JP2866135B2 - Control system for vehicle safety equipment - Google Patents

Description

Description: TECHNICAL FIELD The present invention relates to a control system for a vehicle safety device using a microcomputer.

2. Description of the Related Art As disclosed in Japanese Utility Model Laid-Open No. 2-5371, a system using a microcomputer is known as one of systems for controlling a vehicle safety device such as an airbag. The microcomputer integrates the deceleration signal from the acceleration sensor, compares this integrated value with the threshold level to determine the presence or absence of a vehicle collision. Inflate the airbag to increase occupant safety. This control system has recently attracted attention because a microcomputer can perform collision determination with high accuracy.

A watchdog timer is usually connected to the microcomputer. When the microcomputer runs out of control, a reset signal is output from the watchdog timer after a set time from the runaway, and the microcomputer is reset. Thereby, the microcomputer can escape from the runaway state.

[Problem to be Solved by the Invention] In the control system having the above configuration, an operation command signal may be output from the output port within the set time of the watchdog timer when the microcomputer runs out of control. In this case, there is a possibility that the reset of the microcomputer is not in time and the airbag expands.

[Means for Solving the Problems] The present invention has been made to solve the above problems.
The gist is the control system of the vehicle safety device shown in FIG. More specifically, the control system includes a drive circuit 10 of the vehicle safety device 1, an acceleration sensor 20 for detecting deceleration of the vehicle, a microcomputer 30, and a watchdog timer 60. The microcomputer 30
The presence or absence of a collision is determined based on the deceleration from the acceleration sensor 20. When the collision is determined, an operation command signal for operating the vehicle safety device 1 is transmitted from the output port to the drive circuit.
Send to 10. The watchdog timer 60 detects a runaway of the microcomputer and resets the microcomputer 30 after a lapse of a set time from the runaway. In the control system having such a configuration, the microcomputer 30 includes a plurality of output ports for outputting an operation command signal. The drive circuit 10 is configured to operate the vehicle safety device 1 only when receiving an operation command signal from a plurality of output ports. A delay circuit 50 is interposed between the drive circuit 10 and an output port other than at least one of the plurality of output ports. The delay time of the operation command signal by the delay circuit 50 is set longer than the set time of the watchdog timer 60.

[Operation] At the time of the runaway of the microcomputer 30, for example, an operation command signal may be output to the drive circuit 10 from all output ports. However, the operation command signal from a certain output port arrives at the drive circuit 10 with a delay longer than the set time of the watchdog timer 60 by the delay circuit 50, so that the vehicle safety device 1 does not operate within the set time of the watchdog timer 60. Does not work. When the operation command signal delayed by the delay circuit 50 reaches the drive circuit 10, the microcomputer 60 has already been reset, and the output of the operation command signal from another output port to which no delay circuit is connected is stopped. Therefore, the vehicle safety device does not operate. As a result, malfunction of the vehicle safety device due to runaway of the microcomputer 30 can be reliably prevented.

Embodiment An embodiment of the present invention will be described below with reference to FIGS. FIG. 2 schematically shows a control system for controlling the squib 1 of the airbag (vehicle safety device). The squib 1 is incorporated in the drive circuit 10. The drive circuit 10
A first transistor 11 of a PNP type connected to one end of the power supply side of the squib 1 and an NPN connected to the other end of the ground side of the squib 1
A second transistor 12 of the same type. Between the first transistor 11 and the power supply, in order from the first transistor 11 to the power supply, an energy reservoir (not shown) composed of a large-capacity capacitor, and a booster circuit for increasing the voltage of the energy reservoir higher than the power supply voltage. (Not shown).

The control system includes first and second acceleration sensors 21 and 22 for detecting the deceleration of the vehicle, and a microcomputer 30. Voltage signals representing the decelerations S1 and S2 of the acceleration sensors 21 and 22 are sent to analog / digital converters ADC1 and ADC2 built in the microcomputer 30, respectively, and are converted into digital data.

The microcomputer 30 has output ports PA, PB, PC, PD and a reset terminal Re.

The output port PA is connected to one input terminal of the NAND circuit 41. The output port PB is connected to one input terminal of 42 of the AND circuit. The output port PC is connected to the other input terminals of the NAND circuit 41 and the AND circuit 42 via the delay circuit 50. The delay circuit 50 has a resistor 51 and a capacitor 52 connected in order from the output port PC to the ground side, and a connection point voltage between the resistor 51 and the capacitor 52 is NAND-connected via a buffer 53. The signal is sent to the circuit 41 and the AND circuit 42. The delay time of the delay circuit 50 is set to be longer than a set time of a watchdog timer 60 described later.

