JP3042277B2 - Fail-safe device for in-vehicle electronic control system - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a fail-safe device for an on-vehicle electronic control system.

[0002]

2. Description of the Related Art As a prior art relating to a fail-safe device of an in-vehicle electronic control system, for example, Japanese Unexamined Patent Publication No. Hei.
There is a technique disclosed in 134601. This means that two microprocessors (CPUs) execute the same control operation, compare their intermediate and final results, monitor each other's operation, and when an abnormality is confirmed, each CPU turns off the output. This is a safety device that can be configured. This technique is effective when only one of the CPUs malfunctions due to, for example, heat generation during long-term use.

[0003]

Generally, when a strong electromagnetic field is generated around a CPU, which is a high-density integrated circuit, by a strong radio wave propagating in the air, a potential corresponding to the frequency of the radio wave is generated inside the CPU circuit. May be induced to cause an operation different from the normal operation. Therefore, in the case where the above-described conventional technology is used, even when a strong electromagnetic field that deviates from laws and regulations is received from outside the vehicle, a plurality of CPUs may simultaneously perform operations different from the normal operation as described above. In order to avoid such a problem, it is necessary to completely shield with a metal case, which increases the cost. Conversely, when a low-cost simple case is used, even if the monitoring device using a plurality of CPUs is shielded, any of the CPUs will eventually operate differently from the above-described normal operation due to radio interference. There is fear that the electronic control system may operate differently from normal operation.

[0004] The present invention solves the above-mentioned conventional problems, and when an electromagnetic wave that generates an abnormally strong electromagnetic field that deviates from laws and regulations arrives, a part of the electromagnetic shielding means for the on-vehicle electronic control system. It is an object of the present invention to provide a fail-safe device of an in-vehicle electronic control system which can minimize damage even if there are some incomplete points (for example, installation in a low-cost simple case). .

[0005]

According to the present invention, a plurality of system monitoring circuits are provided for performing fault diagnosis of an actuator drive circuit and mutual fault diagnosis between monitoring circuits of a control system. Installed separately from each other, and the two monitoring means are mutually connected in the vehicle.
Install in a remote location or use one monitoring means
Storage in a storage means with a greater radio wave shielding effect than
At least one treatment was applied. Further, the conduction state is maintained only after the start switch is turned on, and when the system failure is detected by the monitoring circuit, the system is shut off. It is provided between the driving circuits.

[0006]

The plurality of monitoring circuits of the electronic control system are as described above.
As in, or placed in a separate site away the each other's respective inside the body, from at least one of the monitoring circuits in the adjacent installation performs good electromagnetic shielding and housed in a metal case, from the outside Even under the influence of strong electromagnetic waves,
It does not happen that a plurality of monitoring circuits of the electronic control system malfunction at the same time. Therefore, the one of the system monitoring circuit becomes cormorants by malfunction is detected by the other system monitoring circuit surviving in still normal state by slight time difference, the electronic control system is cut off from the power supply, i.e. the The failure of the electronic control system is handled in a fail-safe manner by the inventive fail-safe device, and control of the system-equipped vehicle is left to manual control, for example.

[0007]

