EP0423494A1 - Process and device for verifying the operation of sensors in a vehicle - Google Patents

Abstract

A device for verifying the operation of an idling switch LGS (14) and a pedal value emitter PWG (13) has a count register (15), which stores a count value. Whenever the signals from the pedal value emitter and from the idling switch to one another are plausible, this count value is set to an output count value, for example the value "4". On the other hand it is reduced by "1" if some implausibility occurs. If the count value reaches the value "0", that is implausibility has been detected on four successive runs of the plausibility test, a fault signal is emitted which leads to a fault display and to emergency running. This device and the process performed by it ensure that the operation of the said sensors can be reliably established even when the idling switch rebounds. The said count value process is particularly easy to perform. <IMAGE>

Description

The invention relates to a method and a device for checking the functionality of different sensors on a vehicle.

State of the art

Numerous sensors are used on vehicles, in particular to check the functionality of the internal combustion engine. So z. B. to determine the ignition timing and injection quantity, the speed is continuously monitored. If a sensor fails, this generally represents a safety risk for the continued operation of the vehicle. The functionality of the sensors must therefore be checked continuously. This is done in particular by a plausibility check as to whether the value of the received signal can be expected in comparison with the value of a signal received by another sensor. For example, there are various signals in a vehicle that are directly coupled to the speed. If a first such signal shows a high speed, a second shows a low speed, this is a sign that one of the sensors which the two signals deliver, works incorrectly. An error signal is then output, which is usually used to carry out an emergency run. Procedures of the above type are such. B. in DE 31 45 732 A1 (US 815 308).

DE 33 01 743 A1 (US 4,509,480) discloses a method in which a plausibility check is not carried out between two analog signals, as mentioned above, but in which an analog signal is compared with a digital signal from a switch. The analog signal is a voltage as it is emitted by a so-called pedal value transmitter, ie a potentiometer, the axis of rotation of which is coupled to the axis of rotation of an accelerator pedal. The digital signal is the signal from a switch which is also coupled to the accelerator pedal axis and which switches when the accelerator pedal reaches a minimum position, which indicates idling. Such a switch is called an empty gas switch. If the signal from the idle gas switch now indicates idle, while the signal from the pedal value transmitter corresponds to a voltage value that is clearly different from the idle voltage value, this is a sign that either the pedal value transmitter or the empty gas switch is defective. An error signal is again issued, which triggers emergency operation.

Corresponding switches that switch when actuators assume a minimum or maximum position are used on various components, eg. B. on the brake pedal, on the throttle valve or the control rod of an injection pump. Plausibility checks can be carried out for all signals of such switches in relation to other signals.

It has been found that in plausibility checks in which the signals from switches are used, various error signals are emitted, but then fixed ensures that all sensors whose signals have been subjected to the plausibility check are working properly.

The invention is based on the object of specifying a method for checking the functionality of sensors in a vehicle which also works very reliably when one of the sensors, the signals of which are subjected to a plausibility check in order to determine the functionality, is a switch. The invention is further based on the object of specifying a device for executing such a method.

The invention is given for the method by the features of claim 1 and for the device by the features of claim 4. Advantageous further developments and refinements of the method are the subject of subclaims 2 and 3. A further development of the device according to the invention is the subject of claim 5.

The inventive method is characterized in that after a switching operation of a switch whose signal is subjected to a plausibility check, the result of the plausibility check is only taken into account with a time delay after the switching operation. The invention is based on the knowledge that the various unreliability of plausibility checks with the signals from switches that have been observed so far is due to the fact that some of the switches show a switch bounce for a short time after the switching process. Switches z. B. an idle gas switch from the idle position to the non-idle position, it outputs several times shortly after triggering the switching process, the idle signal because of the bouncing. Is now a computer just at the moment when the empty gas switch again on the idle indicating Signal bounces back, the switch position is sensed, implausibility is recognized, since the switch is actually already in the non-idle position, which is indicated accordingly by the pedal value transmitter, with which the signal is compared. If the plausibility check is now carried out after a switching operation has been recognized until a time has elapsed that is at least as long as the period of time within which the switch bounces, the faulty results that have repeatedly occurred in the plausibility check can be avoided.

