JP6852012B2 - Vehicle transmission control device - Google Patents

Description

The present invention relates to a control device for a vehicle transmission.

IEC 61508, ISO 26262, etc. have been established as international standards for functional safety, and the need for automobile safety performance is increasing.

In order to meet the needs for safety performance, the microprocessor installed in the vehicle transmission is equipped with functions that can constantly monitor the safety status, such as improving the performance of the ROM (Read Only Memory) failure detection function. .. On the other hand, the ROM storage capacity is rapidly increasing due to the technological improvement of the microprocessor, and the ROM failure rate tends to be high.

When a failure of the control device of a vehicle transmission including a ROM failure occurs, a technology for shifting to a fail-safe state has been disclosed.

In the summary column of Patent Document 1, "n failure determination means for determining the failure state of a component, and runaway, engine stall, and sudden deceleration even if a failure occurs in a peripheral or related part assumed from the failure part. It is equipped with m fail-safe mode execution means, which is less than the n failure determination means that are integrated and grouped in advance, and can ensure an operating state that does not cause a double failure. Is detected and determined, the fail-safe mode corresponding to the faulty part is selected from the m fail-safe modes. "

Japanese Unexamined Patent Publication No. 2009-41602

In Patent Document 1, in order to ensure the safety state of the vehicle when the ROM fails, the function of the vehicle transmission is limited, and the drivability may be deteriorated.

The present invention has been made in view of the above problems, and an object of the present invention is that even if a plurality of ROM failures occur, it is not necessary to limit the control of the vehicle transmission by performing alternative control, and the driver. The purpose is to avoid a decrease in ability.

To achieve the above object, the present invention detects a storage unit for storing the address data, and a control unit that performs processing by using the address data to which the storage unit stores, a fault in the control unit In the control device of the vehicle transmission provided with the failure detector, the storage unit has a control address and a control copy address in the address data, and the control unit has a solenoid relay circuit. The address of the first solenoid relay control unit was stored in the control address of the storage unit as a control address for control, and the first solenoid relay control unit was copied to an unused area of the control unit. The address of the second solenoid relay control unit is stored in the control copy address of the storage unit, and the control unit includes a failure part detection control unit that detects a part where an abnormality has occurred in the control unit, and the failure part. A failure site avoidance control unit that switches to the control copy address when the detection control unit detects an abnormality at the control address, and an area that copies the second solenoid relay control unit to an unused area of the control unit. When the data is insufficient, the ROM failure control unit that controls the solenoid relay circuit under predetermined conditions is provided, and the failure site avoidance control unit detects an abnormality in the first solenoid relay control unit. In this case, the second solenoid relay control unit is copied to an unused area of the control unit to serve as the third solenoid relay control unit, and the control address set in the address data is controlled. After rewriting to the copy address and rewriting the control copy address to the address of the third solenoid relay control unit, the solenoid relay circuit is controlled by the control address to control the second solenoid relay control unit. When the unused area to be copied is insufficient, the solenoid relay circuit is controlled by switching to the ROM failure control unit .

According to the present invention, even if a plurality of ROM failures occur, it is not necessary to limit the control of the vehicle transmission by performing the alternative control, and it is possible to avoid a decrease in drivability.

An example of a system overview related to a vehicle transmission control device An example of solenoid relay control. Flow chart of control to detect ROM failure part related to solenoid relay control Flow chart of control to avoid ROM failure part related to solenoid relay control

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

An example of the system outline regarding the control device of the vehicle transmission will be described with reference to FIG.

The vehicle transmission includes a primary pulley 002 that receives the driving force from the engine 008, a secondary pulley 004 that outputs the driving force to the final gear 009, and a belt 003 that connects the primary pulley 002 and the secondary pulley 004. The groove width of the primary pulley 002 and the secondary pulley 004 can be changed by flood control to change the gear ratio.

It also includes an oil pump 005 that supplies oil to the primary pulley 002 and the secondary pulley 004, a primary solenoid valve 006 that adjusts the amount of oil supplied, and a secondary solenoid valve 007.

ATCU (Automatic Transmission Control Unit) 001, which is a control device for vehicle transmissions, controls the oil pressure of the primary pulley 002 and the secondary pulley 004 by opening and closing the primary solenoid valve 006 and the secondary solenoid valve 007, and as a result, the vehicle. It controls the gear ratio of the transmission.

FIG. 2 shows an example relating to solenoid relay control. The ATCU 101 includes a microprocessor 102, a solenoid control IC 114 that receives a target current value from the microprocessor 102 and controls a solenoid valve 116, and a solenoid relay circuit 113 that controls power supply from the battery 115 to the solenoid control IC 114.

The microprocessor 102 includes a ROM data storage unit (storage unit) 105 for storing data, a ROM control unit (control unit) 104 for storing software programs, and a ROM failure detector 103 capable of detecting a ROM failure address.

