EP0213349A2 - Safety and emergency method and apparatus for a self-ignited combustion engine - Google Patents

Abstract

In the case of a safety and emergency driving method with a device for carrying it out, it is proposed to form an emergency driving branch acted upon by its own speed supply device, which specifies a speed-dependent characteristic curve of the minimum control path quantity and which is switched over in the event of a safety situation if a modified idle signal and the condition occur at the same time results in the control path actual value being greater than a minimum control path specified for this case. Further peripheral switching means are provided which relate to the formation of a start hysteresis, an overturn protection, the monitoring of the actual control value transmitter and the possibility that a separate monitoring device assigned to the main computer also switches over to the emergency driving branch independently of external signals.

Description

The invention relates to a method according to the preamble of the main claim or a device according to the preamble of claim 11. It is known to use electrical signal boxes controlled by electrical signals for the electronic control of the operation of self-igniting internal combustion engines (diesel engines), instead of mechanical fuel metering and control systems, a central control unit generates the necessary control signals. Mechanical fuel metering systems in diesel engines are reliable in terms of their reliability, but they may be less and less able to take into account the multitude of different operating conditions and environmental influences today.

The use of electronically safe components in connection with an electronic diesel control (EDC) makes extensive safety, monitoring and emergency driving measures desirable even when the individual components already has possibilities for error detection and, if necessary, healing.

In a safety device for an internal combustion engine with auto-ignition, it is known (DE-OS 33 01 742), continuously certain signals relating to the operation of the internal combustion engine, such as accelerator pedal position, calculated setpoint of the control path, speed, brake pedal position and the like. and to create a corrected control path setpoint by selecting the minimum value and supplying it to the control controller of the EDC system. This corrected control path setpoint also serves to determine a control path deviation, including a feedback of the control path actual value signal. If the predetermined limits are exceeded, the known safety device either reacts by switching off the injection pump, de-energizing the output stage of the control regulator or introducing emergency operation. Problems may arise with this known safety device, however, because not all conceivable boundary conditions are included in the detection of the safety conditions. Thus, an idle signal can be obtained by a corresponding idle contact on the accelerator pedal - but this is not valid if, for example, the internal combustion engine is equipped with a cruise control. It is also conceivable that, for whatever reason (sporty driving, warning rearward driver at high speed, etc.), a driver briefly depresses the brake pedal or even taps it, but on the other hand the foot pedal remains deflected, i.e. not in the Idle position.

It is therefore the object of the present invention in a electronic diesel control (EDC) to create a comprehensive safety and emergency driving device, which on the one hand prevents the engine from running under all circumstances, on the other hand largely enables emergency operation of the vehicle and also the occurrence of peripheral, unexpected conditions (e.g. simultaneous operation of Brake and accelerator pedal) is still properly taken into account.

Advantages of the invention

The invention solves this problem with the characterizing features of the main claim or claim 11 and has the advantage that when a safety event occurs, a control path (the injection pump) which is harmless both for the internal combustion engine and for driving operation is switched over, with sharp torque jumps incorrect quantity signal specified by the main computer can be avoided. It is also advantageous that, even if you have to switch to a minimum characteristic curve of the control path, the automatic start quantity control is enabled at a cold start, for example, and is only reset to the normal minimum control path characteristic after the so-called normal start release speed has been exceeded for the first time (RWmin characteristic).

Another advantage of the present invention is that when a faulty setting of the control path is detected, either the control is switched to a second branch in the input of the control, or a second, redundant control is applied at the same time, thereby also protecting defects in the control that is normally present . There is also a possibility here Possibility to switch back to the first controller when normal operation is resumed, for which purpose corresponding switch-back criteria have been developed.

The switchover to emergency operation can take place either on the basis of separate monitoring of the main computer function by a separate monitoring system (watchdog) or by detection of a special redundant idle signal which, in conjunction with a feedback of the actual position of the control rod position (RWist), causes the switchover to the redundant control controller, to which additional, minimum setpoint generating blocks are assigned, which can also be acted upon by their own speed sensor.

Advantageous further developments and improvements of the invention are possible through the measures listed in the subclaims. Particularly advantageous is the possibility, in the event of a safety event, i.e. incompatible external operating state variables (brake and accelerator pedal pressed simultaneously), to classify these signals in a time grid and to specify a waiting time and only after the end of the injection quantity, not abruptly, but in a ramp over time to reduce the predetermined slope.

drawing

Embodiments of the invention are shown in the drawing and are explained in more detail in the following description. 1 shows a simplified schematic illustration of an internal combustion engine with auto-ignition and its essential associated components including actual value transmitters, Fig. 2 is a block diagram of a comprehensive safety and emergency driving device, Fig. 3 in the form of a diagram the control path for the emergency driving state via the speed including a so-called start hysteresis, Fig. 4 in the form of discrete gate circuits, a processing option of external operating variables for detection 5, in the form of a diagram, the course of the injection quantity supplied over time when a safety event occurs, and FIG. 6, in the form of a block diagram, to switch over to a replacement controller with simultaneous, continuous monitoring of the first controller or normal controller for reusability.

Description of the embodiments

In Fig. 1, the internal combustion engine with auto-ignition (diesel engine) is designated 10; it has an intake pipe 11 and an exhaust pipe 12. A fuel injection pump 13 is connected via a pressure line 15 to an injection valve 14, which is shown here schematically as representative of the required quantity of injection valves. The injection valve 14 can comprise an injection initiator 16, which feeds a redundant speed signal to a speed signal detection and processing block 17 via a connecting line 16a indicated by dashed lines, or which conveys this speed signal to further processing blocks.