It is particularly advantageous if the waiting time, with the expiry of which the plausibility check can only be trusted, is realized by repeating the plausibility check continuously and changing a count value in the process. With each plausible result, the count is set to an output count. If, on the other hand, the result of the plausibility check reveals implausibility, the count value is changed in a predetermined direction, e.g. B. reduced. If it reaches an error count, e.g. B. the value zero, this is the sign that the plausibility check, which indicates implausibility, may be trusted. The error signal is then output. The output and error count value and the step size during counting are set so that counting from one value to the other surely takes a longer period of time than corresponds to the bounce period.

The device according to the invention has a customary checking means for checking for plausibility and, moreover, a time condition means which checks whether there is still implausibility when a time condition is met. The device preferably has a counting means for carrying out the counting method mentioned above.

It is noted that a self-monitoring system with a delay circuit is already known from DE 34 23 404 A1. At the end of engine starting, a predetermined waiting time is started, which is dimensioned such that the battery voltage can recover to a normal level until the waiting time has expired. Only then are self-monitoring processes carried out. Such a time delay method has nothing to do with the time delay in the method according to the invention for checking the functionality of sensors on a vehicle. However, the two methods can be used together, i.e. H. Execution of the method according to the invention does not begin until it has been ensured that the battery voltage has recovered to a normal level after the vehicle engine has been started.

 drawing

• Fig. 1A und B zeitkorrelierte Diagramme für die Signale von einem Pedalwertgeber bzw. einem Leergasschalter, zum Erläutern eines Plausibilitätsverfahrens mit Zeitbedingung;
• Fig. 2 ein schematisches Schaltbild einer Vorrichtung zur Plausibilitätsprüfung, mit Sensoren, deren Signale der Prüfung unterzogen werden;
• Fig. 3 ein Flußdiagramm eines Verfahrens zur Plausibili­tätsprüfung, bei dem als Zeitbedingung der Ablauf einer Wartezeit gilt;
• Fig. 4 ein Flußdiagramm eines Verfahrens zur Plausibili­tätsprüfung, bei dem als erfüllte Zeitbedingung das Erreichen eines Fehler-Zählwertes gilt.

The invention is explained in more detail below on the basis of exemplary embodiments illustrated by figures. Show it:

• 1A and B are time-correlated diagrams for the signals from a pedal value transmitter or an empty gas switch, for explaining a plausibility method with time condition;
• 2 shows a schematic circuit diagram of a device for plausibility checking, with sensors whose signals are subjected to the check;
• 3 shows a flowchart of a method for plausibility checking, in which the expiry of a waiting time applies as the time condition;
• Fig. 4 is a flowchart of a method for plausibility checking, in which the achievement of an error count value is considered to be a fulfilled time condition.

Description of exemplary embodiments

In the diagram according to FIG. 1A it is assumed that the accelerator pedal is adjusted from its rest position at a uniform speed, that is to say that the adjustment angle is increased uniformly from zero. When using a potentiometer as a pedal value transmitter, the voltage of which increases linearly with an increase in the pedal adjustment angle α, the linear relationship shown in FIG. 1A between output voltage U from the pedal value transmitter PG over time t or the adjustment angle α results.

The time-synchronous logic signal from an empty gas switch LGS is shown in FIG. 1B with the sequence of FIG. 1A. In the idle case LL, the switch outputs high level "1", while in the non-idle case LL outputs low level "0". Switching from one area to the other takes place at a relatively low accelerator pedal angle. Due to hysteresis effects, this angle can vary within small limits between an angle α1 and an angle α2, which are shown in FIG. 1A. A lower voltage U1 from the pedal value transmitter belongs to the lower angle α1, while an upper voltage U2 belongs to the upper angle α2 of the hysteresis range.

However, if the voltage U from the pedal value sensor is below the lower voltage U1, the empty gas switch gives the signal LL off, or if the voltage from the pedal value transmitter is above the upper voltage U2, but if the empty gas switch outputs the signal LL, this is both times a sign that one of the two sensors is not working properly. If the voltage lies between the lower voltage U1 and the upper voltage U2, both signals from the empty gas switch are permissible due to the hysteresis, so that no plausibility check can be carried out in this area.

