EP0331674B1 - Process for driving computer-controlled final control elements and computer coupled to a final control element - Google Patents

Abstract

In all processes used until now to drive a computer-controlled final control element in connection with a self-test of the computer, the final control element is at first maintained in a defined reference position and is only released to receive driving signals from the computer once the self-test has been completed. This results however in very long delays in the case of complex computer systems. According to the invention, the final control element is maintained in a fixed position only during a first part of the self-test, and is then driven by a temporary driving signal until the end of a second part of the self-test or until a failure is detected, whichever occurs first.

Description

The invention relates to a method for controlling a computer-controlled actuator according to the preamble of claim 1.

Computer-controlled actuators are used in many areas of technology where the manipulated variable depends on numerous other boundary conditions, including setpoints and controlled variables.

The computers require a high computing speed and the ability to reliably process large data sets. This requires a large amount of memory on the computer side.

Although it has been possible to reduce the failure rate of computer systems more and more in spite of increasing complexity, the possibility of a circuit-technical error has to be expected. While circuitry errors were usually immediately recognizable in analog circuits that used to be common, this is often different with errors in digital computer systems. There an error e.g. remain undetected for a long time in a memory location for a rarely called program routine and then appear completely surprised. This can result in control commands that cause considerable consequential damage.

In order to detect such errors at an early stage, it is customary to subject the computers to a self-test from time to time in the case of complex, safety-related computer-controlled actuators. A test program is run in which all modules are addressed one after the other with the specified data and only if the data are processed correctly after the self-test has ended is a main program carried out. In the case of complex computer systems, such a self-test takes a certain time in which the computer is not available to carry out its actual task. In order to avoid an uncontrolled activation of the actuator during this time, it is held in a defined reference position and only released for control signals of the computer for the first time or again after the self-test has ended.

One area of application for computer-controlled actuators is e.g. B. an electronic diesel injection for diesel engines. The computer-controlled actuator is arranged in a control unit that actuates the control rod for an injection device. The required position of the control rod can depend on the engine temperature, the fuel temperature, the air temperature, the torque and the speed.

The computer's self-test is expediently carried out at the start of each start-up process. However, it has been found that the time required for this can have adverse effects. The long start-up process can unsettle impatient drivers and lead to the assumption that there is a fault. Drivers who are already familiar with starting behavior will be less willing to switch off the engine due to environmental pollution in order to avoid the delay time during traffic jams, traffic light stops or stops before level crossings. Frequent short-distance journeys also place a high load on the starter and the battery. If extreme cold or a weak starter battery is added, the long self-test time can lead to the energy provided by the battery for starting the engine being exhausted prematurely.

Long self-test times can also have an adverse effect in other areas, e.g. B. in computer-controlled actuators in production plants or in the drive technology of rail-bound public transport, watercraft or aircraft.

The invention has for its object to improve a method for controlling a computer-controlled actuator so that the adverse effects of a time-consuming self-test for the control of an actuator are avoided without the safety gained by the self-test is limited.

This object is achieved in a method according to the preamble of claim 1 by the features specified in the characterizing part.

The invention makes use of the knowledge that the self-test of a computer-controlled actuator is passed as a rule, so that the time required for the self-test can subsequently be regarded as wasted. In order to shorten this period of time, the actuator is controlled with a preliminary control signal. This can e.g. B. be chosen so that the actuator ensures a temporary function of the unit operated by him. Because of the short time at which the provisional control signal is present, it can be accepted that this value deviates more or less from an optimal value. However, in order not to suffer any loss of security with these measures, the components of the computer that are responsible for carrying out the test themselves are subjected to the self-test in a first period. Only after this first section of the self-test has been completed is the actuator actuated with the provisional control signal.

This measure also ensures that the subsequent second section of the self-test can be carried out in a controlled manner and that in the event of an error message, the provisional control signal cannot be switched off. With this measure, a considerable reduction in the delay time for actuation of the actuator can be achieved, since the time required to test the memory space required for the self-test and the time to test the associated modules is considerably less than the time for testing of the entire remaining program memory. In practice is with the method according to the invention to achieve a reduction in the delay time until the actuator is actuated for the first time by 1/10 to 1/30 of the time required for the entire self-test.