A speed sensor 18 is provided for speed generation, which detects the speed of the internal combustion engine via a ring gear 19 driven by its crankshaft, for example, and whose output is connected to the speed signal. Detection block 17 is connected. It goes without saying that the manner in which the signals used for the security system according to the invention are obtained is only shown by way of example in FIG. 1 and the subsequent figures; the signals used in each case can also be derived in a different way from the operating states of the internal combustion engine. Furthermore, it is expressly pointed out that the block diagrams shown in the drawings, which indicate the inventions on the basis of discrete switching stages, do not limit the invention, but rather serve in particular to illustrate the basic functional effects of the invention and to indicate special functional sequences in a possible form of implementation. It goes without saying that individual modules and blocks can be constructed using analog, digital or hybrid technology, or else, in whole or in part, corresponding areas of program-controlled digital systems, for example microprocessors, microcomputers, digital or analog logic circuits and the like. can include. The description of the invention given below is therefore only to be evaluated as a preferred exemplary embodiment with regard to the overall functional and time sequence, the modes of action achieved by the blocks discussed in each case and with regard to the respective interaction of the sub-functions represented by the individual components, the references to the individual Circuit blocks are made for better understanding.

Roughly schematic, the block diagram representation of FIG. 1 further shows, in addition to the speed signal N present at the output of the speed detection block 17, further means for signal acquisition. The actual value of the control path RW is, which from the position of the control rod, e 13a the Fuel pump 13 is generated for example via an actual value transmitter or converter for the control path, an accelerator pedal position signal FF6 (foot pedal), for example detected by the position of a tap of a potentiometer 22 which is mechanically connected to the foot pedal 21, from which signal also an accelerator pedal idle signal FFG- _L L can be derived, but this can also be generated in the same way by an idle contact switch on the foot pedal.

Furthermore, the acquisition of a brake signal BS via a suitable contactor 24 assigned to the brake pedal 23 is also of importance, which can also operate the brake lights 25 or generates the brake signal separately. Such a brake contactor can also be part of a pressure switch arranged in the brake cylinder.

A central control unit 26, which contains a main computer and further peripheral circuits, is provided for electronic control and guidance of the injection pump 13. As indicated at 27, the control unit 26 is supplied with a large number of external operating signals, circulation signals and setpoints and the main computer contained in the control unit 26 then uses these input values to generate at least one signal for the setpoint of the control path RWsoll, which is supplied to a downstream control controller 27 which has a predetermined control behavior and is usually a so-called PI0 controller, which controls the actuator 28 via a current controller output stage (not shown in FIG. 1), which moves the control rod 13a into the respectively desired position.

All or part of the signals mentioned here go, except there that they also act on the central control unit 26 at 27, lead to a safety and emergency driving device which, as is understood, can also be part of the central control unit 26, for example can be contained as an additional program block in the main computer or on others , any way is realized.

A block diagram of the safety and emergency driving device 29 is shown in detail in FIG. 2 and its structure is first explained below. In this case, components belonging to the central control unit 26 and the safety and emergency driving device 29 are shown in an interlocking manner in FIG. 2 - the main computer is designated by 30, a monitoring circuit (watchdog) controlling only essential functions of the main computer is designated by 30a. A first speed signal N comes from a normal speed sensor 31, for example formed by a disk 32 with signal markings that rotates synchronously with the internal combustion engine, a sensor 33 that responds to this, a downstream pulse shaper stage 34 to the main computer 30, which receives the speed signal and the input 35 Accelerator pedal signal FFG, usually evaluated with further variables that are not of interest in this context and generates a control path setpoint RWsoll and supplies it to a first control controller 36 via the output line 30b. A current controller 37 connected to the output of the controller 36 (PID controller) directly controls the actuator 38 for the control rod position with its output stage. A feedback actual value of the control path RWist reaches line 39 to the input of the controller 36, whereby the loop is closed for the execution of the normal functions.

At least one auxiliary speed sensor or replacement speed sensor 31 'is provided, which can also be a spray start sensor (SB sensor), the output signal of which can be used as a replacement speed signal if the normal speed sensor 31 fails. The following conditions apply for the starting process, checking for the presence of this replacement speed sensor and use of the same:

When the voltage is switched on, the starting quantity is output as the setpoint for the interlocking control, but the output is only carried out if a fault in the measurement of the internal resistance of the replacement speed sensor has not been detected by a replacement speed sensor monitoring. A fault detection of the sensor internal resistance only leads to the release of the starting quantity when a predetermined speed threshold is reached, determined from pulses from the normal speed sensor.

