JP2008088885A - Control device for internal combustion engine - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To improve safety when detecting abnormality of an engine control system. <P>SOLUTION: In this control device for an internal combustion engine, an ECU 21 is provided with a first breaker 24 to interrupt supply of power supply to a throttle motor 11 and a second breaker 25 to interrupt supply of power supply to a fuel injection valve 15. When detecting abnormality, driving signals are output from both the fail-safe control part 36 of a CPU 22 and the fail-safe control part 43 of an IC 23 to the first breaker 24 and second breaker 25, and a fail-safe processing such as fixation of a throttle opening and fuel cutting is executed. Further, according to the degree and contents of abnormality when detecting abnormality, the fail-safe processing such as inhibition of the use of abnormal sensor output (failure signal), changeover of sensors to be used, correction of accelerator manipulated variable according to a brake state, limitation in change speed or variation of the throttle opening, fixation of the throttle opening, fuel cutting, and output of a reset requirement signal, is gradually executed. The minimum required fail-safe processing for safety is executed. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a control device for an internal combustion engine that adjusts the opening of a throttle valve by controlling a throttle motor based on the output of an accelerator sensor and the output of a throttle opening sensor.

  In recent years, in an internal combustion engine mounted on a vehicle, for example, as described in Patent Document 1 (Japanese Patent Laid-Open No. 2003-343326), an electronic throttle that electronically controls a throttle opening (throttle valve opening). Some have adopted a control system. The electronic throttle control system includes a throttle motor that adjusts the opening of the throttle valve, a throttle opening sensor that detects the throttle opening, and an accelerator sensor that detects an accelerator operation amount (operation amount of an accelerator pedal). The target throttle opening is calculated based on the accelerator operation amount detected by the accelerator sensor, and the throttle motor is controlled so that the actual throttle opening detected by the throttle opening sensor matches the target throttle opening. .

  In such an electronic throttle control system, as described in the above-mentioned Patent Document 1, in order to secure the intake air amount necessary for evacuation travel while ensuring safety in the event of an abnormality, the throttle valve is opened at a predetermined opening degree. A return spring that urges (so-called opener opening) and a load relay that shuts off the power supply to the throttle motor are provided. When an abnormality is detected, the power supply to the throttle motor is shut off by the load relay, and the throttle is opened by the return spring. There is one in which the degree is forcibly returned to a predetermined opening degree.

Further, in Patent Document 1, a first integrated circuit element and a second integrated circuit element are provided in an electronic control unit that controls an internal combustion engine, and the throttle opening, fuel injection amount, ignition, and the like are provided in the first integrated circuit element. In addition to controlling the timing and the like, it is possible to output a drive signal from both the first integrated circuit element and the second integrated circuit element to the load relay, and even when the first integrated circuit element is in an abnormal state, A drive signal is output from the second integrated circuit element to the load relay so that the throttle opening can be returned to the predetermined opening.
JP 2003-343326 A

  In Patent Document 1, when the first integrated circuit element is in an abnormal state, a drive signal is output from the second integrated circuit element to the load relay to return the throttle opening to a predetermined opening. The amount of intake air (the amount of intake air that can be evacuated) can be ensured. In this case, however, if the fuel injection amount or ignition timing cannot be normally controlled due to an abnormality in the first integrated circuit element, a failure will occur. There is a problem that safe processing cannot be executed and safety at the time of detecting an abnormality cannot be sufficiently ensured.

  Moreover, as in the above-mentioned Patent Document 1, in the fail-safe process in which the throttle opening is uniformly fixed at a predetermined opening when an abnormality is detected, and a predetermined intake air amount (intake air amount that can be retreated) is ensured. The following problems can occur:

  For example, when an abnormality is detected while the vehicle is traveling at a high speed (for example, 100 km / h or more), if the throttle opening is immediately returned to a predetermined opening, the vehicle may decelerate rapidly and the traveling state may become unstable. is there.

  In addition, when an abnormality is detected while the vehicle is traveling in the mountains, deserts, or cold regions far away from the town, the throttle opening is fixed at a predetermined opening and a predetermined intake air amount (amount of intake air that can be evacuated) ), It may be difficult to return to the town over difficult places such as dredging and rough roads.

  In addition, in a system that executes lean control that controls the air-fuel ratio of the internal combustion engine lean and ignition delay control that retards the ignition timing, the lean operation region that executes lean control and the ignition delay that executes ignition delay control If the throttle opening is fixed at a predetermined opening and the intake air amount is fixed at a predetermined amount when an abnormality is detected in the driving region, stable running performance may not be obtained.

  The present invention has been made in consideration of these circumstances. Accordingly, an object of the present invention is to provide a control device for an internal combustion engine that can improve safety when an abnormality is detected.

  In order to achieve the above object, the invention according to claim 1 is directed to an output of at least one of a plurality of accelerator sensors for detecting an operation amount of an accelerator pedal and a plurality of throttle openings for detecting an opening of a throttle valve. A control device for an internal combustion engine that controls a throttle motor that adjusts an opening degree of the throttle valve based on an output of at least one of the sensors, wherein the throttle opening degree is cut off from power supply to the throttle motor. Control to an internal combustion engine drive device including a first shut-off means for returning the valve to a predetermined opening, a second shut-off means for stopping at least one of the fuel injection of the fuel injection valve and the ignition operation of the ignition device, and a throttle motor A first integrated circuit that outputs a signal and outputs a drive signal to the first and second shut-off means, and the first and second integrated circuits cooperate with the first integrated circuit. A second integrated circuit that outputs a driving signal to the disconnecting means, an input / output system abnormality diagnosing means for diagnosing the presence or absence of abnormality in the sensor system and the actuator system related to the control of the internal combustion engine driving device, and the first and second A control system abnormality diagnosis means for diagnosing the presence or absence of an abnormality in the integrated circuit; a fail safe control means for executing a predetermined fail safe process when an abnormality is diagnosed by the input / output system abnormality diagnosis means or the control system abnormality diagnosis means; The fail-safe control means includes an output of a drive signal to the first and second shut-off means according to an abnormality diagnosis result of at least one of the input / output system abnormality diagnosis means and the control system abnormality diagnosis means, and a first And the output of the reset request signal to the second integrated circuit.

  In this configuration, since the drive signal can be output also from the second integrated circuit to the first and second cutoff means, the fuel injection amount and the ignition timing cannot be normally controlled due to an abnormality of the first integrated circuit. Even when the abnormality is detected, it is possible to output a drive signal from the second integrated circuit to the second shut-off means when an abnormality is detected, and to execute a fail-safe process for stopping the fuel injection or ignition operation. Sufficient sex can be secured.

  In addition, according to the abnormality diagnosis result of the input / output system abnormality diagnosis means and the control system abnormality diagnosis means, the output of the drive signal to the first and second cutoff means and the reset request signal to the first and second integrated circuits Therefore, when an abnormality is detected, fail-safe processing such as fixing the throttle opening, stopping fuel injection, stopping ignition operation, and outputting a reset request signal is performed according to the degree and content of the abnormality. By executing in steps, the minimum fail-safe process necessary for safety can be executed, and the problem of the prior art that fixes the throttle opening uniformly when an abnormality is detected can be solved.

  In this case, as in claim 2, the control system abnormality detection means includes first self-diagnosis means built in the first integrated circuit for self-diagnosis of the control system abnormality of the first integrated circuit. A first mutual diagnosis means built in the first integrated circuit for diagnosing the presence or absence of an operation abnormality of the second integrated circuit; and a presence or absence of an abnormality in the second integrated circuit built in the second integrated circuit The second self-diagnosis means for self-diagnosis and the second mutual diagnosis means built in the second integrated circuit for diagnosing the presence or absence of operation abnormality of the first integrated circuit may be used. In this way, the first integrated circuit and the second integrated circuit can be provided with a self-diagnosis function and a mutual diagnosis function, respectively.

  Further, as in claim 3, each of the first and second self-diagnosis means has a plurality of diagnosis means for diagnosing the presence / absence of an abnormality of its own integrated circuit, and these diagnosis results are transferred to the other integrated circuit. The first and second mutual diagnosis means may diagnose the presence or absence of an abnormal operation of the other integrated circuit based on the diagnosis result transmitted from the other integrated circuit. In this way, the first and second mutual diagnosis means can reliably diagnose the presence or absence of abnormal operation of the other integrated circuit.

  Further, as in claim 4, the first self-diagnosis means and the second mutual diagnosis means are memories corresponding to the respective control units such as the ignition control unit, the fuel control unit, and the air control unit of the first integrated circuit. An abnormality diagnosis may be performed by dividing the diagnosis range for each area. In this way, abnormality diagnosis (self-diagnosis and mutual diagnosis) can be performed for each control unit such as the ignition control unit, the fuel control unit, and the air control unit of the first integrated circuit.