【Example】

First Embodiment: This embodiment relates to a vehicle equipped with an internal combustion engine, in which variable driving force characteristic control (accelerator-by-wire) for controlling a throttle opening in accordance with an accelerator opening is performed by using an electronically controlled throttle and the aforementioned fail-safe device. This is the system used. In FIG. 1, a normally closed type first electromagnetic clutch is arranged between an accelerator pedal and a throttle valve,
The structure example of the electronic throttle actuator which arrange | positioned the normally open type 2nd electromagnetic clutch between the throttle valve and the drive DC motor is shown. In this embodiment, a first electromagnetic clutch shown on the left side of FIG. 1 and its vicinity are connected to a throttle valve return spring for urging the throttle valve in the closing direction (rotating the throttle shaft) and an accelerator pedal by an accelerator wire. An accelerator drum return spring for urging the accelerator drum in the closing direction (rotating the accelerator drum around the throttle shaft) is disposed. Further, a throttle sensor for measuring the rotation angle of the throttle shaft and an accelerator sensor for measuring the rotation angle of the accelerator drum are arranged at predetermined positions. In the first and second electromagnetic clutches shown in FIG. 1, a black portion is a throttle side clutch plate, which is movable in the axial direction of the throttle in accordance with the on / off of energization of the electromagnetic clutch coil. When the coil is energized, the spring is compressed and moved to the right in the figure), but is engaged with the throttle shaft in the rotational direction. In the first electromagnetic clutch, the clutch plate is always biased by a spring in a direction (left side in the figure) in which the clutch plate is connected to the accelerator drum.
In the second electromagnetic clutch, the clutch plate is always biased by a spring in a direction (left side in the drawing) that is not connected to the motor side. If the coil is not energized, the operation of the accelerator pedal is performed by the accelerator pedal. The accelerator drum is rotated via the wire, and the throttle shaft rotates together with the accelerator drum. When the coil is energized, both clutch plates are attracted to the right in the drawing, and the throttle shaft is rotated by the motor. In this embodiment, a DC motor is used for driving.

FIG. 2 is a system configuration diagram of the present embodiment.
Reference numeral 1 denotes a throttle valve for adjusting the intake air amount of the engine. Reference numeral 2 denotes an electronic throttle valve actuator using the aforementioned DC motor and electromagnetic clutch. 3
Is an accelerator (opening) sensor (dual system), which detects the accelerator opening ACC based on the output voltage of the potentiometer. 4 is a throttle (opening) sensor, which is a throttle opening T
VO is detected by the output voltage of the potentiometer. 5
Is a start switch that is turned on by the driver when the internal combustion engine is started. Reference numeral 6 denotes a self-holding relay circuit using three electromagnetic relays.

Reference numeral 7 denotes the aforementioned throttle drive circuit and the first
The first electronic controller is also used as a system monitoring circuit. Reference numeral 8 denotes a one-chip microcomputer with a CPU, RA
It has M, ROM, digital port, A / D port and various timers. When the system is normal, the microcomputer 8 outputs a CLUTCH signal for instructing energization of the electromagnetic clutch, further calculates a target throttle opening based on various sensor signals and switch signals, and sets the actual throttle opening to this target value. In order to match, a DIR output signal indicating the forward / reverse rotation direction of the DC motor and a DUTY output signal indicating the DC motor drive current are output. When a system failure occurs (when the drive circuit or the second system monitoring circuit fails), an instruction is given to shut off the motor drive current, the clutch drive current, and the electromagnetic relay (No. 1) drive current of the self-holding relay circuit 6. It is possible to perform output and shift from electronic control of the throttle opening using the motor as the driving force to direct drive of the throttle by the accelerator pedal (and the accelerator wire), and at the same time, completely cut off the power supply. Reference numeral 9 designates, based on microcomputer output signals (DUTY, DIR), such that only one set of power transistors at diagonal positions of the DC motor driving bridge circuit is turned on, and the motor driving current and the current direction are changed. This is a DC motor drive circuit to be controlled. Reference numeral 10 denotes an electromagnetic clutch drive circuit, which outputs an output signal (CLUTC
The power transistor is turned on and off based on H).

Reference numeral 11 denotes a second electronic controller used as a second system monitoring circuit. This second electronic controller 11 may also be constituted by a one-chip microcomputer 12 and an electromagnetic relay drive circuit 13, similarly to the first electronic controller 7. . When the failure of the first system monitoring circuit is detected, the drive current of the electromagnetic relay (No. 2) of the self-holding relay circuit 6 is cut off. Reference numeral 14 denotes a serial communication line connecting the first electronic controller 7 for controlling the throttle and the second electronic controller 11 for monitoring the failure. The serial communication line 14 is used for mutual monitoring between the respective electronic controllers. Use an optical communication cable so that it is not affected.