• 1. Als Stxtmengen-Abwurfdrehzahl (also als Drehzahl, bei welcher die zuzuführende Kraftstoffmenge nicht mehr aufgrund von Startbedingungen bestimmt wird, sondern aus normalen äußeren Betriebsbedingungen) wird eine feste Abwurfdrehzahl vorgegeben;
• 2. es wird auf ein geändertes Fahrverhalten-Kennfeld umgeschaltet, wobei bei der Auslegung dieses Kennfelds folgendes gilt:
  • a) für die Fahrpedalstellung 0 ist eine Restmenge für die Einspritzmenge vorzugeben, die bei jeder Drehzahl im Nutzbereich eine sichere SB-Auswertung zuläßt (auch über die Abregelung hinaus sowie bei Drehzahl 0). Diese Restmenge liegt unterhalb des Null-Lastbedarfs des Motors -
  • b) die Vollastmenge wird über die oberste Kennlinie des Fahrverhalten-Kennfelds definiert, sie muß deutlich unter der Saugmotorvollast liegen. Auch die Abregeldrehzahl wird (als Bestandteil des Fahrverhalten-Kennfelds) deutlich herabgesetzt -
  • c) die Leerlaufdrehzahlregelung wird über das Fahrverhalten-Kennfeld bei Leerlauf (Fußfahrgeber = 0 - FFG = ₀) realisiert. Es wird eine gegenüber Normalbetrieb erhöhte Leerlaufdrehzahl vorgegeben.
• 3. Falls normalerweise SB-Regelung durchgeführt wird, wird Umschaltung auf SB-Steuerung vorgenommen.

If the SB encoder is used as a replacement speed encoder, the following functions change for the quantity and spray start control in the event of failure of the normal speed encoder:

• 1. A fixed discharge speed is specified as the text quantity discharge speed (that is, as the speed at which the fuel quantity to be supplied is no longer determined on the basis of starting conditions, but rather from normal external operating conditions);
• 2. It is switched to a changed driving behavior map, the following applies when designing this map:
  • a) For the accelerator pedal position 0, a remaining quantity for the injection quantity is to be specified, which allows a reliable SB evaluation at every speed in the useful range (also beyond the limitation and at speed 0). This remaining amount is below the zero load requirement of the engine -
  • b) The full load quantity is defined via the top characteristic of the driving behavior map, it must be clearly below the naturally aspirated full load. The regulation speed is also significantly reduced (as part of the driving behavior map) -
  • c) the idle speed control is implemented via the driving behavior map at idle speed (foot throttle = 0 - FFG = ₀ ). An idle speed that is higher than normal operation is specified.
• 3. If SB control is normally carried out, switchover to SB control is carried out.

If, instead of the start of injection sensor SBS, any other speed sensor 31 'is used, as already mentioned above, then this can be used, for example, as a speed sensor on the starter ring gear. In order to arrive at the usual speed signals in self-igniting internal combustion engines (the start of injection generates a signal, for example, only every two crankshaft revolutions) and in order not to overload the main computer 30 due to the high frequency of the speed pulses caused by the pulse detection via the starter ring gear, the pulse shaping circuit 34 'is one Divider circuit 42 connected downstream, which is provided for the safety and emergency driving case and in this respect reduces redundant speed signals to approximately the same frequency as the SB signal. In FIG. 2 it is shown that the host computer 30 receives the normal and replacement speed signal fed to the safety and Notfahreinrichtungen via the speed-conditioning block 41 but from the normal speed ^g boar be supplied with engine speed information. It is equally possible to supply the S + N device or part of it with speed information from the replacement speed sensor.

The further safety and emergency driving arrangements of FIG. 2 are explained below in connection with the safety cases that occur in each case and the functions resulting therefrom.

In order to check whether the control actual travel RWist is below a predefined size RWmin when the accelerator pedal is in an idle position position (FFG-LL signal), it is in any case not possible to simply link these sizes if the internal combustion engine is operated with a travel speed control FGR, which is based on the main computer 30 in its control function.

The actual value of the control path RWist therefore reaches a comparator 43 via a branch line 39 ′, the other input of which supplies an RWmin specification relating to the respective speed from an RWmin characteristic block 44. The output signal of this comparator then represents a first and necessary signal, which is included in this check. In the case of a vehicle speed control, which is implemented in conjunction with an electronic diesel control (EDC), the accelerator pedal is in the LL position and nevertheless the internal combustion engine is supplied with a high injection quantity as required, which corresponds to a large control path RWist.

For this reason, FFG-LL detection, that is to say the detection and evaluation of the idle position of the pedestrian, must be prevented in the FGR vehicle speed control.

It is a feature of the present invention, via the brake signal BS supplied at the input 45 and a driving speed ditäts-control signal (FGR signal) to create a so-called redundant, so additional idle signal LL ^* , namely by the link shown in the top center of Fig. 2, which works so that a possible vehicle speed control function FGR does not result in faulty idling -Position detection leads.

In the exemplary embodiment shown, the linkage takes place by means of a linkage circuit 46, which consists of two AND gates 46a, 46b and a downstream OR gate 47. At the output of this OR gate, the redundant idle signal LL ^* results only if there is either no vehicle speed control function (is recognized by the negation at the corresponding input of AND gate 46b) and at the same time an idle signal FFG-LL is present by the pedestrian the vehicle speed control function is available, but the brake is applied. Such a combination must not occur in normal operation because the FGR function must be eliminated when the brake is actuated. Both signals reach the same value via the OR gate 47 as an LL ^* signal on the one input of a further gate circuit connected downstream, namely again an AND gate 48, which is then used together with the redundant idle signal LL ^* and for checking to switch to the RWmin signal provided by the comparator 43, if necessary, on a control path that is safe for the engine and driver.

Since a computer delay or signal delay or actuator delay may have to be expected here, the AND gate 48 is followed by a delay block 49, which only controls a downstream reaction element for immediate actuation when a predetermined time period T has expired. The reaction element is shown to illustrate the function as a bistable flip-flop 50 with the inputs S / R, but can also be implemented differently in a computer be (e.g. setting a flag). The flip-flop 50 is set at its input S "when the security event occurs with consequences to be explained below and is reset at its input R, as can be seen, via an OR gate 51 immediately when the redundant idle signal LL ^{* is lost.} and also when a start hysteresis block 52 supplies a signal indicative of a starting operation, as will be explained.