  According to another aspect of the present invention, the first self-diagnosis means and the second mutual diagnosis means divide the diagnosis range for each function of the first integrated circuit and / or for each peripheral device and perform abnormality diagnosis. Anyway. In this way, abnormality diagnosis (self-diagnosis and mutual diagnosis) can be performed for each function of the first integrated circuit and for each peripheral device.

  Further, as in claim 6, the fail-safe control means is incorporated in both the first and second integrated circuits, and transmits the control signals of the first and second cutoff means to the other integrated circuit. Drive signals may be output from both integrated circuits to the first and second shut-off means. In this way, system redundancy can be improved.

  According to a seventh aspect of the present invention, the first integrated circuit includes a plurality of A / D converters, and the main accelerator sensor output and the main throttle opening sensor output are supplied to the A / D converter for the main sensor. At the same time, the output of the sub accelerator sensor and the output of the sub throttle opening sensor are input to the A / D converter for the sub sensor, and the input / output system abnormality diagnosis means detects the abnormality of the A / D converter for the main sensor. In addition to diagnosing the presence / absence of an A / D converter for the sub sensor, the presence / absence of an abnormality may be diagnosed. By doing so, it is possible to individually diagnose the presence / absence of an abnormality in the A / D converter for the main sensor and the presence / absence of an abnormality in the A / D converter for the sub sensor.

  According to another aspect of the present invention, the second integrated circuit includes at least one of signals reflecting a vehicle operating state such as a rotational speed of the internal combustion engine, a load, a vehicle speed, an operation amount of an accelerator pedal, and an opening degree of a throttle valve. A drive signal may be output to the blocking means according to one. In this way, the fuel injection and the ignition operation can be stopped according to the driving state of the vehicle when an abnormality is detected.

  Further, in the case where the fuel injection of the fuel injection valve is stopped by the second cutoff means, the fuel supply of the fuel injection valve is stopped by shutting off the power supply and / or the fuel supply to the fuel injection valve as in claim 9. It is better to stop the injection. Further, when the ignition operation of the ignition device is stopped by the second cutoff means, the second cutoff means cuts off the control signal and / or power supply to the ignition device as in claim 10. It is preferable to stop the ignition operation of the ignition device.

  Further, as in claim 11, the present invention is preferably applied to a system that executes lean control for controlling the air-fuel ratio of the internal combustion engine to lean. In a system that performs lean control, when an abnormality is detected in the lean operation region in which lean control is performed, if the throttle opening is uniformly fixed to a predetermined opening and the intake air amount is fixed to a predetermined amount, stable running performance is achieved. However, if the present invention is applied, the failsafe process is executed step by step according to the degree and content of the abnormality when the abnormality is detected. The processing can be executed, and a stable and reliable traveling performance can be obtained.

Hereinafter, an embodiment embodying the best mode for carrying out the present invention will be described.
First, a schematic configuration of the entire engine control system will be described with reference to FIG. An intake pipe of an engine which is an internal combustion engine includes a throttle valve 12 whose opening is adjusted by a throttle motor 11, a main throttle opening sensor 13 which detects the opening (throttle opening) of the throttle valve 12, and a sub-throttle opening. A degree sensor 14 is provided. Further, the throttle valve 12 is energized to a predetermined opener opening (a throttle opening corresponding to a minimum intake air amount necessary for retreat travel or a slightly larger intake air amount). A return spring (not shown) is provided.

  A fuel injection valve 15 for injecting fuel is attached in the vicinity of the intake port of each cylinder of the engine. An ignition plug 16 is attached to each cylinder head of the engine, and a high voltage generated by the ignition device 17 is applied to the ignition plug 16 to generate a spark discharge, thereby igniting the air-fuel mixture in the cylinder. .

  Also, a crank angle sensor 18 that outputs a pulse signal every time the crankshaft rotates a predetermined crank angle is attached to the cylinder block of the engine. Based on the output signal of the crank angle sensor 18, the crank angle and the engine rotation speed are determined. Detected. Further, a main accelerator sensor 19 and a sub accelerator sensor 20 for detecting an operation amount of the accelerator pedal (accelerator operation amount) are provided in the vicinity of the accelerator pedal.

  Outputs of these various sensors are input to an engine control circuit (hereinafter referred to as “ECU”) 21. The ECU 21 is mainly composed of a microcomputer having a CPU 22 (first integrated circuit), an IC 23 (second integrated circuit), and the like, and the CPU 22 executes various engine control programs to bring the engine into an operating state. The throttle opening, fuel injection amount and ignition timing are controlled accordingly.

  In addition, the ECU 21 includes a first circuit breaker 24 (first interruption means) that cuts off power supply to the throttle motor 11 and a second circuit breaker 25 (first thing) that cuts off power supply to the fuel injection valve 15. Second blocking means) is provided. By shutting off the power supply to the throttle motor 11 with the first circuit breaker 24, a fail-safe process for returning the throttle opening to the opener opening by the return spring and fixing it can be executed. Thus, by shutting off the power supply to the fuel injection valve 15, the fuel injection of the fuel injection valve 15 is stopped, and the fail safe process for cutting the fuel can be executed. The second circuit breaker 25 cuts off the fuel supply to the fuel injection valve 15 to execute the fuel cut, or the second circuit breaker 25 supplies the power to the fuel injection valve 15 and the fuel. You may make it perform a fuel cut by interrupting both supply.

  The CPU 22 is provided with an A / D converter 26 (analog / digital converter) for a main sensor, an A / D converter 27 for a sub sensor, and a digital input device 28. The output of the main accelerator sensor 19 and the output of the main throttle opening sensor 13 are input to the A / D converter 26 for the main sensor, and the output of the sub accelerator sensor 20 is input to the A / D converter 27 for the sub sensor. And the output of the sub-throttle opening sensor 14 are input, and the output of the crank angle sensor 18 (information on the engine speed) is input to the digital input device 28.

  The CPU 22 calculates the target throttle opening based on the accelerator operation amount detected by the main accelerator sensor 19 and the sub accelerator sensor 20 in the air control unit 29, and the main throttle opening sensor 13 and the sub throttle opening sensor 14. A control signal is output to the throttle motor 11 to control the throttle opening so that the detected actual throttle opening coincides with the target throttle opening. Furthermore, the fuel control unit 30 controls the fuel injection amount by outputting a control signal to the fuel injection valve 15 according to the engine operating state (for example, the engine rotation speed and the intake air amount), and the ignition control unit 31 A control signal is output to the ignition device 17 in accordance with the engine operating state (for example, engine rotational speed, intake air amount, etc.) to control the ignition timing of the spark plug 16. In the predetermined lean operation region, the lean control for controlling the air-fuel ratio to lean is executed, and in the predetermined ignition delay operation region, the ignition delay control for delaying the ignition timing is executed.

  The CPU 22 includes an input system abnormality diagnosis unit 32 for diagnosing the presence or absence of a sensor system abnormality and an output system abnormality diagnosis unit 33 for diagnosing the presence or absence of an actuator system abnormality. Built-in first self-diagnosis unit 34 (first self-diagnosis means) for self-diagnosis of abnormality and first mutual diagnosis unit 35 (first mutual diagnosis means) for diagnosis of presence / absence of operation abnormality of IC 23 The CPU 22 is provided with a self-diagnosis function and a mutual diagnosis function. Further, the CPU 22 has a built-in fail-safe control unit 36 that executes a predetermined fail-safe process when the diagnosis unit 32-35 diagnoses that there is an abnormality. The fail-safe control unit 36 includes a diagnosis unit 32-35. And controlling the output of the drive signal to the first circuit breaker 24 and the second circuit breaker 25 by controlling the first circuit breaker output unit 37 and the second circuit breaker output unit 38 according to the abnormality diagnosis result. Controls the output of a reset request signal to the IC 23.

  On the other hand, the IC 23 is connected to the CPU 22 via a serial / parallel interface, and the output of the crank angle sensor 18 (information on the engine rotation speed) is input to the digital input device 46. The IC 23 includes an input system abnormality diagnosis unit 39 and an output system abnormality diagnosis unit 40, and a second self-diagnosis unit 41 (second self-diagnosis unit) that self-diagnose the presence / absence of an abnormality in the IC 23. The second mutual diagnosis unit 42 (second mutual diagnosis means) for diagnosing the presence or absence of an operation abnormality of the CPU 22 is built in, and the IC 23 is provided with a self-diagnosis function and a mutual diagnosis function. Further, the IC 23 includes a fail-safe control unit 43 that executes a predetermined fail-safe process when the diagnosis unit 39 to 42 diagnoses that there is an abnormality. The fail-safe control unit 43 includes a diagnosis unit 39 to 42. And controlling the output of the drive signal to the first circuit breaker 24 and the second circuit breaker 25 by controlling the first circuit breaker output unit 44 and the second circuit breaker output unit 45 according to the abnormality diagnosis result of Controls the output of a reset request signal to the CPU 22.