The ROM failure detector 103 includes a ROM failure notification register 117 that stores information on whether or not a ROM failure has occurred, and a ROM failure address storage register 118 that stores n addresses in which a ROM failure has occurred. The ROM failure detector 103 is a function mounted on the microprocessor 102, and monitors a ROM failure from the start to the stop of the microprocessor.

In the ROM control unit 104, the ROM failure part detection control 106, which is a software program that identifies the failure part of the control unit based on the information of the ROM failure notification register 117 and the ROM failure address storage register 118 acquired from the ROM failure detector 103. Has.

The ROM failure part avoidance control 107 is a software program for avoiding the failure part of the control unit by the ROM failure part detection control 106.

The solenoid relay control 108 is a software program that controls ON / OFF of the solenoid relay circuit 113.

The solenoid control 111 is a software program that applies a target indicated current to the solenoid control IC 114.

The solenoid relay control copy n-side 109 is a control alternative process performed when a ROM fails, and is a software program having the same contents as the solenoid relay control 108.

Solenoid relay control copy n + 1 side 119 is a control alternative process when solenoid relay control copy n side 109 has a ROM failure, and solenoid relay control copy n side when solenoid relay control 108 has a ROM failure. This is a copy of the software program having the same contents as the 109 to the unused area of the ROM.

Solenoid relay control copy n + 1 side 119 continues copying as long as there is an unused ROM area. The ROM failure control 110 is performed when the unused area of the ROM disappears and the ROM fails even on the solenoid relay control copy n + 1 side 119.

The ROM data storage unit 105 is a non-volatile memory, and includes a control execution data table 112 for avoiding a ROM failure portion. The control execution data table 112 includes a solenoid relay control 108 and a start address and an end address of the solenoid relay control copy n-plane 109.

3 and 4 show an example of software processing of this embodiment regarding solenoid relay control. From the start to the end of the microprocessor 102, software processing is repeatedly performed in the order of FIGS. 3 and 4 at regular intervals.

FIG. 3 is a flow chart of a control for detecting a ROM failure portion related to the solenoid relay control 108. The presence or absence of a ROM failure is determined by the ROM failure notification register 117 of the ROM failure detector 103 (201). When it is determined that the ROM has failed, the ROM failure address information is acquired from the ROM failure address storage register 118 of the ROM failure detector 103 (202). The failure address information (202) is compared with the start address or end address of the solenoid relay control 108 provided in the control execution data table 112 (203). At this time, if the failure address information (202) is within the end address from the start address of the solenoid relay control, it is determined that the ROM failure of the solenoid relay control is performed, and the solenoid relay control copy n-plane address of the control data table is used as the solenoid. Overwrite the relay control (204, 209, 210).

Next, the failure address information (202) is compared with the start address or end address of the solenoid relay control copy n-plane 109 provided in the control execution data table 112 (205). At this time, if the failure address information (202) is within the end address from the start address of the solenoid relay control copy, it is determined that the ROM has failed in the solenoid relay control area (206). If the failure address information (202) is not within the end address from the start address of the solenoid relay control copy, the solenoid relay control copy n-side 109 is copied to the unused area of the ROM to generate the solenoid relay control n + 1 side 119. (207). At this time, the solenoid relay control copy n + 1 plane address of the control data table is overwritten with the solenoid relay control copy address (208, 209, 210).

The address information of the solenoid relay control 108 of the control data table is referred to by the ROM failure portion avoidance control 107, and the avoidance control of the ROM failure portion is performed.

FIG. 4 is a flow chart of control for avoiding a ROM failure portion related to the solenoid relay control 108. The solenoid relay control ROM failure determination (206) of the ROM failure portion detection control 106 determines whether or not to avoid the solenoid relay control (301). If it is not determined that the solenoid relay control has a ROM failure, the solenoid relay control address is acquired from the control execution data table (302). Solenoid relay control is executed by program-jumping to the acquired address (303). When it is determined that the ROM has failed in the solenoid relay control area (206), the ROM failure control 110 (304) is performed.

For example, when the ROM failure control 110 is executed, the software stops the control of each actuator of the vehicle transmission. In this case, the gear ratio is fixed by hardware control of the vehicle transmission to ensure safety, but the drivability is significantly reduced.

In the conventional control device for a vehicle transmission, when the ROM failure is determined by the solenoid relay control, the ROM failure control 110 is performed. However, according to this embodiment, the solenoid relay alternative control is performed. , ROM failure control 110 can be avoided, and as a result, deterioration of drivability can be avoided.

As described above, the control device for the vehicle transmission of the present embodiment is a ROM data storage unit 105 that stores data and a ROM control that performs processing using the data stored in the ROM data storage unit 105. A unit 104 is provided. Then, a plurality of control processes of the vehicle transmission are stored in the ROM control unit 104, and among the plurality of control processes, the control process that causes the vehicle transmission to become uncontrollable when the control process cannot be performed is duplicated. It is remembered.