If a minimum control range RWmin is specified in this context with a fixed lower limit speed threshold, problems also arise for emergency operation, since sharp torque jumps can then occur at this limit speed if the quantity signal specified by the computer is incorrect. According to a feature of the present invention, the limit speed threshold concept is therefore replaced by a speed-dependent control path characteristic for minimum control path RWmin, as indicated in the characteristic block 44 in FIG. 2 and shown in detail in the diagram in FIG. 3. The RWmin curve over the speed is shown in Fig. 3 in solid lines, it should be added that all the functions described in the form of characteristic curves can also be equipped with more or less complex and each and also here a minimum level that is found to be useful is described.

The RWmin characteristic curve over the speed consists of three branches a), b) and c), the branch a) being above a threshold _speed n _limit already mentioned and _{specifying control paths} that are below the zero load quantity requirement of the engine, but above that Control path which is output by the main computer for the idle position of the foot pedal in undisturbed operation; the below the limit rotation Number increasing branch b) allows idling control in emergency driving mode, but is above the idling control characteristic for normal operation, while the third branch c) allows control paths that enable a cold start.

On the other hand, such an RWmin characteristic curve can jeopardize an automatic start quantity control by the electronic diesel control EDC, which wants to release more start quantity (correspondingly larger control path RW) than the RWmin characteristic curve in FIG. 3 allows during a cold start. For this reason, in one embodiment of the present invention, this RWmin characteristic curve is provided with a hysteresis for the start case, which is recognized by block 52 in FIG. 2, which can also be responsible for the change in the RWmin curve to be explained below is shown in dashed lines in FIG. 2 as RWmin 'and causes a shift towards higher speeds when switched on for the first time. In this case, the diagram in FIG. 3 also has a dash-dot line and I denotes the normal starting quantity curve over the rotational speed.

After the normal start shedding speed has been exceeded for the first time (plus a safety distance), RWmin ', i.e. from the expanded hysteresis configuration, then resets to the normal RWmin characteristic.

The comparator 43 compares the RWmin value taken from the RWmin characteristic with the actual RWist value. If an incorrect setting of the control path R _{W is} determined, i.e. if RWist is greater than RWmin and the idle condition LL ^* occurs at the same time, then after the delay time specified by delay block 49, flip-flop 50 is set, which is connected via its output FF _A and a downstream one OR gate 53 switches the control of the control path to a second branch, which then, when this safety event occurs, regulates to the RWmin characteristic curve just described in detail, and at the same time, via return line 54, notifies the main computer 30 of this safety event that has occurred.

In order to be able to regulate the RWmin characteristic curve for emergency driving operation in the event of a safety event, the input of the control regulator 36 can then be switched to the output of the RWmin characteristic curve generation block 44, which is not shown in the drawing in FIG. 2, i.e. one continues to work with the same actuator 36, or one can (alternatively) switch to a second redundant actuator 36 'by actuating a switch 55 from the output of the flip-flop 50, since defects of the normal actuator 36 are also protected in this way.

Such a switchover via the OR gate 53 is also carried out when it is ascertained, namely via the watchdog 30a monitoring circuit of the main computer 30, that the main computer 30 itself is not operational, that is to say is defective, has a too low voltage or the like. Then watchdog 30a also switches switch 55 via line 56.

The safety flip-flop 50 is reset in any case if, as already mentioned, the empty running condition LL ^* is lifted again, or in order to bring the flip-flop 50 into the defined starting position via the start hysteresis block 52 under starting conditions.

The feedback of the switch over the line 54 to the main computer 30 is necessary because the latter itself (if necessary) carries out monitoring for system deviation or to manipulate the main computer 30 in the desired sense, since otherwise this additional redundant switch-off via an additional Actuator (e.g. shut-off valve for the fuel), even the system could shut down altogether.

An additional measure for pure operation via the RWmin characteristic curve is to additionally supply the RWmin characteristic curve generation block via the partial line 57a to the line 57 from the foot transmitter of a pedestrian signal FFG, which, added to the generated RWmin signal, allows any RW position to be regulated , so that an extended emergency drive is possible in a simple manner in the event of a main computer failure or failure of the components affected by the respective security case.

Another embodiment of the present invention is that a detection switch block 58 is provided for failure of the control transmitter; This detection circuit 58 is therefore additionally supplied with the actual value signal of the control path RWist generated and reported by the control path transmitter.

Any input signals linked to the actual position of the control path are supplied to the detection circuit 58, the control path failure detection then being carried out by a known measure of the so-called signal Range check is carried out. If the control path encoder is found to be defective, then according to a feature of the present invention, the real control path signal RWist (which is no longer applicable) is reported back to the position control (the control controller 36, 36 ') or to the main computer 30, but a simulated signal which is generated by switching a switch 59 to an RWist ^* generation block 60 caused by the detection circuit 58. This simulated signal is derived either from the controller output, as shown in FIG. 2, or from other available variables, for example also the output of the current controller 37 connected downstream of the controller. In this respect, however, the RWist generation block is an observer for the general case Position 38.

It is understood that, as is known per se, in addition to the measures taken so far, an overspeed protection circuit 61 is provided which acts directly on the output stage of the current regulator 37 past all blocks and prevents overspeeds.