  In this case, the input system abnormality diagnosis unit 32 and the output system abnormality diagnosis unit 33 of the CPU 22 serve as input / output system abnormality diagnosis means, and the first self-diagnosis unit 34, the first mutual diagnosis unit 35, and the IC 23 of the CPU 22 are used. The second self-diagnosis unit 41 and the second mutual diagnosis unit 42 serve as control system abnormality detection means. Further, the fail safe control unit 36 of the CPU 22 and the fail safe control unit 43 of the IC 23 serve as fail safe control means.

  Further, when the fail safe control unit 36 of the CPU 22 outputs a drive signal to the first circuit breaker 24 or the second circuit breaker 25, the fail safe control unit 36 outputs the signal to the first circuit breaker output unit 37 and the second circuit breaker output unit 38. A control signal (that is, a control signal of the first circuit breaker 24 or the second circuit breaker 25) is also transmitted to the IC 23 and is driven from both the CPU 22 and the IC 23 to the first circuit breaker 24 and the second circuit breaker 25. Output a signal. Further, when the fail safe control unit 43 of the IC 23 outputs a drive signal to the first circuit breaker 24 or the second circuit breaker 25, the fail safe control unit 43 outputs the signal to the first circuit breaker output unit 44 and the second circuit breaker output unit 45. A control signal (that is, a control signal of the first circuit breaker 24 or the second circuit breaker 25) is also transmitted to the CPU 22 and driven from both the IC 23 and the CPU 22 to the first circuit breaker 24 and the second circuit breaker 25. Output a signal. Thereby, the redundancy of the system is improved.

Next, abnormality diagnosis executed by the ECU 21 (CPU 22 and IC 23) will be described.
The input system abnormality diagnosis unit 32 of the CPU 22 diagnoses the presence or absence of abnormality in the main accelerator sensor 19 and the sub accelerator sensor 20, respectively. As a result, when it is determined that the main accelerator sensor 19 is abnormal, the main accelerator sensor abnormality flag XMAPSNG is set to “1”, and when it is determined that the sub accelerator sensor 20 is abnormal, the sub accelerator sensor The abnormality flag XSAPSNG is set to “1”.

  Further, the input system abnormality diagnosis unit 32 of the CPU 22 diagnoses the presence or absence of abnormality in each of the main throttle opening sensor 13 and the sub throttle opening sensor 14. As a result, when it is determined that there is an abnormality in the main throttle opening sensor 13, the main throttle opening sensor abnormality flag XMTPSNG is set to “1” and it is determined that there is an abnormality in the sub-throttle opening sensor 14. The sub-throttle opening sensor abnormality flag XSTPSNG is set to “1”.

  Further, the input system abnormality diagnosis unit 32 of the CPU 22 individually diagnoses the presence / absence of abnormality in the A / D converter 26 for the main sensor, the A / D converter 27 for the sub sensor, and the digital input device 28. As a result, when it is determined that the main sensor A / D converter 26 is abnormal, the main A / D converter abnormality flag XMADNG is set to “1”, and the sub sensor A / D converter 27 is set. If it is determined that there is an abnormality, the sub A / D converter abnormality flag XSADNG is set to “1”.

  On the other hand, the output system abnormality diagnosis unit 33 of the CPU 22 diagnoses the presence or absence of abnormality in the throttle motor 11, the fuel injection valve 15, and the ignition device 17. As a result, when it is determined that there is an abnormality in the throttle motor 11, the throttle motor abnormality flag XSERVONG is set to “1”. If it is determined that there is an abnormality in the fuel injection valve 15, the fuel injection valve abnormality flag XINJNG is set to “1”. If it is determined that the ignition device 17 is abnormal, the ignition device abnormality flag XIGNG is set to “1”.

  The first self-diagnosis unit 34 of the CPU 22 and the second mutual diagnosis unit 42 of the IC 23 are an air control unit 29, a fuel control unit 30, an ignition control unit 31, an input system abnormality diagnosis unit 32, and an output system abnormality of the CPU 22. The diagnosis range is divided for each memory area corresponding to each control unit such as the diagnosis unit 33 and each abnormality diagnosis unit, and abnormality diagnosis is performed as follows. It should be noted that the diagnosis range may be divided for each function of the CPU 22 or for each peripheral device to perform abnormality diagnosis.

  First, the second mutual diagnosis unit 42 of the IC 23 transmits a code No. corresponding to the diagnosis request to the first self-diagnosis unit 34 of the CPU 22. For example, each code No. means the next diagnostic request.

Code NO.1: ROM check of the input system abnormality diagnosis unit 32 Code NO.2: RAM check of the input system abnormality diagnosis unit 32 Code NO.3: Instruction check of the input system abnormality diagnosis unit 32 Code NO.4: Air control unit ROM check code No. 5: RAM check of air control unit 29 Code No. 6: Instruction check of air control unit 29 Code NO. 7: ROM check of fuel control unit 30 Code NO. 8: Fuel control unit 30 RAM check Code NO.9: Instruction check of fuel control unit 30 Code NO.10: ROM check of ignition control unit 31 Code NO.11: RAM check of ignition control unit 31 Code NO.12: Instruction check of ignition control unit 31 Code No. 13: ROM check of output system abnormality diagnosis unit 33 Code No. 14: RAM check of output system abnormality diagnosis unit 33 De NO.15: Instruction check of the output system abnormality diagnosis section 33

  The second mutual diagnosis unit 42 of the IC 23 sends the codes NO. 1 to 15 to the first self-diagnosis unit 34 of the CPU 22 so as to finish all the diagnosis corresponding to these codes NO. 1 to 15 within a predetermined period. Is sent at random.

  The first self-diagnosis unit 34 of the CPU 22 sequentially executes the diagnosis corresponding to the code No. transmitted from the second mutual diagnosis unit 42 of the IC 23, and the air control unit 29, the fuel control unit 30, and the ignition control unit 31. The ROM check result (eg, sum value), the RAM check result (eg, sum value), and the instruction check result (eg, operation result value) for the input system abnormality diagnosis unit 32 and the output system abnormality diagnosis unit 33, respectively. Is returned to the second mutual diagnosis unit 42 of the IC 23.

  Further, the first self-diagnostic unit 34 of the CPU 22 performs the check result of the ROM check on the air control unit 29, the fuel control unit 30, the ignition control unit 31, the input system abnormality diagnosis unit 32, and the output system abnormality diagnosis unit 33, respectively. The check result of the RAM check and the check result of the instruction check are compared with a predetermined determination value to self-diagnose whether there is an abnormality.

  In addition, the second mutual diagnosis unit 42 of the IC 23 is configured such that the air control unit 29, the fuel control unit 30, the ignition control unit 31, the input system abnormality diagnosis unit 32, and the output system abnormality diagnosis unit 33 respectively The check result of the ROM check, the check result of the RAM check, and the check result of the instruction check returned from the diagnosis unit 34 are compared with a predetermined determination value to diagnose the presence or absence of an abnormality.

  As a result, if the first self-diagnosis unit 34 of the CPU 22 or the second mutual diagnosis unit 42 of the IC 23 determines that there is a minor abnormality in the ROM or RAM of the air control unit 29, the air control unit has a minor abnormality. The flag XCPUSERVERVOLG is set to “1”. If it is determined that there is a minor abnormality in the ROM or RAM of the fuel controller 30, the fuel controller minor abnormality flag XCPUINJLNG is set to "1". If it is determined that there is a minor abnormality in the ROM or RAM of the ignition control unit 31, the ignition control unit minor abnormality flag XCPUIGNLNG is set to "1". When it is determined that there is a serious abnormality in the control system (air control unit 29, fuel control unit 30, ignition control unit 31, etc.) of the CPU 22, the control system serious abnormality flag XCPUHNG is set to “1”.

  On the other hand, the second self-diagnosis unit 41 of the IC 23 and the first mutual diagnosis unit 35 of the CPU 22 diagnose the abnormality of the input system abnormality diagnosis unit 39, the output system abnormality diagnosis unit 40, etc. of the IC 23 as follows.

