JP2877912B2 - Electronic control unit for internal combustion engine - Google Patents

Description

The present invention relates to an electronic control unit for an internal combustion engine, and more particularly to at least one controllable circuit unit or component of an internal combustion engine, for example an actuator for a diesel injection pump. And an electronic control unit for an internal combustion engine having at least one control output terminal for outputting a digital control signal.

[Related Art] An electronic control unit of an internal combustion engine is often provided with two computers. Hereinafter, each computer is referred to as a main computer and a sub computer, respectively. The sub-computer monitors the main computer in particular and performs an emergency function if the main computer fails. In the case of various control devices, the subcomputer has only this emergency function. In other controllers, the sub-computer assists the main computer, even when normally operating for control purposes. In this case, either of the two computers can perform an emergency function if the other computer fails.

The sub-computer monitors the main computer using data exchanged between the two computers via data lines. Two more computers are monitored by a watchdog circuit operated by both computers. While at least one of the computers is outputting a trigger signal for activating the watchdog circuit, the watchdog circuit outputs a pass signal to an AND circuit provided in a stage preceding the control output terminal. When no signal is output from the watchdog circuit to the AND circuit, the AND circuit outputs a logic level “zero”. This level corresponds to a safety potential and moves the actuated components of the internal combustion engine into position so that a failure of the control device does not endanger the occupant of the motor vehicle equipped with the internal combustion engine.

When the sub-computer detects the failure of the main computer, it outputs to the signal output means a switching signal indicating that the output signal from the sub-computer should be output to the control output terminal. The problem is that the sub-computer may output a switching signal due to an erroneous function. In that case, the signal from the main computer is not output to the control output terminal, and is switched to the signal from the sub computer even though the sub computer is malfunctioning.

[Problem to be Solved by the Invention] The problem to be solved by the present invention is to make it possible to monitor as surely as possible so that an unintended output signal is not output.
An electronic control device for an internal combustion engine having a main computer and a sub computer is provided.

[Means for Solving the Problems] According to the present invention, the above-mentioned problems are solved by the features described in Claims 1 and 2.

[Operation] The present invention relates to various embodiments of an electronic control device having particularly high reliability. All of the control devices of the present invention have the following configuration: a main computer, a sub-computer that monitors the main computer, and performs an emergency function when the main computer fails, and a monitoring unit that monitors the computer ( Watchdog circuit), and signal output means for outputting a signal having two levels to at least one control output terminal, wherein one of the levels has a safety potential and the potential is continuously output. Has a configuration in which the internal combustion engine is maintained in a safe driving state.

The monitoring means monitors the function of the main computer (10) and the function of the sub-computer (12), and the signal output means
At least the sub-computer outputs the switching signal,
At the same time, if the condition that the sub-computer is operating normally is detected by the monitoring means, the output signal of the sub-computer is output to the associated control output terminal, while the monitoring means When a failure of the main computer and the sub-computer is detected, a safety potential is outputted to each control output terminal (FIG. 1).

By such means, the signal of the sub-computer is output to at least one control output terminal only when the probability that the function of the sub-computer is normal is very high. The normal operation of the subcomputer can be detected by outputting a predetermined signal to the monitoring means.

In such a control device, only the sub-computer detects the failure of the main computer, and even when the monitoring means still detects that the main computer is normal, the output signal of the sub-computer is output to the control output terminal. Output. In this case, the output signal of the sub-computer is output to each control output terminal only when the condition that the monitoring means detects the failure of the main computer is satisfied, and the function of each computer is normal by the monitoring means. If it is detected that the sub-computer has detected a failure in the main computer, it can be configured to output a safety potential to each control output terminal. With this configuration, it becomes possible to output the safety potential to the control output terminal when only the sub-computer detects the failure of the main computer (the configuration in FIG. 2).

As is apparent from the above description, the function of the entire control device is the function of the watchdog circuit. Therefore, it is preferable that the monitor signal is output to the watchdog circuit by the computer, and the output signal of the watchdog circuit is tested after the output of the monitor signal (fourth embodiment).
Figure). As a result of the test, when it is revealed that the watchdog circuit is not functioning properly, a safety potential is output from the signal output means to the control output terminal. The watchdog circuit can be composed of a common watchdog circuit that monitors both computers as in the case of the related art, or can be an individual watchdog circuit.