Essential features of the present invention therefore consist in the fact that, in addition to the redundant speed sensor 31 'or the start of injection sensor, a redundant idle signal LL ^{* is} generated, as is an RWmin characteristic curve, which can additionally be displaced by signals from the driving foot sensor for extended emergency operation.

The RWmin characteristic curve is supplemented by a start hysteresis function, so that in addition to the extended emergency driving mode, starting processes are still possible. Switching to emergency operation is optional by acting on a reaction element, namely the flip-flop 50 or also via the watchdog directly assigned to the computer when the flip-flop switchover is reported. A redundant control controller is preferably provided, which is controlled by the RWmin characteristic curve generation for the safety case and switchover to emergency operation. Furthermore, by generating a simulated control path signal, an actual value that can be evaluated for emergency operation can be obtained. The actuator behavior can also be checked by including the actuator observer in accordance with the RWist ^* generation block 60 in the monitoring program.

Another problem for the general safety and emergency operation in self-igniting internal combustion engines is that the foot pedal can jam or can no longer return to the idle position or when in control. If the signal evaluation of the accelerator pedal sensor is defective or the signal is misinterpreted by the computer In this case, there is a risk that, even though the driver has taken his foot off the accelerator pedal, that is to say that there is an FFG-LL signal, the accelerator pedal is undesirable. Such unwanted accelerating can be prevented by additionally including a brake signal BS, which is then caused by the normal reaction of the driver, as a redundant safety signal, as also happened in FIG. 2, but then comes up against problems, if certain, at the beginning Cases of driving operation mentioned above, for example when the driver is driving fast, the brake is briefly depressed, the accelerator pedal is not in the idle position or when, for example, to approach a type of anti-slip control or in very sporty driving, the accelerator and brake are occasionally actuated simultaneously.

If then removed the injection quantity abruptly and either regulated to a definitely injection quantity 0 supplying control path or even the output stage is inhibited for pumping interlocking can therefore give states dangerous _F AhR ,, because in letzterwähntem case the adjusting knob of the signal box to stop running , when switching back on after canceling the safety case, undesirably long settling processes with sometimes considerable injection quantity overshoots can occur and the abrupt switching off or taking away of the injection quantity during driving operation in any case causes considerable deceleration of the vehicle.

• 1. die Fahrpedalstellung nicht Leerlauf ist (FFG-LL) und
• 2a) entweder zuerst das Fahrpedal nicht in Leerlaufstellung ist und zeitlich nachfolgend das Bremsbetätigungssignal BS auftritt oder
• 2b) zuerst die Bremse betätigt wird (Signal BS) und zeitlich nachfolgend das Fahrpedal nicht in Leerlaufstellung ist und für diesen Fall ferner die Fahrgeschwindigkeit größer als eine vorgegebene Mindestsicherheits geschwindigkeit ist, also V-, Vsmin.

In accordance with a preferred feature of the present invention, which is also independent per se, the procedure for the case of brake actuation is therefore such that an abrupt removal of the injection quantity is avoided for the cases described, the triggering of a safety case for the driver according to FIG. 4 Calculator is only given if

• 1. the accelerator pedal position is not idle ( FFG-LL ) and
• 2a) either first the accelerator pedal is not in the neutral position and the brake actuation signal BS subsequently occurs or
• 2b) the brake is actuated first (signal BS) and the accelerator pedal is subsequently not in the idle position and, in this case, the driving speed is also greater than a predetermined minimum safety speed, ie V-, Vsmin.

It goes without saying that these conditions are not to be considered statically alone. The safety case should be canceled again if the LL position of the accelerator pedal is detected or the brake is released again, but not For example, if, after a triggered safety case and the conditions "brake applied, FFG 0 LL" continue to exist, the speed condition that may still be required to release is no longer present.

The evaluation blocks 62 and 63 shown in FIG. 4 are therefore circuit means which can detect a time assignment or a successive occurrence of events and only emit a signal if the conditions indicated in the blocks are met. The safety case corresponding to the assuming high-level signal at an output gate (AND circuit 64) thus only arises if - the one input is supplied with the signal "accelerator pedal is not in idle position", while the other input from the upstream OR gate 65 is on Signal is supplied either according to condition 2a) or 2b) mentioned above.

As soon as this safety case occurs, processing takes place in accordance with the diagram in FIG. 5, which represents the injection quantity supplied over time. Therefore, when the safety event occurs, a waiting time Tw is first started and after the waiting time has elapsed, the injection quantity is not reduced abruptly, but rather in a ramped manner over time with a predetermined gradient DF / DT, and is regulated to a predeterminable safety speed Ns. The usual idle control parameters can apply to the control.

Immediately after the cancellation of the security case (where cancellation means: one of the two conditions "brake applied" or "FFG ≠ LL" is not applicable) in the drawing of Fig. 4 at time t2, when the safety situation occurred at time t0, the waiting time expired at time t1 and the safety speed was reached at time t2 ^* , the injection quantity is increased again in a ramp over time with a predetermined gradient DR / DT to the quantity that through the normal Input sizes of the control unit (FFG, F6R ...) is specified.

As a result, the otherwise occurring "brake / accelerator pedal" conflict is resolved, hard volume surges are avoided, and a further degree of design freedom is achieved by the additional introduction of the speed safety threshold Ns. It is also essential that, in the case of such a safety case design, the control or regulators do not run against the stop.