  First, the second self-diagnosis unit 41 of the IC 23 uses the counter values of the input system abnormality diagnosis unit 39 and the output system abnormality diagnosis unit 40, information such as the high / low state (high / low state), etc. In addition to transmitting to the diagnosis unit 35, the input system abnormality diagnosis unit 39 and the output system abnormality diagnosis unit 40 diagnose the presence or absence of abnormality based on the change of the counter value, the high / low state, etc., respectively.

  The first mutual diagnosis unit 35 of the CPU 22 changes the counter value transmitted from the second self-diagnosis unit 41 of the IC 23, the high / low state, etc. for the input system abnormality diagnosis unit 39 and the output system abnormality diagnosis unit 40, respectively. Diagnose the presence or absence of abnormalities based on the above.

  Next, the fail-safe process executed when abnormality is detected by the ECU 21 (CPU 22 and IC 23) will be described with reference to FIG.

  (A) When it is determined that there is an abnormality in the main accelerator sensor 19 (when the main accelerator sensor abnormality flag XMAPSNG = 1), the fail safe control unit 36 of the CPU 22 and the fail safe control unit 43 of the IC 23 The output of the drive signal to the second circuit breakers 24 and 25 is prohibited, and both the first and second circuit breakers 24 and 25 are not operated (both the throttle opening is not fixed and the fuel cut is not performed). . Then, the use of the output (failure signal) of the main accelerator sensor 19 is prohibited, and the sensor for detecting the accelerator operation amount is switched from the main accelerator sensor 19 to the sub accelerator sensor 20, and when the brake is depressed (when the brake switch is turned on). Is the accelerator fully closed (accelerator operation amount = 0).

  (B) When it is determined that there is an abnormality in the sub accelerator sensor 20 (when the sub accelerator sensor abnormality flag XSAPSNG = 1), the fail safe control unit 36 of the CPU 22 and the fail safe control unit 43 of the IC 23 The output of the drive signal to the second circuit breakers 24 and 25 is prohibited, and both the first and second circuit breakers 24 and 25 are not operated (both the throttle opening is not fixed and the fuel cut is not performed). . When the brake is depressed (when the brake switch is on), the accelerator is fully closed (accelerator operation amount = 0).

  (C) When it is determined that there is an abnormality in the main throttle opening sensor 13 (when the main throttle opening sensor abnormality flag XMTPSNG = 1), the fail safe control unit 36 of the CPU 22 and the fail safe control unit 43 of the IC 23 are The output of the drive signal to the first and second circuit breakers 24 and 25 is prohibited, and both the first and second circuit breakers 24 and 25 are not operated (both the throttle opening is fixed and the fuel is cut). Neither.) Then, the use of the output (failure signal) of the main throttle opening sensor 13 is prohibited, the sensor for detecting the throttle opening is switched from the main throttle opening sensor 13 to the sub-throttle opening sensor 14, and the target throttle opening sensor The change speed (or change amount) is limited by a predetermined guard value to limit the change speed (or change amount) of the actual throttle opening.

  (D) When it is determined that there is an abnormality in the sub-throttle opening sensor 14 (when the sub-throttle opening sensor abnormality flag XSTPSNG = 1), the fail-safe control unit 36 of the CPU 22 and the fail-safe control unit 43 of the IC 23 are The output of the drive signal to the first and second circuit breakers 24 and 25 is prohibited, and both the first and second circuit breakers 24 and 25 are not operated (both the throttle opening is fixed and the fuel is cut). Neither.) Then, the change speed (or change amount) of the target throttle opening is limited by a predetermined guard value to limit the change speed (or change amount) of the actual throttle opening.

  (E) When it is determined that there is an abnormality in the A / D converter 26 for the main sensor (when the main A / D converter abnormality flag XMADNG = 1), the fail safe control unit 36 of the CPU 22 and the IC 23 fail. The safe control unit 43 prohibits the output of the drive signal to the first and second circuit breakers 24 and 25 and does not operate both the first and second circuit breakers 24 and 25 (fixing the throttle opening). And neither fuel cut.) Then, the use of the output (failure signal) of the main accelerator sensor 19 is prohibited, and the sensor for detecting the accelerator operation amount is switched from the main accelerator sensor 19 to the sub accelerator sensor 20, and when the brake is depressed (when the brake switch is turned on). Is the accelerator fully closed (accelerator operation amount = 0). Further, the use of the output (failure signal) of the main throttle opening sensor 13 is prohibited, the sensor for detecting the throttle opening is switched from the main throttle opening sensor 13 to the sub-throttle opening sensor 14, and the target throttle opening sensor The change speed (or change amount) is limited by a predetermined guard value to limit the change speed (or change amount) of the actual throttle opening.

  (F) When it is determined that there is an abnormality in the sub sensor A / D converter 27 (when the sub A / D converter abnormality flag XSADNG = 1), the fail safe control unit 36 of the CPU 22 and the fail safe of the IC 23 The control unit 43 prohibits the output of the drive signal to the first and second circuit breakers 24 and 25 and does not operate both the first and second circuit breakers 24 and 25 (fixing the throttle opening degree). Do not perform both fuel cuts). When the brake is depressed (when the brake switch is on), the accelerator is fully closed (accelerator operation amount = 0). Further, the change speed (or change amount) of the target throttle opening is limited by a predetermined guard value to limit the change speed (or change amount) of the actual throttle opening.

  (G) When it is determined that there is an abnormality in the throttle motor 11 (when the throttle motor abnormality flag XSERVONG = 1), the fail-safe control unit 36 of the CPU 22 and the fail-safe control unit 43 of the IC 23 By outputting a drive signal to 24 and operating the first circuit breaker 24, the power supply to the throttle motor 11 is cut off and the throttle opening is fixed to the opener opening. In addition, the output of the drive signal to the 2nd circuit breaker 25 is prohibited, and the 2nd circuit breaker 25 is not operated (a fuel cut is not implemented).

  (H) When it is determined that there is an abnormality in the fuel injection valve 15 (when the fuel injection valve abnormality flag XINJNG = 1), the fail safe control unit 36 of the CPU 22 and the fail safe control unit 43 of the IC 23 are in an abnormal state ( For example, by operating the second circuit breaker 25 by outputting a drive signal to the second circuit breaker 25 in accordance with an operation state (for example, engine speed) determined by an abnormality degree or the number of cylinders in which an abnormality has occurred) Depending on the state, the power supply to the fuel injection valve 15 and the fuel supply are cut off to perform fuel cut. The output of the drive signal to the first circuit breaker 24 is prohibited and the first circuit breaker 24 is not operated (the throttle opening is not fixed).

  (I) When it is determined that there is an abnormality in the ignition device 17 (ignition device abnormality flag XIGNG = 1), the fail safe control unit 36 of the CPU 22 and the fail safe control unit 43 of the IC 23 are in an abnormal state (for example, abnormal A driving signal is output to the second circuit breaker 25 in accordance with an operation state (for example, engine speed) determined by the degree or the number of cylinders in which an abnormality has occurred, and the second circuit breaker 25 is operated to enter the operation state. Accordingly, the fuel cut is performed by shutting off the power supply and fuel supply to the fuel injection valve 15. The output of the drive signal to the first circuit breaker 24 is prohibited and the first circuit breaker 24 is not operated (the throttle opening is not fixed).

  (J) When it is determined that there is a minor abnormality in the ROM or RAM of the air control unit 29 (when the air control unit minor abnormality flag XCPUSERVERVOL = 1), the fail safe control unit 36 of the CPU 22 and the fail safe control of the IC 23 The unit 43 outputs a drive signal to the first circuit breaker 24 to operate the first circuit breaker 24, thereby cutting off the power supply to the throttle motor 11 and fixing the throttle opening to the opener opening. . In addition, the output of the drive signal to the 2nd circuit breaker 25 is prohibited, and the 2nd circuit breaker 25 is not operated (a fuel cut is not implemented).

  (K) When it is determined that there is a minor abnormality in the ROM or RAM of the fuel control unit 30 (when the fuel control unit minor abnormality flag XCPUINJLNG = 1), the failsafe control unit 36 of the CPU 22 and the failsafe control of the IC 23 The unit 43 outputs a drive signal to the second circuit breaker 25 in accordance with the operating state (for example, engine rotation speed) and operates the second circuit breaker 25, thereby causing the fuel injection valve 15 to respond to the operating state. Cut off the power supply and fuel supply of the car and cut the fuel. The output of the drive signal to the first circuit breaker 24 is prohibited and the first circuit breaker 24 is not operated (the throttle opening is not fixed).