Further developments and advantageous embodiments of the method according to the invention result from claims 2-11.

The invention further relates to a computer coupled to an actuator according to the preamble of claim 12.

In this regard, it is the task of improving a computer coupled to an actuator of the type mentioned above so that the adverse effects of a delayed release of the actuator for control signals of the computer are avoided without the security gained by the self-test is limited.

The invention solves this problem in a computer coupled to an actuator according to the preamble of claim 12 with the features specified in the characterizing part.

With this configuration, the actuator can be controlled with a preliminary control signal before the self-test is completed. As a result, the time until the actuator is released for control signals from the computer can be bridged. In principle, the control signal can be freely selected. It is expediently chosen so that it temporarily ensures the operability of the unit actuated by the actuator. A loss of safety is not associated with this measure, since after actuation of the actuator with the provisional control signal, the self-test can be continued and, in the event of a fault, the actuator can be switched over again so that it assumes the defined reference position.

The invention is explained below using exemplary embodiments which are illustrated in the drawing.

• Fig. 1 ein Flußdiagramm für den Ablauf eines Selbsttests bei einem rechnergesteuerten Stellglied als Bestandteil eines Steuergeräts für eine elektronische Dieseleinspritzung bei einem Dieselmotor,
• Fig. 2 ein Flußdiagramm ähnlich Fig. 1, jedoch zusätzlich für den Ablauf eines Selbsttests für eine Überwachungsschaltung, und
• Fig. 3 ein Blockschaltbild eines erfindungsgemäßen, rechnergesteuerten Stellgliedes.

Show it.

• 1 is a flowchart for the course of a self-test in a computer-controlled actuator as part of a control unit for electronic diesel injection in a diesel engine,
• Fig. 2 is a flow chart similar to Fig. 1, but additionally for the execution of a self-test for a monitoring circuit, and
• Fig. 3 is a block diagram of a computer-controlled actuator according to the invention.

The flowchart in Fig. 1 begins at an initial state 10 of the computer, in which the computer z. B. was offset by a reset command after applying an operating voltage. In the next method step, which is designated by 12, the actuator is brought into a defined reference position and held there.

This position corresponds to a zero quantity of diesel fuel. During this phase, the starter turns the engine without it being able to start. In a subsequent method step, which is designated by 14, a self-test routine of a first part of the program memory is run through. The memory locations of the computer-side memory are checked for function in which the program part of the self-test program is stored.

Such a memory test can e.g. B. be carried out so that the entire program memory is added up and compared with a comparison sum, or the comparison sum is included in a program memory cell and selected so that there is zero when totaling the entire program memory content.

A comparison for errors is then carried out in a method step denoted by 16. If an error is found, the computer is returned to its initial state, which is denoted by 10. If no error is found, the method step designated 18 is carried out. It is a function test of other components of the computer, e.g. B. a read-write memory, a timer, or an analog-to-digital converter. After this test has been completed, an error check is carried out again at 16. In the event of an error, a reset command is issued which resets the computer to its initial state 10; if no error is found, the next process step follows.

The implementation of method steps 12, 14, 16, 18 and again 16 in the form of predetermined self-test routines corresponds to a first section of the self-test. In the subsequent step 20, the actuator is now controlled with a provisional control signal. In the application example, this corresponds to a starting quantity of diesel that is sufficient to start the engine safely. A second section of the self-test is carried out while the engine is already running. This is much more time-consuming than the previous self-test carried out in the first section. In the second section of the self-test, a program routine is run through in which the remaining program memories are checked for function. This is represented by method step 22. After the completion of this process step, an error check is carried out as symbolized by 16. In the event of an error, the computer is reset to its initial state; in the other case, the actuator for control signals of the computer is released by the computer going into the main program. This is symbolized by 24. The second section of the self-test ends when the test to be carried out at 16 is successful.