Since only the input variables of the accelerator pedal sensor FFG and the brake switch BS are required for this special safety problem, which are already supplied to the main computer as shown in FIG. 2, there is the further advantage that this entire safety function is shifted to the main computer 30, that is to say this can be designed accordingly, so that a significantly lower circuit complexity results.

A further addition to the present invention, which also has independent inventive significance, can finally be seen in the illustration in FIG. 6. This is the possibility, already mentioned above, of arranging a second control regulator or replacement regulator, which is designated by 66 in FIG. 6. As in FIG. 2, the normal regulator bears the reference symbol 36.

The safety and emergency driving system in the illustration in FIG. 2 likewise has a second and therefore redundant controller 36 '; In this system, however, this can also be optionally provided, since, in the event of a safety event, only the regulating control of the control path to the second one Branch formed from blocks 44 and 52 switches so that the RWmin characteristic continues. This second branch can also be connected to the original actuator. In contrast to this, the redundant control controller 66 which is effectively provided in accordance with FIG. 6 increases the availability of the entire system and thus also of the vehicle. The following considerations form the basis for this. In EDC systems, the injection quantity is metered via the electromagnetic actuator 38 '(see FIG. 6) with position feedback (position of the control rod - RWist encoder) and a control regulator 36 in the control unit. If one of these regulators fails, quantity metering can no longer be carried out, so that the vehicle equipped with such an internal combustion engine also stops.

The invention here provides a second substitute controller 66 or redundant controller and also provides means which recognize whether the normal actuator 36 is inoperable so that it is possible to switch to the substitute controller 66. It goes without saying that such measures can also be applied to other regulators for other sizes, for example exhaust gas recirculation rate ARF, start of injection or the like.

The actual controller (PID) itself, and in extension also assigned subsequent stages including the final stage (current controller 37) can be regarded as belonging to such a control controller. Since, as already mentioned, a control controller generally contains an I component, it can be assumed with a functional control controller that, if there is a control deviation, the controller output is at the maximum possible position for correcting the deviation goes, he runs to the stop, the direction of the deviation and the direction of the controller at the stop are mutually assigned. This assignment and the requirement that the controller runs to the stop allow the controller and possibly subsequent stages to be checked, taking into account the principle that, if there is a control deviation and if this control deviation is present, it is possible to determine whether the controller output is correct for a given fixed time at the appropriate stop. If this is not the case, then it must be switched to the substitute controller 66. According to FIG. 6, the invention provides a comparison device 67, to which the control deviation is fed at input 67a and the controller starting position at input 67b. The control deviation is obtained in the usual way at a summation point 68, to which the control rod setpoint RWsoll is fed by the main computer and the feedback of the control rod setpoint is fed by the RWist encoder. If it is determined that after the predetermined fixed time 1 ⁷ the controller starting position does not correspond to the stop, the comparator switches over to the replacement controller 66 via the switch 69, which can then either continue to work with the previous setpoint (supplied via line 70) or to which a separate setpoint value derived from this can also be supplied from an emergency driving device via line 71 as RWsoll-Not (see block _44. A failure of the normal ^{setting controller} _{36 shown in} ^{FIG. 2)} in the latter case always means a complete switchover to the emergency driving branch , which may simplify logic.

Since such a switchover is also caused by a single fault. tion can be triggered and a switch back from emergency operation is no longer possible with the means explained so far, although if necessary the function If the normal regulator 36 is not disturbed or not further disturbed, according to one embodiment of the invention, the target input of the regulator 36 (initially recognized as defective) is switched to a fixed target value, likewise from the output of the comparator 67 by actuation of a switching device 72, this fixed target value preferably in is in the middle of the normal operating range. The comparator 67 continues to monitor the output of the normal controller 36.

Since the substitute control controller 66 continues to work with the changing setpoints RWsoll or RWsoll-Not that result during driving operation, the normal controller 36 will necessarily see alternating positive and negative control deviations with respect to its fixed setpoint, since the RWist indication will continue to be supplied to it. When the control controller 36 has healed again, ie is functioning properly, one or the other stop would then have to be approached alternately.

It is then possible to determine a predetermined number of stop changes, which the comparison device 67 can detect and whereupon it can then switch back to the normal function, so that the emergency driving function can be used again, with the advantages and the further advantages that result. that the emergency drive function is available for use again.

All features shown in the description, the following claims and the drawing can be essential to the invention both individually and in any combination with one another.

Claims (34)