  (L) When it is determined that there is a minor abnormality in the ROM or RAM of the ignition control unit 31 (when the ignition control unit minor abnormality flag XCPUIGLNG = 1), the fail-safe control unit 36 of the CPU 22 and the fail-safe control of the IC 23 The unit 43 outputs a drive signal to the second circuit breaker 25 in accordance with the operating state (for example, engine rotation speed) and operates the second circuit breaker 25, thereby causing the fuel injection valve 15 to respond to the operating state. Cut off the power supply and fuel supply of the car and cut the fuel. The output of the drive signal to the first circuit breaker 24 is prohibited and the first circuit breaker 24 is not operated (the throttle opening is not fixed).

  (M) When it is determined that there is a serious abnormality in the control system of the CPU 22 (air control unit 29, fuel control unit 30, ignition control unit 31, etc.) (when the control system severe abnormality flag XCPUHNG = 1), the CPU 22 The fail-safe control unit 36 of the IC and the fail-safe control unit 43 of the IC 23 output a drive signal to the first circuit breaker 24 and operate the first circuit breaker 24 to cut off the power supply to the throttle motor 11. Then, the throttle opening is fixed to the opener opening, and a drive signal is output to the second circuit breaker 25 to operate the second circuit breaker 25, whereby power supply and fuel supply to the fuel injection valve 15 are performed. Shut off and cut fuel. Further, the CPU 22 outputs a reset request signal to the IC 23 and outputs a reset request signal from the IC 23 to the CPU 22 to stop the engine.

  In this way, when an abnormality is detected, depending on the degree and content of the abnormality, the use of the abnormal sensor output (failure signal) is prohibited, the sensor to be used is switched, the accelerator operation amount is corrected according to the brake state, the actual throttle Fail-safe processing such as limiting the rate of change (or amount of change) of the opening, fixing the throttle opening, fuel cut, reset request signal output, etc. are executed in stages, so that the minimum fail required for safety Perform safe processing.

  The fail-safe process described above is executed by the ECU 21 according to the programs shown in FIGS. Hereinafter, the processing contents of each of these programs will be described.

[Fail-safe processing program]
The fail safe processing program shown in FIG. 3 is executed at a predetermined cycle while the ECU 21 is powered on. When this program is started, first, in step 101, an accelerator-related processing program shown in FIGS. 4 and 5 described later is executed, thereby performing A / D conversion for the main accelerator sensor 19, the sub accelerator sensor 20, and the main sensor. When an accelerator-related abnormality is detected in the detector 26, the sub-sensor A / D converter 27, etc., fail-safe processing corresponding to the content of the abnormality is executed.

  Thereafter, the process proceeds to step 102, and a throttle-related processing program shown in FIGS. 6 and 7 to be described later is executed, whereby the main throttle opening sensor 13, the sub-throttle opening sensor 14, and the A / D converter 26 for the main sensor. When a throttle-related abnormality is detected in the sub-sensor A / D converter 27 and the like, a fail-safe process corresponding to the content of the abnormality is executed.

  Thereafter, the process proceeds to step 103 and executes a shut-off process request program shown in FIGS. 8 and 9 to be described later, so that the control system of the CPU 22 (air control unit 29, fuel control unit 30, ignition control unit 31, etc.), throttle motor 11. When an abnormality is detected in the fuel injection valve 15, the ignition device 17, etc., a cutoff processing request is set according to the degree of abnormality (severity), and then the routine proceeds to step 104, where the cutoff processing shown in FIGS. By executing the program, fail-safe processing corresponding to the shut-off processing request is executed.

[Accel-related processing program]
The accelerator-related processing program shown in FIGS. 4 and 5 is a subroutine executed in step 101 of the fail-safe processing program shown in FIG. When this program is started, first, in step 201, it is determined whether or not at least one of the main accelerator sensor abnormality flag XMAPSNG and the main A / D converter abnormality flag XMADNG is set to “1”.

  If it is determined in step 201 that both the main accelerator sensor abnormality flag XMAPSNG and the main A / D converter abnormality flag XMADNG are “0”, that is, the A / D conversion for the main accelerator sensor 19 and the main sensor. If it is determined that both of the devices 26 are normal, the routine proceeds to step 202, where the main accelerator sensor use prohibition flag XMAPSUS is reset to “0”.

  Thereafter, the process proceeds to step 203, in which it is determined whether or not at least one of the sub accelerator sensor abnormality flag XSAPSNG and the sub A / D converter abnormality flag XSADNG is set to “1”.

  If it is determined in step 203 that the sub accelerator sensor abnormality flag XSAPSNG and the sub A / D converter abnormality flag XSADNG are both “0”, that is, the sub accelerator sensor 20 and the sub sensor A / D converters. If both are determined to be normal, the process proceeds to step 206, the sub accelerator sensor use prohibition flag XSAPSUS is reset to “0”, and then the process proceeds to step 209, where the brake correction flag XBR is set to “0”. Reset.

  On the other hand, if it is determined in step 203 that at least one of the sub accelerator sensor abnormality flag XSAPSNG and the sub A / D converter abnormality flag XSADNG is set to “1”, that is, the sub accelerator sensor 20 If it is determined that at least one of the sub-sensor A / D converters 27 is abnormal, the process proceeds to step 207, the sub accelerator sensor use prohibition flag XSAPSUS is set to “1”, and then to step 210. Then, the brake correction flag XBR is set to “1”.

  If it is determined in step 201 that at least one of the main accelerator sensor abnormality flag XMAPSNG and the main A / D converter abnormality flag XMADNG is set to “1”, that is, the main accelerator sensor 19 When it is determined that at least one of the A / D converters 26 for the main sensor is abnormal, the process proceeds to step 204, and the main accelerator sensor use prohibition flag XMAPSUS is set to “1”.

  Thereafter, the process proceeds to step 205, in which it is determined whether or not at least one of the sub accelerator sensor abnormality flag XSAPSNG and the sub A / D converter abnormality flag XSADNG is set to “1”.

  If it is determined in step 205 that both the sub accelerator sensor abnormality flag XSAPSNG and the sub A / D converter abnormality flag XSADNG are “0”, that is, the sub accelerator sensor 20 and the A / D converter for the sub sensor. If it is determined that both are normal, the process proceeds to step 208, the sub accelerator sensor use prohibition flag XSAPSUS is reset to “0”, then the process proceeds to step 210, and the brake correction flag XBR is set to “1”. set.

  On the other hand, if it is determined in step 205 that at least one of the sub accelerator sensor abnormality flag XSAPSNG and the sub A / D converter abnormality flag XSADNG is set to “1”, that is, the sub accelerator sensor 20 If it is determined that at least one of the sub-sensor A / D converters 27 is abnormal, the process proceeds to step 207, the sub accelerator sensor use prohibition flag XSAPSUS is set to “1”, and then to step 210. Then, the brake correction flag XBR is set to “1”.

  Thereafter, the process proceeds to step 211 in FIG. 5 to determine whether or not the main accelerator sensor use prohibition flag XMAPSUS is “0”, and when it is determined that the main accelerator sensor use prohibition flag XMAPSUS is “0”. Proceeds to step 213, permits the use of the output of the main accelerator sensor 19, and adopts the detected value of the main accelerator sensor 19 as the accelerator operation amount.

  On the other hand, when it is determined in step 211 that the main accelerator sensor use prohibition flag XMAPSUS is “1”, the process proceeds to step 212, and whether the sub accelerator sensor use prohibition flag XSAPSUS is “0”. Determine whether or not.

  If it is determined in this step 212 that the sub accelerator sensor use prohibition flag XSAPSUS is “0”, the process proceeds to step 214 to prohibit the use of the output (failure signal) of the main accelerator sensor 19 and the accelerator operation. The sensor for detecting the amount is switched from the main accelerator sensor 19 to the sub accelerator sensor 20, and the detection value of the sub accelerator sensor 20 is adopted as the accelerator operation amount.

  On the other hand, when it is determined in step 211 that the main accelerator sensor use prohibition flag XMAPSUS is “1”, and in step 212, the sub accelerator sensor use prohibition flag XSAPSUS is determined to be “1”. In step 215, use of the outputs (failure signals) of both the main accelerator sensor 19 and the sub accelerator sensor 20 is prohibited, and the accelerator operation amount is set to a fixed value.

  Thereafter, the process proceeds to step 216, where it is determined whether or not the brake correction flag XBR is “1”. If it is determined that the brake correction flag XBR is “0”, the present program is terminated as it is.

  On the other hand, if it is determined in step 216 that the brake correction flag XBR is “1”, the process proceeds to step 217, where it is determined whether the brake is depressed by whether the brake switch is turned on.

  If it is determined in step 217 that the brake is depressed, the process proceeds to step 218, where the accelerator operation amount is set to the accelerator fully closed value (for example, 0), and in step 217, the brake is not depressed. If it is determined, the routine proceeds to step 219, where the smoothed value of the brake return amount is adopted as the current accelerator operation amount.