In a modification of the flow diagram shown, the second section of the self-test can also take place after completion of the test 16 following the step 14 and the step 18 can be assigned to the second section of the self-test. In this case, method step 20, by which the actuator is controlled with a preliminary control signal, would have to be shifted upwards.

In a further modification, the computer can display error messages that only appear after several Self-test routines that have run without errors occur, are set to a different state than the initial state. A state is expediently chosen which corresponds to the last error-free self-test section.

Since the engine is cranked by the starter during the first section of the self-test, error messages can occur as a result of voltage drops without causing damage to the computer. In this case, the method according to the modified execution prevents test routines which have already been successfully run through from being repeated and thereby wasting unnecessary time. However, this configuration also requires special control measures, which in turn require program memory locations. Based on the consideration that such errors rarely occur anyway, the general resetting of the computer to the initial state should not be regarded as disadvantageous.

In a further development of the invention, this fact is saved as a switching state when the computer is reset due to newly applied operating voltage. This storage takes place e.g. B. in step 12. Before the provisional actuation of the actuator in step 20, a comparison 26 is carried out in this case, in which the switching state is evaluated as a switching criterion. The memory is then deleted in a method step 28. The memory is also erased if an error has already occurred before comparison 26 is reached.

If, in comparison 26, it is found that the self-test routines have been successfully carried out immediately after the operating voltage has been applied for the first time, method step 20 is then carried out. In the other case, method step 20 is not carried out. Resetting the computer to the initial state due to an error message therefore means that the actuator is held in the defined reference position during the subsequent self-test routines. In relation to the application example, this means that the engine receives zero quantity until the entire self-test is completed.

This measure prevents recurring error messages in the second section of the self-test from running through a loop in which the actuator is repeatedly controlled with the provisional control signal. In the application example, this would lead to the engine being cyclically injected with the starting quantity of diesel. Since the starting quantity is dimensioned much higher than the idling quantity, this would lead to the engine running up and over revving, which can lead to considerable damage. In this case, the safety aspect has priority over a reduction in the time for the control of the actuator with control signals.

In order to be able to monitor the safety of a computer-controlled actuator even during operation, a monitoring circuit (watchdog) is often provided. This checks z. B. arithmetic routines or sync pulses and triggers a reset command in the absence of such signals. This prevents the computer from an external disturbance, e.g. B. is brought into a state by a voltage drop, voltage peaks or by electromagnetic interference, which he can no longer leave by himself.

If the monitoring circuit is to be included in the self-test, z. B. can be proceeded according to a flow chart according to FIG. 2. The computer is programmed in such a way that it omits a computation routine or a synchronous signal, so that the monitoring circuit initiates a reset command.

In this case, a comparison 34 is carried out between method steps 12 and 14 by checking whether a reset command has taken place by the monitoring circuit. If this is the case, the computer goes into the main program 24, i.e. the actuator is released for control commands from the computer. However, this comparison is only carried out when all other self-test sections have been carried out successfully. The method steps are carried out in the same order as has been described in FIG. 1. If the self-test of the first and second sections was error-free, the actuator is first temporarily brought back into the defined reference position and held there in a method step 30. This corresponds to the delivery of zero quantity of diesel. In a subsequent method step 32, the wait for the arrival of a reset command which must be triggered by the monitoring circuit. After running through method step 12 in response to such a reset command, a check is then carried out at 34 as to whether the reset command has taken place by the monitoring circuit and has been transferred to main program 24. An embodiment of a computer-controlled actuator, which is shown as a block diagram in Fig. 3, is finally explained.

It includes an actuator 34 for actuating a control rod of an electronic diesel injection and a computer 36. A switch 40 is inserted into a control line 38 of the actuator 34, which switch 36 is switched by the computer 36 via a control line 50 and can assume three states.

As long as there is no switching signal at switch 40, it is in the position shown. In this position, it is at reference potential 42, which corresponds to a definition of a defined reference position. If the test routines of a first section are passed and if the initial state from which the computer started the self-test was due to the first application of the operating voltage, the switch 40 is switched to second position flipped. In this position, the actuator 34 is connected via a line 44 to a generator 46 which generates a preliminary control signal. In the application example, this corresponds to a starting quantity of diesel. Only when the computer has successfully completed all sections of the self-test does the switch 40 reach the third position, in which the actuator 34 is released for control signals from the computer 36, which it receives via a control line 48.