1. Safety and emergency driving procedures for an internal combustion engine with auto-ignition, with the status of the internal combustion engine (accelerator pedal position FFG (-LL), speed N, brake pedal position or brake light signal BS, actual value of the control rod position RWist) being continuously recorded and evaluated for superordinate system monitoring, characterized in that that if a modified idling condition and a predetermined minimum value of the control path (RWmin) occur simultaneously due to the actual control path (RWist), the control for the control path is switched to a second branch regulating along an RWmin characteristic curve. 2. The method according to claim 1, characterized in that in addition to the speed-dependent RWmin value obtained from the RWmin characteristic curve course for emergency travel _, the signal (FFG) of the pedestrian (21) is added to obtain the new control rod setpoint value which enables an extended emergency travel ( RWsoll-Not). 3. The method according to claim 1 or 2, characterized in that the control. With the new, characteristic-dependent and foot pedal-dependent setpoint (RWsoll-Not) is switched to a second, redundant control (36 ', 66) for simultaneous protection of faults in the normal control (36, ₆₆ ). 4. The method according to any one of claims 1 to 3, characterized in that the generation of the RWmin characteristic curve for emergency operation, the speed signal (N) of the normal speed sensor (31) or a replacement speed sensor (31 '; SBS) is used as a spray start sensor Derives the speed signal from the effectively recorded start of the injection or reduces the speed signals redundantly recorded synchronously to the crankshaft revolution by division. puts. 5. The method according to any one of claims 1 to 4, characterized in that the speed-dependent generated RWmin characteristic curve for the emergency driving mode includes a start hysteresis function that releases an additional starting quantity for the cold start beyond the RWmin characteristic curve and after the first time exceeding the normal start shedding speed switches back to the normal RWmin characteristic. 6. The method according to any one of claims 1 to 5, characterized in that to detect the modified idle signal (FFG-LC) either a brake pedal actuation signal (BS) with a vehicle speed control signal (FGR) compared or the non-occurrence of a vehicle speed control signal ( FGR ) compared with an accelerator pedal normal idle signal (FFG-LL) and Only after a specified delay time (T) has the modified idle signal (LL ^* ) switched over to the control system in the presence of the condition RWist> RWmin. 7. The method according to any one of claims 1 to 6, characterized in that the permanent switchover bypassing the modified idle signal generation and the comparison RWist with RWmin can be carried out directly by a separate monitoring device (watchdog 30a) assigned to the main computer (30). 8. The method according to any one of claims 1 to 7, characterized in that the failure of the RWist encoder is detected and switched to a simulated, derived from the controller output RWist ^* signal. 9. The method according to any one of claims 6 or 7, characterized in that a reaction means (bistable flip-flop 50; analog switching algorithm in the computer) is controlled for permanent position control changeover, which is reset when the modified idle signal (LL ^* ) is absent. 10. The method according to claim 9, characterized in that the flip-flop (50) is reset even when the start hysteresis function occurs. 11. Safety and emergency driving method for an internal combustion engine with auto-ignition, with the status of the internal combustion engine (accelerator pedal position FFG (-LL), speed N, brake pedal position or brake light signal BS) continuously being used for superordinate system monitoring. Actual value of the control rod position RWist) can be detected and evaluated, in particular according to one or more of claims 1 to 10, characterized in that the control deviation and the controller starting position are monitored if the I component of the control controller is assumed, and if the output controller does not reach a stop value on the output side after a predetermined time period (r) is switched to a replacement controller (66). 12. The method according to claim 11, characterized in that the replacement controller, the same setpoint for the control rod travel (RWsoll) is supplied as the switched off normal actuator (36). 13. The method according to claim 11 or 12, characterized in that the emergency controller (66) an emergency driving setpoint (RWsoll-Not) is supplied. 14. The method according to any one of claims 11 to 13, characterized in that when switching to the replacement controller (66), the normal controller (36) is charged with a fixed setpoint and its controller starting position is continuously monitored, with the proviso that when a predetermined one is reached Number of stop values on the output side, the functionality of the normal controller (36) is recognized and switched back to this from emergency operation. 15. Safety and emergency driving procedures for an internal combustion engine with auto-ignition, with the status of the internal combustion engine (accelerator pedal position FFG (-LL), rotary) continuously being used for superordinate system monitoring number N, brake pedal position or brake light signal BS, actual value of the control rod position RWist) can be detected and evaluated, in particular according to one or more of claims 1 to 14, characterized in that, in order to avoid switching off or reducing the injection quantity, possibly down to a safety quantity of zero with the simultaneous occurrence of a Brake signal (BS) and an accelerator pedal signal (FFG-LL) located outside the idle range, these two signals are brought into a temporal condition dependency in such a way that a safety case is only recognized if there is no idle signal ( FFG-LL ) either the accelerator pedal is not initially in the idle position and the brake is subsequently actuated, or if the brake is actuated first (occurrence of the BS signal) and the accelerator pedal subsequently does not reach the idle position and at the same time the vehicle speed is greater than one specified minimum security speed (V> VSmin). 16. The method according to claim 15, characterized in that a waiting time (Tw) is started when the security event occurs and only after the waiting time has elapsed the injection quantity supplied by appropriate loading of the main computer or downstream components reduced in a ramp over time with a predetermined slope and then to one specified safety speed (Ns) is regulated. 17. The method according to claim 15 or 16, characterized in that after canceling the safety case, the injection quantity ramped over time with a predetermined greater slope is increased to the amount specified by the normal input quantities of the control device. 18. Safety and emergency driving device for an internal combustion engine with self-ignition, with the status of the internal combustion engine (accelerator pedal position FFG-LL, speed N, brake pedal position or brake light signal BS, actual value of the control rod position RWist) being continuously recorded, compared and evaluated for internal combustion engine shutdown or emergency operation for the purpose of superordinate system monitoring , for carrying out the method according to one or more of Claims 1 to 10, characterized in that a circuit (44) generating a minimum control path characteristic curve (RWmin) is provided over the speed, the output of which in the event of safety for regulating the control path to the control controller (36, 36 '; 66) is switched. 