[Throttle-related processing program]
The throttle related processing program shown in FIGS. 6 and 7 is a subroutine executed in step 102 of the fail safe processing program of FIG. When this program is started, first, at step 301, it is determined whether or not at least one of the main throttle opening sensor abnormality flag XMTPSNG and the main A / D converter abnormality flag XMADNG is set to “1”. To do.

  If it is determined in step 301 that both the main throttle opening sensor abnormality flag XMTPSNG and the main A / D converter abnormality flag XMADNG are “0”, that is, the main throttle opening sensor 13 and the main sensor When it is determined that both of the A / D converters 26 are normal, the process proceeds to step 302, and the main throttle opening sensor use prohibition flag XMTPSUS is reset to “0”.

  Thereafter, the process proceeds to step 303, in which it is determined whether or not at least one of the sub-throttle opening sensor abnormality flag XSTPSNG and the sub-A / D converter abnormality flag XSADNG is set to “1”.

  If it is determined in step 303 that both the sub-throttle opening sensor abnormality flag XSTPSNG and the sub-A / D converter abnormality flag XSADNG are “0”, that is, the sub-throttle opening sensor 14 and the sub-sensor A If it is determined that both of the D / D converters 27 are normal, the process proceeds to step 306, the sub-throttle opening sensor use prohibition flag XSTPSUS is reset to “0”, and then the process proceeds to step 309 where the actual throttle is opened. There are no restrictions on the rate of change or the amount of change.

  On the other hand, if it is determined in step 303 that at least one of the sub-throttle opening sensor abnormality flag XSTPSNG and the sub-A / D converter abnormality flag XSADNG is set to “1”, that is, the sub-throttle opening If it is determined that at least one of the degree sensor 14 and the sub-sensor A / D converter 27 is abnormal, the process proceeds to step 307 and the sub-throttle opening sensor use prohibition flag XSTPSSUS is set to “1”. After that, the routine proceeds to step 310, where the change speed (or change amount) of the target throttle opening is limited by a predetermined guard value to limit the change speed (or change amount) of the actual throttle opening.

  If it is determined in step 301 that at least one of the main throttle opening sensor abnormality flag XMTPSNG and the main A / D converter abnormality flag XMADNG is set to “1”, that is, the main throttle opening When it is determined that at least one of the degree sensor 13 and the A / D converter 26 for the main sensor is abnormal, the process proceeds to step 304, and the main throttle opening sensor use prohibition flag XMTPSUS is set to “1”. set.

  Thereafter, the process proceeds to step 305, in which it is determined whether or not at least one of the sub-throttle opening sensor abnormality flag XSTPSNG and the sub-A / D converter abnormality flag XSADNG is set to “1”.

  If it is determined in step 305 that both the sub-throttle opening sensor abnormality flag XSPSNG and the sub-A / D converter abnormality flag XSADNG are “0”, that is, the sub-throttle opening sensor 14 and the sub-sensor A If it is determined that both of the D / D converters 27 are normal, the process proceeds to step 308 to reset the sub-throttle opening sensor use prohibition flag XSTPSUS to “0”, and then proceeds to step 310 to open the target throttle. The rate of change (or amount of change) of the degree is limited by a predetermined guard value to limit the rate of change (or amount of change) of the actual throttle opening.

  On the other hand, if it is determined in step 305 that at least one of the sub-throttle opening sensor abnormality flag XSTPSNG and the sub-A / D converter abnormality flag XSADNG is set to “1”, that is, the sub-throttle opening If it is determined that at least one of the degree sensor 14 and the sub-sensor A / D converter 27 is abnormal, the process proceeds to step 307 and the sub-throttle opening sensor use prohibition flag XSTPSSUS is set to “1”. After that, the routine proceeds to step 310, where the change speed (or change amount) of the target throttle opening is limited by a predetermined guard value to limit the change speed (or change amount) of the actual throttle opening.

  Thereafter, the process proceeds to Step 311 in FIG. 7 to determine whether or not the main throttle opening sensor use prohibition flag XMTPSSUS is “0”, and to determine that the main throttle opening sensor use prohibition flag XMTPSSUS is “0”. If YES, the process proceeds to step 313, the use of the main throttle opening sensor 13 is permitted, and the detected value of the main throttle opening sensor 13 is adopted as the actual throttle opening. The system abnormality flag XTPSBNG is reset to “0”.

  On the other hand, if it is determined in step 311 that the main throttle opening sensor use prohibition flag XMTPSUS is “1”, the process proceeds to step 312 and the sub throttle opening sensor use prohibition flag XSTPSSUS is set to “0”. Is determined.

  If it is determined in step 312 that the sub-throttle opening sensor use prohibition flag XSTPSUS is “0”, the process proceeds to step 314 to prohibit use of the output (failure signal) of the main throttle opening sensor 13. Then, the sensor for detecting the throttle opening is switched from the main throttle opening sensor 13 to the sub-throttle opening sensor 14, the detection value of the sub-throttle opening sensor 14 is adopted as the actual throttle opening, and the process proceeds to step 316. Both throttle system abnormality flags XTPSBNG are reset to “0”.

  On the other hand, it is determined in step 311 that the main throttle opening sensor use prohibition flag XMTPSUS is “1”, and in step 312 it is determined that the sub throttle opening sensor use prohibition flag XSTPSUS is “1”. In this case, the process proceeds to step 315, the use of the outputs (failure signals) of both the main throttle opening sensor 13 and the sub throttle opening sensor 14 is prohibited, and the actual throttle opening is set to a fixed value (for example, opener opening). Then, the routine proceeds to step 317, where both throttle system abnormality flags XTPSBNG are set to "1".

[Blocking request program]
The shut-off process request program shown in FIGS. 8 and 9 is a subroutine executed in step 103 of the fail-safe process program in FIG. When this program is started, first, at step 401, it is determined whether or not the control system severe abnormality flag XCPUHNG is set to "1", and the control system severe abnormality flag XCPUHNG is set to "1". If it is determined, that is, if it is determined that there is a serious abnormality in the control system of the CPU 22 (air control unit 29, fuel control unit 30, ignition control unit 31, etc.), the routine proceeds to step 405 and the abnormality level NGLEVEL is set. Set to “4”.

  Further, if it is determined in step 402 that at least one of the fuel controller minor abnormality flag XCPUINJLNG and the ignition controller minor abnormality flag XCPUIGLNG is set to “1”, that is, the fuel controller 30 of the CPU 22 If it is determined that there is a slight abnormality, or if it is determined that there is a slight abnormality in the ignition control unit 31 of the CPU 22, the process proceeds to step 406 and the abnormality level NGLEVEL is set to “3”.

  If it is determined in step 403 that at least one of the fuel injection valve abnormality flag XINJNG and the ignition device abnormality flag XIGNG is set to “1”, that is, it is determined that the fuel injection valve 15 is abnormal. If it is determined that there is an abnormality in the ignition device 17, the process proceeds to step 407 and the abnormality level NGLEVEL is set to “2”.

  If it is determined in step 404 that at least one of the throttle motor abnormality flag XSERVONG, the air control unit minor abnormality flag XCPUSERVERVOL, and both throttle system abnormality flags XTSBNG is set to “1”, that is, the throttle motor 11 or when it is determined that there is a slight abnormality in the air control unit 29 of the CPU 22, or at least one of the main throttle opening sensor 13 and the A / D converter 26 for the main sensor. If it is determined that one of them is abnormal and at least one of the sub-throttle opening sensor 14 and the A / D converter 27 for sub-sensor is determined to be abnormal, the process proceeds to step 408 and the abnormal level NGLEVEL is reached. Is set to “1”.

  If it is determined in step 404 that the throttle motor abnormality flag XSERVONG, the air control unit minor abnormality flag XCPUSERVERVOLG, and both the throttle system abnormality flags XTPSBNG are all “0”, the process proceeds to step 409 and the abnormality level NGLEVEL Is set to “0”.

  Thereafter, the process proceeds to step 410 in FIG. 9 to determine whether or not the abnormal level NGLEVEL is “4” or higher. If it is determined that the abnormal level NGLEVEL is “4” or higher, the process proceeds to step 414. The first circuit breaker operation flag XOUT1, the second circuit breaker high rotation side operation flag XOUT2H, and the second circuit breaker low rotation side operation flag XOUT2L are all set to “1”.

  If it is determined in step 411 that the abnormal level NGLEVEL is “3”, the process proceeds to step 415 where the first circuit breaker operation flag XOUT1 is reset to “0” and the second circuit breaker high Both the rotation side operation flag XOUT2H and the second circuit breaker low rotation side operation flag XOUT2L are set to “1”.