Output terminals of the NAND circuit 41 and the AND circuit 42 are connected to bases of the transistors 11 and 12, respectively. Only when both output ports PA and PC are at high level, N
The output of the AND circuit 41 becomes low level, and the first transistor 11 turns on. Only when the outputs of the output ports PB and PC both go high, the output of the AND circuit 42 goes high and the second transistor 12 turns on.

The squib 1 is ignited by receiving a current supply from the energy reservoir only when the transistors 11 and 12 are both turned on, in other words, only when the outputs of the three output ports PA, PB and PC are all high. Perform airbag inflation.

A watchdog timer 60 is interposed between the output port PD of the microcomputer 30 and the reset terminal Re.

In the above-described configuration, the microcomputer 30 is connected to the third
The timer interrupt routine shown in the figure is executed every set time. First performs integration of the deceleration S ₁ from the first acceleration sensor 21 (step 100). That is, the first integral value Δ stored in the RAM
v Add the deceleration S _1, which is currently input to _1. Next, the integral of the deceleration S ₂ from the second acceleration sensor 21 (step (10
1). That is added deceleration S _2, which is currently input to the second integrating value Delta] v _2.

Next, it is determined whether or not the output port PA is at a low level (step 102). If it is determined that the low level is compared with the threshold level Th _1, which is determined in accordance with the first integrated value Delta] v ₁ in the deceleration S ₁ (step 103).

First integration value in step 103 Delta] v ₁ is when it is determined to be less than the threshold level Th _1, the output port PB is determined whether the low level (step 104). If it is determined to be at the low level, the second integral value Δv ₂ is decelerated.
Comparing the threshold level Th ₂ which is determined in accordance with the S ₂ (step 105). If it is determined that the second integral value Δv ₂ is less than the threshold level Th ₂ , the output level of the output port PD is switched (step 106), and the process returns to the main routine described later.

Normally, that is, when a vehicle collision has not occurred, the above steps 100 to 106 are executed for each timer interruption.

By switching the output level of the output port PD in step 106, this output level becomes two times the set time of the timer interrupt.
High and low are repeated at twice the cycle to become a program run signal indicating that the program is executed normally.
The watchdog timer 60 is reset, for example, each time it receives a high-level output from the output port PD. Since the set time of the watchdog timer 60 is longer than the period during which the high-level output is not received, a reset signal is not output from the watchdog timer 60 to the microcomputer 30 in a normal state.

When a collision occurs, the first integrated value Delta] v ₁ exceeds the threshold level Th _1, a second integrated value Delta] v ₂ is greater than the threshold level Th _2. Therefore, step 1
A negative decision is made at 03,105.

If a negative determination is made in step 103, it writes the first integrated value Delta] v ₁ as Delta] v ₁ 'in RAM (Step 10
7) Write a Th ₁ 'to the threshold level Th ₁ also RAM (step 108), the output port PA to the high level (step 109).

If a negative determination is made in step 105, the second integral value Δv _{2 is written} into the RAM as Δv ₂ ′ (step 11).
0), writing a Th ₂ 'to the threshold level Th ₂ also RAM (step 111), the output port PB to the high level (step 112).

The above Δv ₁ ′ and Th ₁ ′ represent the first integral value and the threshold level when the collision is determined in step 103. Similarly, Δv ₂ ′ and Th ₂ ′ represent the second integral value and the threshold level when the collision is determined in step 105.

In the timer interrupt routine after the output ports PA and PB are set to high level in steps 109 and 112, step
Since a negative judgment is made in 102, 104, steps 103, 107, 1
08,109 and steps 105,110,111,112 are not executed.

The microcomputer 30 executes the main routine shown in FIG. More specifically, it is determined whether or not the output port PA is at the high level (step 120), and whether or not the output port PB is at the high level (step 121). These steps 120,12
Repeat step 1.