FIG. 3 is a diagram showing a control operation performed by the microcomputer 8 in the first electronic controller 7 for each part. The routine shown in FIG. 3 is executed at a constant cycle (for example, 10 msec). In P1, a system diagnosis including a sensor, an actuator, an input circuit, and a drive circuit is performed based on an input signal, an output monitor signal of the drive circuit, and the like, and the presence or absence of a failure is confirmed. Further, it is checked whether the received data of the serial communication conforms to a predetermined protocol, and it is determined whether or not the second electronic controller 11 has a failure. In P2, P
Based on the result of 1, if there is no failure, proceed to P4, and if there is a failure, proceed to P3. In P3, the values of CLUTCH for instructing ON / OFF of the electromagnetic clutch drive current, DUTY and DIR for instructing the drive current and rotation direction of the motor are initialized to zero. FAIL1 for instructing ON / OFF of energization to the electromagnetic relay (No. 1) of the self-holding relay circuit.
Is initialized (cleared) to zero. Proceed to P9. In P4, FAIL1 for instructing on (off) of energization to the electromagnetic relay (No. 1) of the self-holding relay circuit is set to 1 (set). In P5 to P6, the accelerator opening ACC is read by the accelerator sensor 3 and the throttle opening TVO is read by the throttle sensor 4, and the microcomputer 8 calculates based on these values. In P7, the accelerator opening ACC is determined based on the accelerator opening-throttle opening correspondence characteristic diagram as shown in FIG. 5 which is predetermined in consideration of the characteristics of the engine and the vehicle.
From the target throttle opening TVOR. Proceed to P8. In P8, using a known control method such as PID control, a duty ratio DUTY indicating a motor drive current and a DIR indicating a motor rotation direction are calculated based on the throttle opening deviation. At P9, the above-mentioned DUTY, DIR, CLUTC is stored in a predetermined I / O register of the microcomputer 8.
H, writing FAIL1, PWM (pulse width modulation) signal, motor rotation direction instruction signal, electromagnetic clutch control signal,
Outputs self-holding relay circuit control signals, etc.

FIG. 4 shows a control operation performed by the microcomputer 12 of the second electronic controller 11, and the routine shown in FIG. 4 is executed at regular intervals (for example, 10 msec). P1
Then, the first electronic controller 7 checks whether the received data of the serial communication conforms to a predetermined protocol.
The presence or absence of a failure is determined. In P2, based on the result of P1, if there is no failure, the process proceeds to P4, and if there is a failure, the process proceeds to P3. At P3, the FAI for instructing (on) or off the energization of the electromagnetic relay (No. 2) of the self-holding relay circuit 6
Initialize (clear) L2 to zero. Proceed to P5. P4
Then, the electromagnetic relay of the self-holding relay circuit 6 (No. 2)
FAIL2 for instructing ON (OFF) of the power supply to is set to 1 (set). Proceed to P5. At P5, the above FAIL2 is written into a predetermined I / O register of the microcomputer 12, and
The control signal of the self-holding relay circuit 6 is output.

The operation and effect of the first embodiment will be described.
Even when the first electronic controller 7 and the second electronic controller 11 are affected by strong electromagnetic waves, these two electronic controllers are shielded in separate cases, respectively.
When the cases are installed at different parts in the vehicle, the first electronic controller 7 and the second electronic controller 11 cannot malfunction at the same time completely. Therefore, in the case of using this embodiment, if the first electronic controller 7 malfunctions first, the second electronic controller 11 detects an abnormality and turns off the electromagnetic relay (No. 2) of the self-holding circuit. . As a result, the electromagnetic relay (No. 3) is cut off, and the cut-off state of the power supply is completely maintained until the driver turns on the start switch again. In other words, after this (after the first electronic controller 7 malfunctions), even if the second electronic controller 11 enters a double failure state in which the second electronic controller 11 malfunctions, the electronic control system is in the cutoff state and the safety is ensured. Conversely, the same applies when the second electronic controller 11 malfunctions first.

