after a lapse of a predetermined time after receiving. 4. The monitoring unit calculates control output data or data equivalent thereto by the same method as the control unit, and compares the control output data with the calculated data to detect an abnormality in the control output data of the control unit. The vehicle electronic control device according to claim 1, wherein the determination is performed. 5. The monitoring unit is the same CPU as the control unit.
The electronic control device for a vehicle according to any one of claims 1 to 4, wherein 6. When the control section receives a notification of occurrence of an abnormality, it initializes control output data at that time, and substitutes separately calculated control output data into a memory area different from the output memory area. The electronic control unit for a vehicle according to any one of claims 1 to 5, which outputs to the actuator via 7. When it is determined that the control output data output from the control unit is abnormal and the state continues for a predetermined time,
7. The vehicle electronic control device according to claim 1, wherein the control unit initializes the control output data according to a notification of occurrence of an abnormality.