JPH07182003A - Fail-safe device for electronic control - Google Patents

Abstract

PURPOSE:To deal with a fault at the pulse output terminal of a CPU with the small number of parts as well in order to improve reliability and to reduce cost for the fail-safe device for guiding a system to the safe side when the CPU is abnormal. CONSTITUTION:This device is provided with a CPU 5 equipped with a program for fail-safe to output pulses in a prescribed cycle at normal time, pulse voltage charging circuit 10 for keeping an output almost constant by charging that pulse voltage, relay RY for turning on/off power supply to an electromotive actuator 1 as the controlled system of the CPU 5, and relay driving circuit 4 for controlling the relay Rr of a power source corresponding to the output of the pulse voltage charging circuit 10.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an electronically controlled fail-safe device.

[0002]

2. Description of the Related Art For example, in an electric power steering system for a vehicle, a control unit including an electric motor for power assisting an operating force of a steering wheel and a steering angle sensor for detecting a steering angle of the steering wheel and including a microcomputer or the like. The electronically controls the drive of the electric motor based on the detection signal of the rudder angle sensor.However, in case the control program of the control unit runs out of control for some reason, it is necessary to guide the system to the safe side. As a fail-safe device, a device configured as shown in FIG. 5 is known.

[0003] 1 electric motor for power assisting the operation force of the handle, a power on-off circuit 3 which comprises a relay R _Y to the drive circuit 2, the relay drive circuit 4 is provided comprised of the resistor R ₁ and transistor T _R1 . A CPU 5 controls the motor drive circuit 2 according to the steering angle of the steering wheel.
In addition to the control program for the electric motor 1, the CPU 5 stores the fail-safe program.
The watchdog timer 6 monitors the pulse of the CPU 5, and when the stop of the pulse is detected when the CPU is abnormal, C
It outputs a reset pulse to PU5. 7 is a pulse output terminal, 8 is a pulse input terminal, and 9 is a relay drive terminal.

The fail-safe program outputs a pulse of a predetermined cycle from the pulse output terminal 7 to the watchdog timer 6 when the CPU is normal, and at the same time, the relay drive terminal 9
The supplies current I _B to the base of transistor T _RI applying a voltage of 5 volts, with the abnormal CPU is generated to stop the pulses to the watchdog timer 6, the relay driven by the reset pulse of the watchdog timer 6 The terminal voltage is reduced to 0 volt to cut off the base current I _B to the transistor T _R1 .

Therefore, when the control unit 5 stops the base current I _B to the transistor T _{R1 by} the reset pulse of the watchdog timer 6, the relay current I _{R Y}
The power to the motor drive circuit 2 is cut off by turning off the
Even if the control program runs out of control, the motor 1 does not operate, and the steering of the vehicle can be safely continued by manual steering. FIG. 6 shows the relay drive voltage V _OUT and the base current I _B.
FIG. 6 is an operating characteristic diagram showing a relationship between the relay current I _RY and the relay current I _RY .

As a watchdog timer, its circuit configuration is disclosed in Japanese Utility Model Laid-Open No. 1-100239.

[0007]

By the way, in such a conventional example, when the pulse input terminal 8 or the relay drive terminal 9 fails, the base current I _B of the transistor T _R1 may continue to flow and the motor 1 There was a problem that the system could not be guided to the safe side because the power of could not be cut off. In addition, since many parts including the watchdog timer 6 are required, not only the cost rises but also the fail-safe itself is liable to cause the device failure, and there is a problem that high reliability cannot be expected so much. . Although there is an example in which the fail-safe device is integrated into an IC, the IC itself is expensive and it is difficult to adopt it in terms of cost.

The present invention has been made in view of the above problems, and an object thereof is to provide a fail-safe device having a low cost and a high reliability.

[0009]

Therefore, a CPU having a fail-safe program that outputs a pulse of a predetermined cycle in a normal state, a pulse voltage charging circuit that charges the pulse voltage to keep the output substantially constant, and a CPU And a relay drive circuit for controlling the relay of the power supply according to the output of the pulse voltage charging circuit.

[0010]

In normal operation, the CPU outputs a pulse of a predetermined cycle, so the output of the pulse voltage charging circuit is kept almost constant, and the relay drive circuit continues to operate. Maintained at. Therefore, the electric actuator operates normally under the control of the CPU.

When an abnormality or a failure occurs in the control program or the pulse output terminal of the CPU, the CPU does not output a pulse having a predetermined cycle and the pulse remains off or the pulse cycle becomes very long. Does not charge the pulse voltage charging circuit even if the pulse continues to be on for a long time, and its output drops, so the relay drive circuit turns off the relay of the power supply, ensuring the power supply of the power supply actuator to the safe side of the system. Can be shut off.

[0012]

FIG. 1 shows an example of application to an electric power steering system of a vehicle. Reference numeral 1 is an electric motor for power assisting steering wheel operation force. A CPU 5 controls a drive circuit 2 thereof, and steering wheel steering is performed. In addition to the control program for instructing the drive of the electric motor 1 according to the angle, the fail-safe program for the abnormality is stored. The fail-safe program outputs a pulse of a predetermined cycle when the CPU 5 is normal, and stops outputting the pulse when an abnormality occurs in the motor control program.

The motor drive circuit 2 is provided with a power source on / off circuit 3 having a relay R _Y and a relay drive circuit 4 composed of a transistor T _RI and a resistor R ₁ . The pulse voltage charging circuit 10 controls ON / OFF of the transistor T _R1 of the relay driving circuit 4, and is connected so that the voltage of the pulse output terminal 7 of the CPU 5 becomes the input voltage of the relay driving circuit 4. The pulse voltage charging circuit 10 charges the pulse voltage of the CPU 5 and outputs normally (relay drive voltage V
(Corresponding to _OUT ) is kept substantially constant, and is composed of capacitors C ₁ and C ₂ , diodes D ₁ and D ₂ and a resistor R ₂ .