The method according to the invention and the computer coupled to an actuator thus enable a considerable shortening of the actuation of the actuator 34 triggered by the self-test. The remaining time, in which no injection of diesel takes place in the application example, corresponds approximately to the time required by the starter accelerate the engine to the starting speed. After the engine has started, the further self-test can then be carried out without potential faults due to voltage dips caused by the starter. In the course of this further self-test, any errors that occur lead to an immediate shutdown of the provisional control signal, i.e. the starting quantity of diesel. As a result, security is not compromised.

The measures achieved with the invention in the application example of the diesel engine thus contribute to the fact that the immediate starting behavior of the engine encourages the driver to switch off the engine during short stays and thus to reduce the environmental impact. Furthermore, the lifespan of the starter is increased, the battery is relieved, especially on short journeys, and the engine can be started even with a low battery.

Claims (12)

1. Process for driving a computer-controlled final control element in a self-test of a computer, the final control element being initially held in a defined reference position during the self-test and being released for control signals of the computer after the self-test has been successful, in particular for driving an electronic diesel injection system for diesel engines, characterized in that the final control element is only held during a first section of the self-test and is subsequently driven with a temporary control signal up to the end of a second section of the self-test or up to a previously occurring error message.

2. Process according to Claim 1, characterized in that the first section of the self-test is formed at least from test routines for testing the program memory part for the self-test program.

3. Process according to Claim 2, characterized in that the first section of the self-test is formed from test routines for testing the program memory part for the self-test program as well as other components of the computer other than the remaining program memory parts.

4. Process according to Claim 3, characterized in that the second section of the self-test is formed from test routines for testing the remaining program memory part.

5. Process according to one of Claims 1-4, characterized in that, in the case of an error message originating from an initial state of the computer from which the self-test was started, the self-test is repeated and in the absence of errors is subsequently continued, and in that the final control element is held in the defined reference position during the entire repeated and continued self-test.

6. Process according to one of Claims 1-4, characterized in that, in the case of an error message originating from the last error-free test routine, the self-test is repeated and continued in the absence of errors, and in that, during the entire repeated and continued self-test, the final control element is held in the defined reference position.

7. Process according to Claim 5, in which the computer is placed in the initial state by each new application of the operating voltage, the self-test being begun from said initial state, characterized in that the new application of the operating voltage is stored as a switching state and after the first section of the self-test has run free of errors, is evaluated as a switching criterion for the temporary control signal, and in that, after driving of the final control element with the temporary control signal or after an error message, the memory is cleared for the switching state of the new application of the operating voltage.

8. Process according to one of Claims 3-7, characterized in that a third section of the self-test is formed from a test routine of a monitoring circuit (watchdog) in which the final control element is again held in the defined reference position, and in that only when the test of the monitoring circuit has been successful can the final control element be released for control signals of the computer.

9. Process according to one of Claims 1-8, characterized in that, at the change-over of the computer from a self-test program to a main program, the control signals are released.

10. Process according to Claim 8 or 9, characterized in that, after a change-over of the computer from a test program via a reset procedure into the initial state, the control signals are released into a main program.

11. Process according to one of Claims 1 to 10 for driving an electronic diesel injection system for diesel engines, characterized in that the defined reference position of the final control element corresponds to a zero amount and the position assumed by the temporary control signal corresponds to a starting amount of diesel fuel for injection into a diesel engine.

12. A computer (36) coupled to a final control element (34), by means of which computer the final control element (34) can be switched over by a reference signal (42) between a defined reference position and a release position for control signals of the computer (36) and is held in the defined reference position during a self-test of the computer (36), characterized in that the final control element (34) can be switched over during the self-test into a third position by means of the computer (36), it being possible for the final control element to be driven in said third position by a temporary control signal, and in that a control signal generator (46) is provided, to which the final control element (34) is connected in this position.

Images