FIG. 6 is a diagram for explaining the operation according to the embodiment of the present invention and the operation according to the conventional example in comparison with the passage of time. In the conventional example, when both system controllers become abnormal. Means that the power is eventually on,
In this embodiment, the power is turned off after one of the two controllers becomes abnormal, that is, fail-safe. Next, the fact that the first and second electronic controllers do not malfunction at the same time will be described with reference to FIG. When a vehicle enters a strong electromagnetic field due to an illegal radio wave from a fixed station at 180 km / h, the electromagnetic field intensity around the vehicle gradually increases from the front. Therefore, when each electronic controller is installed as shown in FIG. There is a time difference of 60 ms or more from when the electromagnetic field intensity E1 at which the second electronic controller installed near the foot of the seat malfunctions reaches the electromagnetic field intensity E1 at which the first electronic controller installed in the rear trunk room malfunctions. can get. (A difference in the shielding effect between the vehicle bodies is neglected.) Therefore, if a mechanical relay that operates within this time difference is used, the power supply can be reliably maintained in the cutoff state.

Second Embodiment Both the first and second electronic controllers are installed near the feet of the driver's seat in the vehicle. Further, the first electronic controller (for throttle control) is housed and shielded in a metal case, and the second electronic controller (for monitoring) is housed in a simple case having no shielding effect. (It is also possible to use a controller having a low degree of risk that does not affect the vehicle running even if it breaks down, such as a controller for an air conditioner, for example, as the second electronic controller.) Strong electromagnetic field due to illegal radio waves from a fixed station Even when a vehicle enters the vehicle or an object that emits illegal radio waves approaches the vehicle, the electromagnetic field intensity E1 at which the second electronic controller malfunctions is reached before the first electronic controller housed in the metal case malfunctions. It is generally considered that there is a time lag before the field strength E2 is reached. FIG.
(B) shows a temporal change of the electromagnetic field intensity near the electronic controller in the second embodiment. (The difference in the shielding effect between the vehicle bodies is ignored.) Therefore, if this time difference is equal to or longer than the minimum time required to operate the mechanical relay, the second embodiment is the same as the first embodiment. Effects can be obtained.

Third Embodiment As shown in FIG. 7, the second electronic controller is installed near the foot of the driver's seat in the vehicle compartment, and the first electronic controller is installed in the rear trunk room.
(It can be installed more than 3 m apart.) Further, the first electronic controller (for throttle control) is housed in a metal case and shielded, and the second electronic controller (for monitoring)
Is housed in a simple case with no shielding effect. (A low-risk controller that does not affect the vehicle running even if it breaks down can be used as the second electronic controller as in the second embodiment.) 180km / h from front with vehicle in magnetic field
In this case, the electromagnetic field intensity around the vehicle gradually increases, so that the first electronic controller stored in the metal case malfunctions after reaching the electromagnetic field intensity E1 at which the second electronic controller stored in the simple case malfunctions. In general, a time difference of 60 ms or more is obtained until the electromagnetic field intensity E2 reaches the maximum value. (The difference in the shielding effect due to the vehicle body is ignored.) Therefore, if a mechanical relay that operates within this time difference is used, the effect more than that of the first embodiment can be obtained.

Fourth Embodiment: When the present invention is applied to an electronically controlled diesel engine for completely electronically controlling combustion injection, an electronically controlled steering device, and an electronically controlled antilock brake device, the first, second, and third embodiments are also applicable. This is almost the same as the example, except that the actuator drive circuit is replaced. When applied to an electric vehicle, a start switch for starting the engine needs to be specially provided for a fail-safe purpose.

[0018]

As described above, according to the present invention, a plurality of monitoring circuits for diagnosing a failure of an actuator drive circuit and a failure diagnosis between monitoring circuits, and a start circuit between a power supply and an actuator drive circuit are provided. The conduction state is maintained only after the switch is turned on, and when the system failure is detected and shut down by the monitoring circuit, a self-holding relay that holds the interruption state until the start switch is turned on again is provided, so that the configuration is provided. Even if a low-cost simple shielding case is used for each monitoring circuit, any one of the monitoring circuits will detect an abnormality unless a strong electromagnetic field of illegal radio waves is received from outside the vehicle and all the monitoring circuits fail at the same time. Since the self-holding circuit is shut off, the electronic control system is shut off from the power supply until the start switch is turned on by the driver. Chueta does not operate, it is fail-safe.