2 to 4 are operating characteristic diagrams showing the relation between the pulse voltage _V'OUT , the diode voltage V _D1 and the capacitor voltage V _C2 , and the base current I _B and the relay current I _RY . In this case, the pulse output terminal 7 of
When the voltage changes from 5 V to 5 V, the current flows from the resistor R ₂ → the capacitor C ₁ → the diode D ₂ → the resistor R ₁ and the transistor T _R1 receives the base current I _B and turns on. At that time, a current also flows into the capacitor C ₂ , so that the capacitor C ₂ is charged and its voltage Vc ₂ rises.

After the elapse of a predetermined time, the pulse output terminal 7 becomes 5
When the voltage changes from 0 volt to 0 volt, the current I _D1 flows through the diode D ₁ → the capacitor C ₁ → the resistor R ₂ , so that the capacitor C ₁ is discharged at once and prepares for the next pulse output.
At the same time, the capacitor C ₂ is discharged toward the resistor R ₁ and the base current I _B continues to flow, so that the transistor T _R1 is held in the ON state.

Thus, the voltage V'of the pulse output terminal 7 is
_OUT is by repeating the change of the predetermined period, the flow continues the base current I _B to the transistor T _R1, power on-off circuit 3 of the electric motor 1 is to be maintained in the ON state by operation of the relay R _Y, the CPU5 The normal power steering function of the electric motor 1 based on the control program is exhibited.

When an abnormality occurs in the control program, the CPU 5 stops pulse output as shown in FIG. 2. During that time, the resistance R ₂ → capacitor C ₁ is the same as when a failure occurs in which the pulse output terminal is fixed at 0 volt. → diode D ₂ → current does not flow to the resistor R ₁ , the capacitor C ₁ is neither charged nor discharged, and the base current I _B to the transistor T _R1 is cut off, so the relay R _Y turns off and the electric motor The power supply to 1 is cut off. Therefore, thereafter, the vehicle can be safely steered by the manual steering.

When a failure occurs in the pulse output terminal 7 of the CPU 5 and the disconnection or the pulse voltage is fixed at 0 volt as shown in FIG. 3, the relay R _Y is turned off in the same manner as above.
Further, as shown in FIG. 4, the pulse voltage may be fixed at 5 volts, but when the charging capacity of the capacitor C ₁ becomes full, the current is cut off by the capacitor C ₁ and the diode D ₁ → capacitor becomes the pulse voltage. Since the current I _D1 to C ₁ → resistor R ₂ is dammed, the capacitor C ₁ is not discharged, and the diode voltage V _D1 gradually decreases. Therefore, when the discharge of the capacitor C ₂ is completed, the base current to the transistor TR ₁ is reduced. Is turned off, the relay R _Y is turned off. That is, even when the pulse output terminal 7 has a failure, the power supply on / off circuit 3 of the electric motor 1 can be reliably shut off to the safe side as in the case of the abnormality of the control program.

Structurally, the number of parts is reduced by omitting the watchdog timer, so that cost reduction and reliability improvement can be realized. Further, since the pulse output terminal 7 of the CPU 5 is used in the same manner as the relay drive terminal 9 of the prior art, the reset pulse input terminal 8 and the relay drive terminal 9 of the prior art are used.
It is not necessary to be prepared for the failure of 1), and even if there is a failure or disconnection of the pulse output terminal 7, a good fail-safe function can be easily ensured.

[0020]

In summary, according to the present invention, a CPU having a fail-safe program that outputs a pulse of a predetermined cycle in a normal state, and a pulse voltage charging circuit that charges the pulse voltage to keep the output substantially constant are provided. , A relay drive circuit for controlling the relay of the power supply according to the output of the pulse voltage charging circuit is provided.
Even if a failure occurs in the pulse output terminal of the PU, the system can be guided to the safe side. In addition to not requiring a watchdog timer and reducing the number of parts, the pulse output terminal of the CPU is used as a relay drive terminal, so a highly reliable fail-safe function can be easily realized at low cost. To be

[Brief description of drawings]

FIG. 1 is a configuration diagram showing an embodiment of the present invention.

FIG. 2 is an operating characteristic diagram of a pulse voltage charging circuit and a relay drive circuit.

FIG. 3 is an operation characteristic diagram of a pulse voltage charging circuit and a relay drive circuit.

FIG. 4 is an operation characteristic diagram of a pulse voltage charging circuit and a relay drive circuit.

FIG. 5 is a configuration diagram illustrating a conventional example.

FIG. 6 is an operation characteristic diagram of a relay drive circuit.

[Explanation of symbols]

1 electric motor for power steering 2 motor drive circuit 3 power supply on / off circuit 4 relay drive circuit 5 CPU 7 pulse output terminal 10 pulse voltage charging circuit _RY relay T _R1 transistor R ₁ , R ₂ resistance C ₁ , C ₂ capacitor D ₁ , D ₂ diode

Claims (1)

[Claims] 1. A CPU having a fail-safe program that outputs a pulse of a predetermined cycle during normal operation, a pulse voltage charging circuit that charges the pulse voltage to keep the output substantially constant, and an electric motor as a control target of the CPU. An electronically controlled fail-safe device comprising: a relay that turns on and off a power supply to an actuator; and a relay drive circuit that controls a relay of the power supply according to an output of a pulse voltage charging circuit.