In Fig. 1B it is shown in detail that the signal from the empty gas switch when switching from the idle state to the non-idle state is not in a simple manner from LL to LL jumps, but that the high level LL is reached again several times within a period t after triggering the switching. It is now assumed that the signal from the empty gas switch LGS is repeatedly sampled by a computer. The sampling times are shown in FIG. 1B and the associated measuring cycles are denoted by n to n + 3. The measurement cycle n is the last one before switching from the idle state to the non-idle state. Shortly after this measuring cycle, the signal from the empty gas switch LGS drops from the high level LL to the low level LL , then to switch back to the high level due to switch bouncing and from there again to the low level LL to fall. This low level is present at the next measurement cycle n + 1. In accordance with the non-idle signal from the idle gas switch, it is determined during this measuring cycle that the voltage U from the pedal value transmitter PWG is above the upper voltage U2. The signals from the two sensors are therefore plausible to one another.

After the measurement cycle n + 1, the rise to the high level LL and the fall to the low level are repeated LL three more times. In Fig. 1B it is assumed that the next measurement cycle n + 2 occurs just when the signal from bouncing empty gas switch reached the high level LL for the last time. This indicates idling, while the pedal value transmitter also outputs a voltage that is above the upper voltage U2. The two signals are therefore not plausible to one another. In known methods for checking the functionality of sensors, an error signal was accordingly output and emergency operation was introduced. In a method, as will be explained below by way of example with reference to FIGS. 3 and 4, such a misdiagnosis caused by switch bouncing is excluded. This is done by checking that a time condition is still fulfilled.

Before the methods according to FIGS. 3 and 4 are explained in more detail, the device representation according to FIG. 2 will be briefly explained. The device has a conventional microcomputer 10 with an A / D converter 11 and a logic measurement input 12. The signal from a pedal value transmitter PWG 13 is fed to the A / D converter 11, while the logic measurement input 12 receives the signal from an empty gas switch LGS 14 receives. The two sensors, that is, the pedal value sensor 13 and the empty gas switch 14 are supplied with a supply voltage VS of z. B. + 5 V. It is important for the method explained below with reference to FIG. 4 that the microcomputer 10 also contains a count value register 15.

3 is called from a main program. In a first step s1, the voltage is determined by the pedal value transmitter PWG. In a step s2 it is checked whether the voltage has changed the range, that is from <U1 to> U2 or vice versa. According to the example in FIG. 1b, no range change is found for the measuring cycles n and n + 4 in step s2, while a range change is determined for the measuring cycles n + 1 and n + 3. In response to a determined change of range, a step s3 is used Waiting time t 'set in the form of a count value. This waiting time is longer than the longest observed switch bounce time t. After step s3, the main program is returned to. If this is run through again so far that the test program with step s1 and the subsequent steps is reached again, the waiting time t'new is set for the measuring cycles n + 2 and n + 3. Only in measuring cycle n + 4 is it determined that the range indicated by the pedal value transmitter PWG has not changed. The time count is then reduced by a predetermined value in a step s3 'and a check is carried out in a step s4 to determine whether the waiting time has expired. This is not the case with the example, which is why the main program is returned to. If step s4 is reached again the next time the test program is run, that is to say for measuring cycle n + 5, the waiting time t 'has still not expired, which is why the main program is re-entered. The waiting time t 'only expired at the measuring cycle n + 6, whereupon the examination step s4 is now followed by a step s5 in which the position of the empty gas switch LGS is determined. In a step s6, the plausibility check explained above with reference to FIGS. 1A and 1B is carried out. If it is found in an evaluation step s7 that the signals are not implausible to one another, the main program is reached again. If, on the other hand, there is implausibility, this determination corresponds to an error signal which ensures that an error is displayed in step s8 and an emergency operation measure is taken. After that, the main program is also reached in this case. The nature of the emergency operation measure depends on the individual case. In the case with the fewest effects, it consists in switching to redundant signals and only asking for the error to be corrected by means of the error display. In other cases, some limiting measures are taken, e.g. B. the speed is limited if it is still measurable, or the amount of fuel is limited. In particularly critical cases, e.g. B. if proper operation of the internal combustion engine or the brake system can no longer be guaranteed, the vehicle is overridden by the error signal.