As the control process that causes the vehicle transmission to become uncontrollable, the relay control process of the solenoid coil and the like can be considered. These relate to the actuator which must be controlled at least as ATCU 101 at the time of ROM failure. On the contrary, if the actuator does not need to be controlled when the ROM fails, there is no problem even if the software program is not duplicated, but the present invention is not limited to this.

That is, if all the control processes stored in the ROM control unit 104 are duplicated, if a failure occurs in the storage area for a certain control process, the duplicated control process enables alternative control. However, duplicating all control processes is not realistic due to the problem of the storage capacity of the ROM control unit 104.

Therefore, in this embodiment, the ROM control unit 104 is duplicated by focusing on a specific control process. If a failure occurs in the storage area that stores the relay control process of the solenoid coil described above, and if it is not duplicated, it is determined that the control device cannot control the transmission. However, in this case, the safety is ensured by fixing the gear ratio of the vehicle transmission, so that the drivability is significantly lowered.

On the other hand, in the present embodiment, for example, the control process that causes the vehicle transmission to become uncontrollable, such as the relay control process of the solenoid coil, is duplicated and stored in the ROM control unit 104. As a result, even if a failure occurs in a plurality of locations in the storage area of the relay control process of the solenoid coil, the ROM control unit 104 can perform alternative control according to the duplicated and stored control contents, and can perform normal control. Can be continued.

Therefore, it is not necessary to extremely increase the capacity of the ROM control unit 104, and it is possible to suppress an increase in cost and to suppress a significant decrease in drivability by fixing the gear ratio of the vehicle transmission. It becomes.

Further, the ROM mounted on the microprocessor is composed of a storage unit for storing data, a control unit for executing a software program using the data, and an unused area not used in the software program.

The control unit is composed of a group of software programs that control the actuator of the vehicle transmission based on the sensor information attached to the vehicle transmission and the information acquired from other ECUs, and is arranged in the ROM in the control unit.

It is duplicated with the same content as the control unit. The selection of the control to be duplicated depends on the ROM capacity, and the functions that can avoid the decrease in drivability are preferentially duplicated. Hereinafter, the duplicated software program is referred to as a control copy surface.

The microprocessor function monitors the ROM failure, and when a ROM failure occurs, the address information of the failed part is acquired.

The control at the failure part is specified by the address information of the ROM failure part and the control execution data table.

Control control at the ROM failure site The same control as in normal operation is performed on the copy surface.

When a ROM failure occurs, the control is copied to an unused area of the ROM, and even if a ROM failure occurs at a plurality of locations, the same control as in normal operation is continued.

When the unused area of the ROM is exhausted, the fail-safe state of the prior art is set, the function of the vehicle transmission is restricted, and the safety is ensured.

Based on the above, in a control device for a vehicle relay including a storage unit for storing data and a control unit for performing processing using the data stored in the storage unit, the storage unit is described as described above. A plurality of control processes of the vehicle transmission are stored, and at least the solenoid relay control process is duplicated among the plurality of control processes, and the solenoid relay control is copied to an unused area of the storage unit.

Further, when any of the duplicated solenoid relay controls cannot be processed, the solenoid relay control is copied to the unused area of the storage unit.

Further, when the control unit detects an abnormal address of the storage unit corresponding to the solenoid relay control, the control unit copies the solenoid relay control duplicated in the storage unit to the unused area of the storage unit. When the abnormal address is detected again, the processing is performed by the solenoid relay control copied to the unused area.

104 ROM control unit (control unit), 105 ROM data storage unit (storage unit), 108 solenoid relay control

Claims (1)

A storage unit that stores address data and
A control unit that performs processing using the address data stored in the storage unit, and
A failure detector that detects a failure in the control unit and
In the control device of the transmission for vehicles equipped with
The storage unit
The address data includes a control address and a control copy address.
The control unit
The address of the first solenoid relay control unit is stored in the control address of the storage unit as the control address for controlling the solenoid relay circuit, and the first solenoid relay control unit is unused of the control unit. The address of the second solenoid relay control unit copied in the area is stored in the control copy address of the storage unit.
The control unit
A failure part detection control unit that detects a part where an abnormality has occurred in the control unit,
When the failure site detection control unit detects an abnormality in the control dress, the failure site avoidance control unit switches to the control copy address.
It has a ROM failure control unit that controls the solenoid relay circuit under predetermined conditions when an area for copying the second solenoid relay control unit is insufficient in the unused area of the control unit.
The failure site avoidance control unit
When an abnormality is detected in the first solenoid relay control unit, the second solenoid relay control unit is copied to an unused area of the control unit to form a third solenoid relay control unit, and the address data is used. The control address set in is rewritten to the control copy address, the control copy address is rewritten to the address of the third solenoid relay control unit, and then the solenoid relay circuit is rewritten with the control address. Control and
A control device for a vehicle transmission, characterized in that when an unused area for copying the second solenoid relay control unit is insufficient, the control unit is switched to the ROM failure control unit to control the solenoid relay circuit.

Images