  If it is determined in step 412 that the abnormal level NGLEVEL is “2”, the process proceeds to step 416, where both the first circuit breaker operation flag XOUT1 and the second circuit breaker high rotation side operation flag XOUT2H are set. Both are reset to “0”, and the second circuit breaker low rotation side operation flag XOUT2L is set to “1”.

  If it is determined in step 413 that the abnormal level NGLEVEL is “1”, the process proceeds to step 417 where the first circuit breaker operation flag XOUT1 is set to “1” and the second circuit breaker high level is set. Both the rotation side operation flag XOUT2H and the second circuit breaker low rotation side operation flag XOUT2L are reset to “0”.

  If it is determined in step 413 that the abnormal level NGLEVEL is "0", the process proceeds to step 418, where the first circuit breaker operation flag XOUT1 and the second circuit breaker high rotation side operation flag XOUT2H are set. All the second circuit breaker low rotation side operation flags XOUT2L are reset to “0”.

[Blocking program]
The blocking processing program shown in FIGS. 10 and 11 is a subroutine executed in step 104 of the fail-safe processing program in FIG. When this program is started, first, in step 501, at least one of the second circuit breaker high rotation side operation flag XOUT2H and the second circuit breaker low rotation side operation flag XOUT2L is set to "1". It is determined whether or not.

  If it is determined in step 501 that both the second circuit breaker high rotation side operation flag XOUT2H and the second circuit breaker low rotation side operation flag XOUT2L are “0”, the process proceeds to step 505, where the fuel After requesting permission of the injection to the IC 23, the process proceeds to step 506, and the CPU 22 permits fuel injection. In this case, both the fail safe control unit 36 of the CPU 22 and the fail safe control unit 43 of the IC 23 prohibit the output of the drive signal to the second circuit breaker 25 and do not operate the second circuit breaker 25 (fuel). Do not cut).

  On the other hand, in step 501, it is determined that at least one of the second circuit breaker high rotation side operation flag XOUT2H and the second circuit breaker low rotation side operation flag XOUT2L is set to “1”. If YES in step 502, the flow advances to step 502 to determine whether or not the engine speed is lower than a low rotation side predetermined value L (for example, 2000 rpm), and it is determined that the engine rotation speed is lower than the low rotation side predetermined value L. If YES in step 505, the CPU 23 requests the IC 23 to permit fuel injection, and then proceeds to step 506 where the CPU 22 permits fuel injection. In this case, both the fail safe control unit 36 of the CPU 22 and the fail safe control unit 43 of the IC 23 prohibit the output of the drive signal to the second circuit breaker 25 and do not operate the second circuit breaker 25 (fuel). Do not cut).

  On the other hand, if it is determined in step 502 that the engine speed is equal to or higher than the low rotation side predetermined value L, the process proceeds to step 503, where the second circuit breaker high rotation side operation flag XOUT2H is “0”. If the second circuit breaker high rotation side operation flag XOUT2H is determined to be “0”, that is, the second circuit breaker low rotation side operation flag XOUT2L is set to “1”. If YES in step 507, the IC 23 requests the IC 23 to prohibit fuel injection, and then proceeds to step 508 where the CPU 22 prohibits fuel injection. In this case (that is, when the second circuit breaker low rotation side operation flag XOUT2L = 1 and the engine speed is equal to or higher than the low rotation side predetermined value L), both the fail safe control unit 36 of the CPU 22 and the fail safe control unit 43 of the IC 23 In both cases, a drive signal is output to the second circuit breaker 25 to operate the second circuit breaker 25, whereby the power supply and fuel supply to the fuel injection valve 15 are interrupted to cut the fuel.

  If it is determined in step 503 that the second circuit breaker high rotation side operation flag XOUT2H is set to “1”, the process proceeds to step 504, where the engine speed is set to the high rotation side predetermined value H ( For example, if the engine speed is determined to be lower than the high rotation side predetermined value H, the process proceeds to step 505, and after requesting the IC 23 to permit fuel injection, In step 506, the CPU 22 permits fuel injection. In this case, both the fail safe control unit 36 of the CPU 22 and the fail safe control unit 43 of the IC 23 prohibit the output of the drive signal to the second circuit breaker 25 and do not operate the second circuit breaker 25 (fuel). Do not cut).

  On the other hand, if it is determined in step 504 that the engine speed is equal to or higher than the predetermined value H on the high rotation side, the process proceeds to step 507, after requesting the IC 23 to prohibit fuel injection, the process proceeds to step 508, and the CPU 22 Prohibit fuel injection. In this case (that is, when the second circuit breaker high rotation side operation flag XOUT2H = 1 and the engine rotation speed is equal to or higher than the high rotation side predetermined value H), both the fail safe control unit 36 of the CPU 22 and the fail safe control unit 43 of the IC 23 In both cases, a drive signal is output to the second circuit breaker 25 to operate the second circuit breaker 25, whereby the power supply and fuel supply to the fuel injection valve 15 are interrupted to cut the fuel.

  Thereafter, the process proceeds to step 509 in FIG. 11, and the first circuit breaker operation flag XOUT1, the second circuit breaker high rotation side operation flag XOUT2H, and the second circuit breaker low rotation side operation flag XOUT2L are all set to “1”. It is determined whether or not it has been done.

  In this step 509, it is determined that the first circuit breaker operation flag XOUT1, the second circuit breaker high rotation side operation flag XOUT2H, and the second circuit breaker low rotation side operation flag XOUT2L are all set to “1”. If this is the case (that is, if the abnormal level NGLEVEL is “4”), the process proceeds to step 510 where a reset request signal is output from the CPU 22 to the IC 23 and a reset request signal is output from the IC 23 to the CPU 22 to stop the engine. .

  On the other hand, at step 509, at least one of the first circuit breaker operation flag XOUT1, the second circuit breaker high rotation side operation flag XOUT2H, and the second circuit breaker low rotation side operation flag XOUT2L is “0”. If it is determined, the process proceeds to step 511 to determine whether or not the first circuit breaker operation flag XOUT1 is set to “1”.

  If it is determined in step 511 that the first circuit breaker operation flag XOUT1 is “0”, the process proceeds to step 512, the CPU 22 permits the throttle opening control, and then proceeds to step 513 to open the throttle. The IC 23 is requested to permit the degree control. In this case, both the fail safe control unit 36 of the CPU 22 and the fail safe control unit 43 of the IC 23 prohibit the output of the drive signal to the first circuit breaker 24 and do not operate the first circuit breaker 24 (throttle). Do not fix the opening).

  On the other hand, if it is determined in step 511 that the first circuit breaker operation flag XOUT1 is set to “1”, the process proceeds to step 514, and after the CPU 22 prohibits the throttle opening control, step 515 is performed. Then, the IC 23 is requested to prohibit the throttle opening control. In this case, both the fail-safe control unit 36 of the CPU 22 and the fail-safe control unit 43 of the IC 23 output a drive signal to the first circuit breaker 24 to operate the first circuit breaker 24, whereby the throttle motor 11. The power supply to is cut off and the throttle opening is fixed at the opener opening.

  In the present embodiment described above, a drive signal can be output from the CPU 22 to the first and second circuit breakers 24 and 25, and a drive signal can also be output from the IC 23 to the first and second circuit breakers 24 and 25. Even if the fuel injection amount and the ignition timing cannot be normally controlled due to the abnormality of the CPU 22, the drive signal is output from the IC 23 to the second circuit breaker 25 when the abnormality is detected. The fail-safe process to be performed can be executed, and safety at the time of abnormality detection can be sufficiently ensured.

  Moreover, when an abnormality is detected, depending on the degree and content of the abnormality, the use of abnormal sensor output (failure signal) is prohibited, the sensor to be used is switched, the accelerator operation amount is corrected according to the brake state, and the actual throttle opening Performs fail-safe processing such as limiting the speed of change (or amount of change), fixing throttle opening, fuel cut, reset request signal, etc. in stages, and performing the minimum fail-safe processing necessary for safety Since it is executed, it is possible to solve the problem of the prior art that uniformly fixes the throttle opening when an abnormality is detected.

  In the present embodiment, the fail safe control unit 36 of the CPU 22 and the fail safe control unit 43 of the IC 23 transmit the control signals of the first circuit breaker 24 and the second circuit breaker 25 to both the CPU 22 and the IC 23. Since the drive signal is output to the first circuit breaker 24 and the second circuit breaker 25, there is an advantage that the redundancy of the system can be improved.