The method according to FIG. 3 immediately applies the knowledge that it is expedient to wait for a waiting time to elapse after a change in position of the empty gas switch has been ascertained before the result of the plausibility check is trusted. The method described in FIG. 4 described below also uses the expiry of a waiting time, but in an indirect manner, which leads to less computing effort than is required in the method according to FIG. 3.

Again, the test program is reached from the main program with a first step s4.1. The position of the empty gas switch LGS and the voltage from the pedal value transmitter PWG are determined in this. In a subsequent step s4.2, the plausibility check, which has already been mentioned several times, is carried out. In step s4.3 it is checked whether implausibility is present. If this is not the case, the counter value Z of a counter is set to an output counter value A in step s4.4, in the example to the value "4". Then the main program continues. If, on the other hand, there is implausibility in step s4.3, a step s4.5 is reached in which it is checked whether the count value Z has reached the value "0". If this is not the case, the count value Z is decreased by "1" in a step s4.6. The main program follows. If, on the other hand, it occurs in step s4.5 that the counter has counted down to the count "0" as an error count, this determination corresponds to the output of an error signal which leads to an error display and emergency operation measures in step s4.7. The main program then follows again.

The method according to FIG. 4 can be carried out more easily than that according to FIG. 3, since it is not necessary to carry out a test for a change in the position of the empty gas switch.

The output count value A, the step size when counting and the error count value are set in such a way that, together with the time which elapses between two runs of the test program, it is ensured that an error signal is only output if more implausibility states than occur they can be determined within a switch bounce time.

For the exemplary embodiments, the signals from an empty gas switch and a pedal value transmitter were used, since a reliable plausibility check is of particular importance for safety reasons for these signals. If implausibility is detected in the signals from these sensors, drastic emergency operation measures are always necessary. One tries to avoid unnecessary error signals. On the other hand, it is of the utmost importance to reliably identify errors that actually occur as quickly as possible. The method according to the invention is particularly advantageous for this. However, it can be applied to all methods for checking the functionality of sensors in which one of the sensors is a switch. In this case, a switch is understood to be any sensor whose signal level changes abruptly when a predetermined value of the variable to be measured is exceeded.

In the exemplary embodiments, it was assumed that the output of the error signal leads to an error display and to the taking of emergency operation measures. Depending on the application, one of the two measures can be dispensed with.

In the exemplary embodiment, it was assumed that of the two sensors, the two signals of which are checked for plausibility, only one is a switch. However, both sensors can also be switches.

The microcomputer 10 according to FIG. 2 is at the same time a test means for carrying out the plausibility check, and also a time condition means for checking whether the aforementioned time condition has been met, now check it using the method according to FIG. 3 or the one according to FIG. 4 or another method.

Claims (5)

1. A method for checking the functionality of different sensors on a vehicle, at least one of which is a switch, with the following steps:
- Execution of a plausibility check, in which it is examined whether a switch signal is plausible with respect to other sensor signals, and
Outputting an error signal when the check shows that the signals subjected to the plausibility check are implausible to one another,
characterized in that
- The error signal is output when, when a time condition is met after a switching operation of a switch whose signal is subjected to a plausibility check, this check results in implausibility. 2. The method according to claim 1, characterized in that
- a waiting time is set with each determined switching of a switch,
- the plausibility check is carried out at the end of the waiting period, and
- The error signal is issued if this plausibility check reveals implausibility. 3. The method according to claim 1, characterized in that
- the plausibility check is carried out repeatedly,
a count value is changed by a predetermined value in a predetermined direction if there is implausibility in the plausibility check,
- on the other hand, the count value is set to an initial count value if plausibility results in the plausibility check, and
- The error signal is output when the counter value reaches a predetermined error counter value. 4. Device for checking the functionality of different sensors on a vehicle, at least one of which is a switch, with
- a test device (10) for checking whether the switch signal is plausible compared to other sensor signals,
marked by
- A time condition means (10, 15) which checks whether a time condition has been met and then outputs an error signal if, when the time condition is met, after a switching operation of a switch whose signal is subjected to a plausibility check, this check results in implausibility. 5. The device according to claim 4, characterized in that the time condition means comprises a counting means (15) which is operated as follows to output the error signal when an error count value is reached:
- changing the count value by a predetermined value in a predetermined direction if there is implausibility in the plausibility check,
- on the other hand, setting the count value to an output count value if plausibility results during the plausibility check.

Images