Even if the function of the computer is determined to be normal, there is always a risk that an incorrect output signal is output. In order to eliminate such malfunctions based on danger,
The signal output to the control output terminal is tested by at least one computer, and if it is detected that the value of the tested signal does not match the expected value, safety control is performed. Instead of the signal output at the control output terminal, it is also possible to test the output signal of the output stage activated by the signal at the control output terminal.

The function of monitoring both computers and the function of testing that the output signals are accurate may be used individually or together. It is very effective to use together all means that contribute to increasing safety.

EXAMPLES Hereinafter, the present invention will be described in detail with reference to examples shown in the drawings.

The control device shown in all of FIGS. 1 to 4 includes a main computer 10, a first watchdog circuit 11 for monitoring the main computer, a sub computer 12, a second watch dog circuit 13 for monitoring the sub computer, and Signal output means 14.1 having a group of circuits performing different functions is provided. This signal output means 14.1 is indicated by a dashed line. Each control unit drives at least one circuit unit of the internal combustion engine. In FIG. 1, two circuits 15.1 and 15.2 are provided. Each circuit unit receives a control signal from at least one control output terminal 16. The control device shown in FIG. 1 is provided with two control output terminals 16.1 and 16.2.
The circuit unit is, for example, a drive circuit or a controller that drives an actuator. In the former case, that is, in the case of an actuator drive circuit, the output control signal is an operation signal, and in the latter case, that is, in the case of a controller, it is a target value signal. Different control signals can be output to different control output terminals. However, the control signal is a digital signal and therefore a signal having two levels. Each of the circuit units 15 is configured such that when one level of the signal is continuously output, the vehicle equipped with the internal combustion engine can be maintained in a safe driving state. The potential at the level at which the safe state occurs is referred to below as the safe potential. This potential can be a low level or a high level according to the configuration of the circuit unit 15 to be driven.

The signal output means 14.1 of the control device shown in FIG. 1 is provided with an OR gate 17, an AND gate 18, a switching device 19, and two shut-off AND gates 20.1 and 20.2. The signals from the first watchdog circuit 11 and the second watchdog circuit 13 are input to the OR gate 17. The output of the OR gate 17 becomes the first input signal of the blocking AND gates 20.1 and 20.2. The second input signal of the first shut-off and gate 20.1 is the first output signal HAS.1 of the main computer. The second input signal of the second shut-off and gate 20.2 is the second output signal HAS.2 of the main computer 10. The output signal of the first cut-off AND gate 20.1 is the first control output terminal 1
Guided to 6.1. Similarly, the output signal of the second cut-off AND gate 20.2. Is output to the second control output terminal 16.2.

However, the output signals HAS.1 and HAS.2 are input to the shutoff AND gates 20.1 and 20.2 only when the main computer 10 is functioning normally. If the function of the main computer 10 is not normal, the switching device 19 switches, whereby the output signals NAS.1 or NAS.2 of the sub-computer 12 are input to the shut-off AND gates 20.1 and 20.2. This switching is performed when an output signal is output from the AND gate 18. The output signal of the second watchdog circuit 13 is input to one input terminal of the AND gate 18, and the switching signal US is input to the other input terminal. When the two signals go high, a switch is made.

The logical processing of the above functions is performed in the following procedure.

If at least one of the two watchdog circuits 11 and 13 indicates that one of the two computers is functioning properly, a high-level signal is output from the OR gate 17, whereby The two blocking AND gates 20.1 and 20.2 are switched to the conducting state. Therefore, a signal applied to the second input terminal of the shut-off AND gate is output from the output of the shut-off AND gate. This signal is the respective output signal HAS.1 or HAS.2 if the main computer is functioning properly. However, when an error signal is input to the sub-computer 12 via the data exchange line 21 or no signal is input to the sub-computer, the main computer 10
When the sub-computer determines that has failed, the sub-computer 12 is switched to the data signal NAS.1 or NAS.2. When a switching signal is output from the sub-computer 12 due to the provision of the AND gate 18 in the above-described circuit, and at the same time, the second watchdog circuit 13 detects that the sub-computer 12 is functioning normally. Only by the switching signal, switching is performed. In a conventional known control device, the sub-computer may erroneously recognize that the function of the main computer is not normal due to a malfunction, and thereafter, the switching may be performed and the sub-computer may output an erroneous output signal. This disadvantage is solved in the control device shown in FIG.