  In addition, in a system that executes lean control that controls the air-fuel ratio of the engine to lean and ignition delay control that retards the ignition timing, the lean operation region that executes lean control and the ignition retarded operation that performs ignition delay control When the abnormality is detected in the region, if the throttle opening is uniformly fixed to a predetermined opening and the intake air amount is fixed to a predetermined amount, there is a possibility that stable running performance may not be obtained. When the abnormality is detected, fail-safe processing is executed in stages according to the degree and content of the abnormality, and the minimum fail-safe processing necessary for safety is executed, so that stable driving performance is obtained. Is possible.

  In the above-described embodiment, the fuel cut and the power supply to the fuel injection valve 15 are cut off by the second circuit breaker 25, and the fuel cut is executed. The control signal and the power supply may be cut off to stop the ignition operation of the ignition device 17. Alternatively, the second circuit breaker 25 cuts off the fuel supply and power supply to the fuel injection valve 15 to execute fuel cut, and cuts off the control signal and power supply to the ignition device 17 to cut off the ignition device 17. The ignition operation may be stopped.

  Further, in the above embodiment, when it is determined that there is an abnormality in the fuel injection valve 15 or the ignition device 17, or when it is determined that there is a slight abnormality in the ROM or RAM of the fuel control unit 30 or the ignition control unit 31, The fuel cut is executed by outputting a drive signal to the second circuit breaker 25 according to the engine speed, but the present invention is not limited to this, but the engine speed, engine load, vehicle speed, accelerator operation amount, throttle opening A drive signal may be output to the second circuit breaker 25 in response to at least one of the signals reflecting the vehicle operating state such as the degree, and the fuel cut or the ignition operation may be stopped.

It is a block diagram which shows schematic structure of the engine control system in one Example of this invention. It is a figure for demonstrating the fail safe process at the time of abnormality detection. It is a flowchart explaining the flow of a process of a fail safe process program. It is a flowchart (the 1) explaining the flow of a process of an accelerator related process program. It is a flowchart (the 2) explaining the flow of a process of an accelerator related process program. It is a flowchart (the 1) explaining the flow of a process of a throttle related process program. It is a flowchart (the 2) explaining the flow of a process of a throttle related process program. It is a flowchart (the 1) explaining the flow of a process of the interruption | blocking process request program. It is a flowchart (the 2) explaining the flow of a process of the interruption | blocking process request program. It is a flowchart (the 1) explaining the flow of a process of the interruption | blocking process program. It is a flowchart (the 2) explaining the flow of a process of the interruption | blocking process program.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 11 ... Throttle motor, 12 ... Throttle valve, 13 ... Main throttle opening sensor, 14 ... Sub-throttle opening sensor, 15 ... Fuel injection valve, 16 ... Spark plug, 17 ... Ignition device, 19 ... Main accelerator sensor, 20 ... Sub accelerator sensor, 21 ... ECU, 22 ... CPU (first integrated circuit), 23 ... IC (second integrated circuit), 24 ... first circuit breaker (first breaking means), 25 ... second Circuit breaker (second circuit breaker), 26 ... A / D converter for main sensor, 27 ... A / D converter for sub sensor, 29 ... Air control unit, 30 ... Fuel control unit, 31 ... Ignition control unit 32 ... Input system abnormality diagnosis unit (input / output system abnormality diagnosis means), 33 ... Output system abnormality diagnosis unit (input / output system abnormality diagnosis means), 34 ... First self diagnosis part (first self diagnosis means), 35. First mutual diagnosis section (first Mutual diagnosis means), 36... Fail safe control section (fail safe control means), 41... Second self diagnosis section (second self diagnosis means), 42. ), 43... Failsafe control unit (failsafe control means)

Claims (11)

Based on the output of at least one of the plurality of accelerator sensors that detect the operation amount of the accelerator pedal and the output of at least one of the plurality of throttle opening sensors that detect the opening of the throttle valve, the throttle valve A control device for an internal combustion engine that controls a throttle motor that adjusts the opening of
A first shut-off means for returning the throttle opening to a predetermined opening by shutting off power supply to the throttle motor;
A second shut-off means for stopping at least one of fuel injection of the fuel injection valve and ignition operation of the ignition device;
A first integrated circuit that outputs a control signal to the internal combustion engine drive device including the throttle motor and outputs a drive signal to the first and second shut-off means;
A second integrated circuit that cooperates with the first integrated circuit to output a drive signal to the first and second shut-off means;
Input / output system abnormality diagnosis means for diagnosing the presence or absence of abnormality of a sensor system and an actuator system related to the control of the internal combustion engine drive device;
Control system abnormality diagnosis means for diagnosing the presence or absence of abnormality in the first and second integrated circuits;
A fail-safe control means for performing a predetermined fail-safe process when an abnormality is diagnosed by the input / output system abnormality diagnosis means or the control system abnormality diagnosis means,
The fail-safe control means outputs the drive signal to the first and second shut-off means according to the abnormality diagnosis result of at least one of the input / output system abnormality diagnosis means and the control system abnormality diagnosis means, and the A control device for an internal combustion engine, which controls output of a reset request signal to the first and second integrated circuits. The control system abnormality detection means includes
A first self-diagnosis means built in the first integrated circuit for self-diagnosis for the presence or absence of an abnormality in the control system of the first integrated circuit;
A first mutual diagnosis means built in the first integrated circuit for diagnosing the presence or absence of an operation abnormality of the second integrated circuit;
A second self-diagnosis means built in the second integrated circuit for self-diagnosing the presence or absence of abnormality in the second integrated circuit;
2. The internal combustion engine control according to claim 1, further comprising: a second mutual diagnosis unit built in the second integrated circuit and diagnosing whether or not the first integrated circuit is operating abnormally. apparatus. Each of the first and second self-diagnostic means has a plurality of diagnostic means for diagnosing the presence or absence of abnormality of its own integrated circuit, and transmits the diagnosis results to the other integrated circuit,
3. The internal combustion engine according to claim 2, wherein the first and second mutual diagnosis means diagnose the presence or absence of an operation abnormality of the other integrated circuit based on a diagnosis result transmitted from the other integrated circuit. Engine control device.   The first self-diagnosis means and the second mutual diagnosis means are diagnostic ranges for each memory area corresponding to each control unit such as an ignition control unit, a fuel control unit, and an air control unit of the first integrated circuit. The control apparatus for an internal combustion engine according to claim 2, wherein abnormality is diagnosed by dividing the engine.   The first self-diagnosis unit and the second mutual diagnosis unit divide a diagnosis range for each function of the first integrated circuit and / or for each peripheral device, and perform abnormality diagnosis. The control apparatus for an internal combustion engine according to any one of 2 to 4.   The fail-safe control means is incorporated in both the first and second integrated circuits, and transmits the control signal of the first and second shut-off means to the other integrated circuit, so that the both integrated circuits can transmit the control signal. 6. The control apparatus for an internal combustion engine according to claim 1, wherein a drive signal is output to the first and second shut-off means. The first integrated circuit includes a plurality of analog-digital converters (hereinafter referred to as “A / D converters”), and A / D conversion for a main sensor among the plurality of A / D converters. The output of the main accelerator sensor of the plurality of accelerator sensors and the output of the main throttle opening sensor of the plurality of throttle opening sensors are input to the detector, and among the plurality of A / D converters, The output of the sub accelerator sensor among the plurality of accelerator sensors and the output of the sub throttle opening sensor among the plurality of throttle opening sensors are input to the A / D converter for the sub sensor,
The input / output system abnormality diagnosing means diagnoses whether there is an abnormality in the A / D converter for the main sensor and diagnoses whether there is an abnormality in the A / D converter for the sub sensor. The control apparatus for an internal combustion engine according to any one of 1 to 6.   The second integrated circuit is responsive to at least one of the signals reflecting the vehicle operating state such as the rotational speed of the internal combustion engine, the load, the vehicle speed, the operation amount of the accelerator pedal, and the opening of the throttle valve. 8. The control device for an internal combustion engine according to claim 1, wherein a drive signal is output to the shut-off means.   The said 2nd interruption | blocking means stops the fuel injection of the said fuel injection valve by interrupting | blocking the power supply and / or fuel supply to the said fuel injection valve, In any one of Claim 1 thru | or 8 characterized by the above-mentioned. The internal combustion engine control device described.   The said 2nd interruption | blocking means stops the ignition operation | movement of the said ignition device by interrupting | blocking the control signal and / or power supply to the said ignition device, The one of Claim 1 thru | or 9 characterized by the above-mentioned. Control device for internal combustion engine.   11. The control apparatus for an internal combustion engine according to claim 1, which is applied to a system that executes lean control for controlling the air-fuel ratio of the internal combustion engine lean.

Images