19. Device according to claim 18, characterized in that a redundant control regulator (36 '; 66) connected to the circuit (44) generating the RWmin characteristic curve is provided, to which the input of the downstream control element (38) or a control element upstream Stromreg-Ier (37) is connected in the event of a safety. 20. Device according to claim% 8 or 19, characterized in that in order to enable extended emergency operation, the circuit (44) generating the RWmin characteristic curve for regulating any desired control path values evaluates the position of the pedestrian. 21. Device according to one of claims 18 to 20, characterized in that the generating the RWmin characteristic Circuit (44) is assigned a start hysteresis block (42) which, depending on the speed, releases the RWmin characteristic curve in the direction of higher injection values until a predetermined start release speed is exceeded for the first time. 22. Device according to one of claims 18 to 21, characterized in that at least one redundant speed sensor (31; injection start sensor) is provided which, optionally via a divider circuit (42) and an upstream speed processing block (41), the circuit (44) forming the emergency driving blocks for generating the RWmin characteristic curve, an overspeed protection circuit (61) and the start hysteresis block (52) are supplied with a speed signal. 23. Device according to one of claims 18 to 22, characterized in that a circuit is provided which defines a modified idle signal (LL ^* ) which, in addition to actuating the brake pedal, evaluates a vehicle speed control signal (FGR) and an accelerator pedal idle signal (FFG-LL) and controls a downstream reaction element (flip-flop 50). 24. The device according to claim 23, characterized in that a first AND gate (46) is provided for generating the modified idle signal (LL ^* ), to which a brake actuation signal (BS) and a fan speed control signal (FGR) is supplied, which negates also a second AND gate (46b) which receives at its other input the accelerator pedal idle signal (FFG-LL) which the outputs of both AND gates (46a, 46b) are fed to an OR gate (47) whose output is the modified idle signal (LL ^* ) is formed, which is fed to one input of a downstream AND gate (48), the other input of which is supplied with a signal which fulfills the condition RWist> RWmin. 25. Device according to claim 23 or 24, characterized in that the output signal of the modified idle signal (LL ^* ) together with the condition RWist> RWmin processing AND gate (48) is supplied to a delay circuit (49) which is used to switch to the Emergency operation is followed by a bistable flip-flop (50), the output of which either switches the control of the control path to the emergency blocks (44, 52) or switches the actuator (48) for the control path (RW) to a redundant control (46 '). 26. The device according to claim 25, characterized in that the safety case output signal of the flip-flop (50) is fed to the main computer (30). 27. The device according to one or more of claims 18 to 26, characterized in that the main controller (30) is assigned its own safety monitoring circuit (watchdog 30a), the output signal of which directly effects the control switching or the switching to the redundant control (36). 28. Device according to one of claims ₂₅ to 27, characterized in that the reset of the flip-flop (50) for switching back to normal operation from the emergency mode when the modified idle signal (LL ^* ) is omitted and, via an OR gate (51) _present a Starthysteresebedingung by the start hysteresis block (52) takes place. 29. The device according to one or more of claims 18 to 28, characterized in that a monitoring circuit (58) is provided for the control path transmitter, which generates a simulated control path actual value signal (RWist ^* ) in the event of its failure on a from the output of the controller (36) Circuit (60) switches. 30. Safety and emergency driving device for an internal combustion engine with auto-ignition, with the operating system signals of the internal combustion engine (accelerator pedal position FFG-LL, speed N, brake pedal position or brake light signal BS, actual value or control rod position RWist) being continuously recorded, compared and evaluated for internal combustion engine shutdown or emergency operation for superordinate system monitoring , in particular according to one or more of claims 18 to 28, for carrying out the method according to one or more of claims 11 to 14, characterized in that a comparison circuit (67) is provided which supplies the control deviation, which is also supplied to the control controller (36) is monitored together with the controller starting position for recording output-side stop positions of the actuating controller (36) which has an I component and then switches over to a (redundant) replacement controller (66) if the normal controller (36) is for a predetermined period of time (f) predominant R Lever deviation remains free of stop positions. 31. The device according to claim 30, characterized in that when switching to the replacement controller for emergency operation the normal controller (36) to a fixed setpoint Continuous monitoring of the controller starting position can be carried out in such a way that when a predetermined number of stop positions occur at the outlet of the normal controller (36), this is switched back to for further operation. 32. Device according to claim 30 or 31, characterized in that when switching to the replacement controller (66) this from the circuit blocks (44, 52) of the emergency drive branch, a control path emergency operation command signal (71) is supplied. 33. Safety and emergency driving device for an internal combustion engine with auto-ignition, with the status of the internal combustion engine (accelerator pedal position FFG-LL, speed N, brake pedal position or brake light signal BS, actual value or control rod position Rwist) being continuously recorded, compared and evaluated for internal combustion engine shutdown or emergency operation for superordinate system monitoring , in particular according to one or more of claims 18 to 32, for carrying out the method according to one of claims 15 to 16, characterized in that in order to avoid the occurrence of a safety event with simultaneous brake and accelerator pedal actuation, the successive occurrence of brake and accelerator pedal signals ( BS; FFG-LL) detecting circuit blocks (62, 63) are provided. 34. Device according to claim 33, characterized in that the one input of an AND gate 64 generating a safety case signal at its output, an accelerator position signal (FFG-LL) not relating to the idle position and the other input from the Time-order blocks (62, 63) are influenced by signals and that switching means are provided which, after a predetermined waiting time (Tw), regulate the injection quantity in a ramping manner to this speed until a predetermined safety speed is reached, until after the cancellation of the safety case, ramp-down to the speed Normal injection quantity is regulated up, this circuit means including the safety case detection means (62, 63, 64, 65) being realized within the main computer (30).

Images