The above disadvantages can be further remedied by using the principle described below with reference to FIG. That is, in FIG. 2, when the watchdog circuit provided in the sub-computer indicates the failure of the sub-computer, not only the output of the signal from the sub-computer is prevented but also the main computer 10 is provided. Although the watchdog circuit 11 indicates that the function of the main computer is normal, even when the sub-computer 12 indicates the failure of the main computer 10, the output of the signal from the sub-computer is prevented. .

In order to realize the above principle, the signal output signal 14.2 of the control device shown in FIG.
In addition to the functions in 4.1, an AND gate 22 shown in FIG. 2 is further provided. In this second AND gate 22,
And only the second AND gate 22 has the OR gate 17
And the output signal of the AND gate 18 are input. in this case,
The signal of the AND gate 18 is inverted and input. In addition,
The input signals of the OR gate 17 and the AND gate 18 are the signals described with reference to FIG.

For simplicity, only one control output terminal 16 is shown in each of FIGS. 2 and 3 and 4. A circuit unit 15 operated by the signal is connected to the control output terminal. Similarly, the main computer 10 outputs only one output signal HAS,
The sub-computer 12 is also shown as outputting only one output signal NAS. However, even when a large number of control signals are output from each computer to a large number of control output terminals, the principle of the control device does not change.

The output signal of the shut-off AND gate 20 is input to the control output terminal 16 described above. The shutoff AND gate 20 receives two input signals, in particular, the output signal of the second AND gate 22 and the output signal of the switching device 19. In the embodiment shown in FIG. 2, this switching device 19
Is switched by the output signal of the first watchdog circuit 11 instead of by the switching signal US output from When this signal falls to a low level, the switching device 19 outputs the output signal of the main computer 10.
Switching from the HAS to the output signal NAS of the subcomputer 12 is performed.

By operating the switching device 19 as described above, the first watchdog circuit 11
When it is detected that the function of 10 is normal, the output signal of the sub-computer 12 is not output to the control output signal 16. However, at the same time, when the sub-computer 12 detects an abnormality in the function of the main computer and the switching signal US is output to the AND gate 18, the second AND gate 22 shuts off the second AND gate 22 in the circuit described above.
Is output to a low level, whereby the shut-off AND gate 20 outputs a signal having a low level to the control output terminal 16. This is performed by the switching signal US being combined at the AND gate 18 with the signal from the watchdog circuit 13 and the inverted signal being input to the second input terminal of the second AND gate.

Therefore, in the circuit shown in FIG. 2, the signals from the two watchdog circuits 11 and 13 are lost (one input of the second AND gate 22 becomes low level), or the sub-computer 12 outputs the switching signal US And the watchdog circuit 13 detects that the function of the sub-computer 12 is normal (the other input of the second AND gate 22 becomes low level). It is shut off, and the safety potential is output to the control output terminal 16.

The control device shown in FIG. 3 is a modified example of the control device shown in FIG. In the case of FIG. 3, when the sub-computer 12 fails and the first watchdog circuit 11 indicates that the function of the main computer 10 is normal, the safety potential is always output to the control output terminal. Instead, when the output signal HAS of the main computer 10 and the output signal NAS of the sub-computer 12 match, control is performed by digital signals. Further, in this embodiment, unlike the embodiment shown in FIG. 2, the switching device 19 is not provided, and the output signal HAS of the main computer 10 or the sub-computer 12
Is supplied to the control output terminal 16 or both signals are supplied to the control output terminal under the conditions described in the preceding paragraph.

The signal output means 14.3 shown in FIG. 3 includes a main AND gate 24.1, a sub AND gate 24.2, a signal OR gate 25.1, a cut-off OR gate 25.2 (and a second AND gate).
22) is provided. The output signals of the OR gates 25.1 and 25.2 are input to the second AND gate 22 as input signals. The output signals of the two AND gates 24.1 and 24.2 are input to the signal OR gate 25.1 as input signals.
Output signals from both watchdog circuits 11 and 13 are input to the cut-off OR gate 25.2 as input signals. Further, the output signal of the first watchdog circuit 11 is a main AND gate.
Input to 24.1 as an input signal. Similarly, the output signal of the second watchdog circuit 13 is input to the sub AND gate 24.2 as an input signal. Main And Gate 2
The second input signal of 4.1 is the output signal HAS of the main computer 10, and the second input signal of the sub AND gate 24.2 is the output signal NAS of the sub computer 12.