When a positive determination is made in both steps 120 and 121, the determination in steps 122 and 123 is performed. That is, in step 122, the difference between the first integral value Δv ₁ ′ at the time of collision judgment and the threshold level Th ₁ ′ is compared with a predetermined value α representing an allowable range, and at step 123, the second integral value Δv ₂ at the time of collision judgment And the threshold level Th ₂ 'is compared with a predetermined value α.
If it is determined in steps 122 and 123 that the difference is smaller than α, it is determined that the integrated values Δv ₁ ′ and Δv ₂ ′ are normal as data, and the output port PC is set to high level (step
124). As a result, all three output ports PA, PB, and PC become high level, so that the squib 1 is ignited and the airbag expands.

The first integral Δv ₁ ′ or the second
If the data of the integrated value Δv ₂ ′ is abnormal due to radio interference, it is determined in step 122 or 123 that the difference is equal to or larger than the predetermined value α. At this time, the output port
PA and PB are returned to low level (step 125). As a result,
The ignition of the squib 1 is not executed, and the malfunction of the airbag can be prevented.

When microcomputer 30 runs away, step
Since step 106 is not executed and no program run signal is output, a reset signal is output from the watchdog timer 60 after a set time, and the microcomputer 30 is reset. By the way, at the time of the above runaway, watch dock timer
Within the set time of 60, the outputs of the three output ports PA, PB, and PC may all go high. However, the high-level output of the output port PC is delayed by the delay circuit 50 for a time longer than the set time of the watchdog timer 60, and reaches the NAND circuits 41 and 42. Transistors 11, 12
Can be turned off. Also, the high-level output of the output port PC is delayed and the NAND circuit 41 and the AND circuit
At the time point 42 has been reached, the microcomputer 30 has already been reset by the watchdog timer 60 and has returned to normal operation, and the low-level output of the output ports PA and PB has become N.
Since the voltages have reached the AND circuits 41 and 42, the transistors 11 and 12 are not turned on. As a result, malfunction of the airbag can be more reliably prevented.

The low-level output from the output ports PA, PB, and PC can be recognized as an operation inhibition signal to the drive circuit 10.

The delay time of the delay circuit 50 is set to be sufficiently short so that, when a vehicle collision actually occurs, the elapsed time from the time of the collision to the inflation of the airbag is sufficient to ensure the safety of the occupant. Of course.

The present invention is not limited to the above embodiments, and various modes are possible. For example, the squib 1 may be ignited simply by setting the output ports PA and PB to high level. In this case, the NAND circuit
A transistor is used instead of 41, and the AND circuit 42 and the output port PC become unnecessary. The routine shown in FIG. 4 is not required. In this case, a delay circuit is interposed between one of the output ports PA and PB and the drive circuit.

Although only one acceleration sensor may be provided, even in this case, a plurality of operation command signal output ports are required.

The control system of the present invention is applicable not only to airbag control but also to seatbelt control.

[Effects of the Invention] As described above, the present invention uses the delay circuit to prevent malfunction of the vehicle safety device within the set time of the watchdog timer which cannot be prevented by the watchdog timer during runaway of the microcomputer. Thus, malfunction can be reliably prevented.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a basic configuration of the present invention, FIG. 2 is a circuit diagram schematically showing an embodiment of the present invention, and FIG.
FIG. 4 is a flowchart showing a timer interrupt routine executed by the microcomputer shown in FIG. 4, and FIG. 4 is a flowchart showing a main routine. 1 vehicle safety device, 10 drive circuit, 20, 21, 22 acceleration sensor, 30 microcomputer, 50 delay circuit, 60 watchdog timer, PA, PB, PC output port.

──────────────────────────────────────────────────続 き Continued on the front page (58) Field surveyed (Int.Cl. ⁶ , DB name) B60R 21/32

Claims (1)

(57) [Claims] 1. A drive circuit for a vehicle safety device; (b) an acceleration sensor for detecting a deceleration of the vehicle; and (c) a determination of the presence or absence of a collision based on a deceleration signal from the acceleration sensor. A microcomputer that sends an operation command signal for operating the vehicle safety device from the output port to the drive circuit when it is determined that a collision has occurred; and (d) a microcomputer that detects runaway of the microcomputer and after a lapse of a set time from runaway. The microcomputer has a plurality of output ports for outputting an operation command signal, and the drive circuit has a vehicle safety only when receiving an operation command signal from the plurality of output ports. An output port excluding at least one of the plurality of output ports and a driving circuit. A control system for a vehicle safety device, wherein a delay circuit is interposed between the road and the road, and a delay time of the operation command signal by the delay circuit is set longer than a set time of a watchdog timer. .