[Brief description of the drawings]

FIG. 1 shows a first embodiment in which a first electromagnetic clutch of a non-energized type is arranged between an accelerator pedal and a throttle valve, and a second electromagnetic clutch of a non-energized open type is arranged between a throttle valve and a driving DC motor. FIG. 3 is a diagram illustrating an example electronic throttle actuator.

FIG. 2 is a system configuration diagram of a first embodiment.

FIG. 3 is a diagram showing a control operation performed by a microcomputer in a first electronic controller of the first embodiment for each part.

FIG. 4 is a diagram showing a control operation performed by a microcomputer of the second electronic controller of the first embodiment.

FIG. 5 is a diagram showing an example of an accelerator opening-throttle opening correspondence characteristic;

FIG. 6 is a diagram for explaining the operation of the electronic control system in a case according to the present invention and in a case according to a conventional example in comparison with time.

FIG. 7 is a diagram illustrating an example of an arrangement location of first and second electronic controllers.

8A is a diagram of the first embodiment, FIG. 8B is a diagram of the second embodiment, and FIG. 8C is a diagram of the time of electromagnetic field intensity around each electronic controller in the third embodiment. It is a figure showing a target change.

[Explanation of symbols]

DESCRIPTION OF SYMBOLS 1 ... Throttle valve 2 ... Electronic throttle valve actuator 3 ... Accelerator sensor 4 ... Throttle sensor 5 ... Start switch 6 ... Self-holding relay circuit 7 ... 1st electronic controller 8 ... Microcomputer 9 ... DC motor drive circuit 10 ... Electromagnetic clutch drive circuit 11 ... second electronic controller 12 ... microcomputer 13 ... relay drive circuit 14 ... serial communication line

Continuation of the front page (58) Field surveyed (Int. Cl. ⁷ , DB name) G05B 9/02 B60T 8/96 F02D 41/22 310 F02D 45/00 372

Claims (7)

(57) [Claims] A first system monitor provided separately from the second system monitoring means for monitoring a power supply means for supplying a voltage, an actuator driving means and a second system monitoring means and detecting a failure thereof; Means, and second system monitoring means for monitoring the actuator driving means and the first system monitoring means and detecting a failure thereof , and the first system monitoring means and the second system monitoring means.
Stem monitoring means is installed at a place separated from each other in the vehicle
Or use one of the monitoring means more effectively than the other.
At least one of
And a trigger switch means for outputting a trigger signal by a driver's operation, and a conductive state only by the trigger switch means,
A self-holding relay unit that is turned off by a failure detection signal from the first or second system monitoring unit and then holds the shutoff state until a trigger signal is input; and a power supply supplied by the self-holding relay unit. An actuator driving means for driving the electronic control unit, and a fail-safe device of the vehicle-mounted electronic control system. 2. The fail-safe device according to claim 1, wherein a start switch for starting the engine is used as said trigger switch means. 3. The on-vehicle electronic control system according to claim 1, wherein the means for electronically controlling the throttle valve opening of the internal combustion engine is the actuator driving means. 4. A fail-safe device for an on-vehicle electronic control system according to claim 1, wherein the means for electronically controlling the fuel injection amount of the diesel engine is the actuator driving means. 5. The on-vehicle electronic control system according to claim 1, wherein the means for electronically controlling the steering angle of the rear wheel or the front wheel is the actuator driving means. 6. A fail-safe device for an on-vehicle electronic control system according to claim 1, wherein the means for electronically controlling the brake is the actuator driving means. 7. An electric motor as a drive source of an electric vehicle,
2. The fail-safe device for an in-vehicle electronic control system according to claim 1, wherein said actuator drive means is used.