Here, the function of the control device configured as described above will be briefly described again. When the first watchdog circuit 11 and the sub computer 12 detect that the function of the main computer 10 is normal, the output signal HAS of the main computer is output to the control output terminal 16. When the failure of the main computer 10 is detected by the first watchdog circuit 11 and the sub computer 12, the output signal NAS of the sub computer 12 is output to the control output terminal 16.
Both watchdog circuits 11 and 13 are
If 10 or 12 faults are detected, control output terminal 16
, A safety potential is continuously output. Further, the sub-computer 12 detects the failure of the main computer 10, and if the watchdog circuit 11 nevertheless detects that the function of the main computer 10 is normal, the outputs HAS and NAS of both computers 10 and 12 are obtained. A digital output signal is output to the control output terminal only when the values match. Otherwise, a safety potential is output.

As is clear from the above description, it is important for the desired driving safety whether the watchdog circuits 11 and 13 function normally. In order to test whether the function is perfect, in the control device of the embodiment shown in FIG. 4, the output signal of the first watchdog circuit 11 is fed back to the main computer 10 and the second watchdog circuit The configuration is such that the output signal of 13 is fed back to the sub computer 12. In the test program, the main computer 10 stops the trigger signal for activating the first watchdog circuit 11, and then determines whether the output signal of the watchdog circuit has dropped to a low level. If it does not decrease, it indicates that the function of the first watchdog circuit 11 is erroneous.
SH is output to the signal output means 14. This signal output means 14
Is not shown in FIG. The signal output means of FIG. 4 preferably operates according to any of the principles described in FIGS. In order to output the emergency travel signal NLS.H, the signal output means 14 outputs a safety potential to the control output terminal or outputs a digital signal which significantly restricts travel driving. This prompts the driver of the car to go to the repair shop to repair the control unit.

The main computer 10 has a first watchdog circuit 11
The subcomputer 12 also tests the second watchdog circuit 13 in the same way as outputting the emergency running signal NLS.H when the first watchdog circuit has failed, and In some cases, an emergency traveling signal NLS.N is output.

The above-described test can also be performed when two different watchdog circuits are not provided and two computers operate a common watchdog circuit. In this case, the main computer 10 informs the sub computer 12 via the data exchange line 21 that no operation signal (trigger signal) is output. Thereafter, either computer detects whether the output signal of the watchdog circuit has disappeared. If it does not disappear, activate the emergency traveling means.

As will be apparent from the above description, the various embodiments of the signal output means are all used to ensure reliable operation in the event that either computer fails. However, if the function of the signal output means itself is erroneous, or if the activated circuit unit 15 processes the input signal incorrectly, the result may be different from the intended one. In order to improve the driving safety of this type of error, the control device shown in FIG.
Is output to both the main computer 10 and the sub computer 12.
In that case, each computer tests whether the signal generated at the control output terminal 16 matches the expected signal. To that end, the output signal of the circuit unit 15 can be fed back to the two computers to compare the expected signals. If an error occurs in either of the comparisons, the main computer 10 or the sub-computer 12 outputs the inhibition signals SPS.H to SPS.N. This signal is input to a safety switch 26 connected to the subsequent stage of the circuit unit 15, and the safety switch outputs an earth potential or another safety potential according to the intended use to an output line. By providing a second connection point (not shown in FIG. 4) acting in parallel with the output terminal 16 having the circuit unit 15 in place of the safety switch 26 connected at the subsequent stage, for example, as shown in FIG. It is also possible to obtain a safe state via another output terminal as shown in FIG.

The safety measures described with reference to FIG. 4 can preferably be used together, but can also be used separately. It is extremely effective to use the means described with reference to FIG. 4 together with the means described with reference to FIG. 2 or FIG.

[Effects of the Invention] As described above, according to the present invention, only when the probability that the function of the subcomputer is normal is very high,
It becomes possible to output the signal of the sub-computer to at least one control output terminal.

[Brief description of the drawings]

FIG. 1 shows that the output signal of the sub-computer can be output to the control output terminal only when it is determined by the watchdog circuit provided in the sub-computer that the sub-computer is functioning normally. FIG. 2 is a block circuit diagram of the electronic control device configured. FIG. 2 shows a watchdog circuit provided in the subcomputer, which determines that the subcomputer is functioning normally. FIG. 3 is a block circuit diagram of an electronic control device configured to output an output signal of the sub-computer to the control output terminal only when the circuit indicates a failure of the main computer. Watchdog circuit determines that the subcomputer is functioning properly. Only when the watchdog circuit provided in the main computer indicates a failure of the main computer or when the main computer and the subcomputer output the same output signal, the output signal of the subcomputer is output to the control output terminal. FIG. 4 is a block circuit diagram of an electronic control device configured to be able to output, and FIG. 4 monitors an output signal and outputs the output of the control device when the obtained output signal does not match the expected output signal. FIG. 3 is a block circuit diagram of an electronic control device configured to apply a safety potential to a terminal. 10: Main computer 11: First watchdog circuit 12: Subcomputer 13: Second watchdog circuit 14: Signal output means 15: Circuit unit 16: Control output terminal

────────────────────────────────────────────────── ─── Continued on the front page (72) Inventor Herbert Graf Germany 7295 Dornstedttten am Bergwerk 2 (72) Inventor Werner Zimmermann Germany 7000 Stuttgart 40 Driesetstraße 9 Base ( 72) Inventor Johannes Locher 7000 Stuttgart 50 / Möwenweg 50 (56) References JP-A-57-176341 (JP, A) JP-A-60-135332 (JP, A) 61-49154 (JP, A) JP-A-63-183254 (JP, A) (58) Fields investigated (Int. Cl. ⁶ , DB name) F02D 45/00 G06F 11/18, 11/20

Claims (5)

(57) [Claims] A main computer (10) and a sub-computer (1) that monitors the main computer and performs an emergency function when the main computer fails.
2); monitoring means (11, 13) for monitoring a computer; and signal output means (14.1) for outputting a signal having two levels to at least one control output terminal (16.1, 16.2). One of them has a safety potential, and when the potential is continuously output, the internal combustion engine is maintained in a safe drive state, and the monitoring means controls the functions of the main computer (10) and the sub-computer (12). In the electronic control unit for an internal combustion engine to be monitored, the signal output unit (14.1) outputs a switching signal at least by a subcomputer
At the same time, when the condition that the sub-computer is operating normally is detected by the monitoring means, the output signal of the sub-computer is output to the associated control output terminal (16.1, 16.2). On the other hand, the electronic control unit for an internal combustion engine is configured to output a safety potential to each control output terminal when the monitoring means detects a failure in the main computer and the sub-computer. 2. A main computer (10) and a sub-computer (1) that monitors the main computer and performs an emergency function if the main computer fails.
2), monitoring means (11, 13) for monitoring a computer, and signal output means (14.2) for outputting a signal having two levels to at least one control output terminal (16), one of the levels Has a safety potential, and when the potential is continuously output, the internal combustion engine is maintained in a safe driving state, and the monitoring means monitors the function of the main computer (10) and the function of the sub-computer (12). In the electronic control unit for an internal combustion engine, the signal output means (14.2) may be connected to the sub-computer (12) only when a condition that the monitoring means detects a failure of the main computer (10) is satisfied. An output signal is output to the associated control output terminal (16), and the monitoring means has detected that the functions of both computers are normal. If you are detecting that the function of the computer is abnormal, the electronic control device for an internal combustion engine, characterized by being configured to output a safety potential to each control output terminal. 3. A computer (10, 12) outputs a monitoring signal to monitoring means (11, 13), and after outputting the monitoring signal, an output signal of the monitoring means is tested. As a result of the test, the monitoring means normally operates. 3. The internal combustion engine according to claim 1, wherein a safety potential is output from the main computer (10) or the sub-computer (12) when it is clear that the internal combustion engine is not functioning. Electronic control unit. 4. A signal applied to a control output terminal (16) is:
2. The safety control according to claim 1, wherein the safety control is performed if the value of the signal tested is detected by at least one of the computers and does not match the expected value. The electronic control device for an internal combustion engine according to any one of claims 1 to 3. 5. The output signal of a controlled circuit unit (15) is tested by at least one computer (10, 12), said circuit unit being activated by a signal applied to an associated control output terminal (16), respectively. The safety control is performed when it is detected that the value of the tested signal does not match the expected value, and the safety control is performed. An electronic control unit for an internal combustion engine according to claim 1.