JPH0752785A - Fail-safe device of on-vehicle electronic control system and diagnosing method for the system - Google Patents

Abstract

PURPOSE:To prevent any misjudgement at a fail check each component at the time of operation of a forced outage circuit. CONSTITUTION:In order to monitor the operation condition of a forced outage circuit 30, an output side of this circuit 30 is connected to a forced outage circuit monitor 37 in a central processing unit 22 via a forced outage monitoring signal input terminal PB. This monitor 37 feeds a diagnoser 33 with a fail check prohibiting signal so as to make this diagnosing device 33 not perform a fail check whenever the forced outage circuit 30 is operating. With this fail check prohibiting signal, the diagnoser 33 will not check each component and a safety relay 28. Accordingly, any possible misjudgement of this fail check at the time of operation of the forced outage circuit 30 is thus prevented from occurring.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an anti-skid brake control (hereinafter also referred to as ABS) system for preventing wheel lock during braking, and a traction control (hereinafter referred to as TRC control) for preventing idling of drive wheels when the vehicle starts. (Also referred to as) electronic control system mounted on a vehicle, and in particular, a fail-safe device that stops the operation of the electronic control system when a failure of each component such as an electromagnetic valve and a motor that constitutes the electronic control system is detected. And a method for diagnosing a vehicle-mounted electronic control system for diagnosing each component of the electronic control system.

[0002]

2. Description of the Related Art An automobile is equipped with various electronic control systems such as an ABS control system and a TRC control system, and the electronic control unit controls the operation of each component of the electronic control system to control the vehicle. The operation control is optimized.

As such an in-vehicle electronic control system, conventionally, for example, an ABS system and a T system as shown in FIG.
ABS / TRC integrated with RC system
There is a system.

As shown in FIG. 3, this ABS / TRC system adjusts the brake pressure of the wheel speed sensors 3 and 4 and the front wheels 1 and 2 for detecting the wheel speeds of the left and right front wheels 1 and 2 which are non-driving wheels. A modulator 5, a brake actuator 6 that generates a braking force on the front wheels 1 and 2, wheel speed sensors 9 and 10 that detect the wheel speeds of the left and right rear wheels 7 and 8 that are driving wheels,
Modulators 11 and 12 that adjust the brake pressures of the rear wheels 7 and 8, brake actuators 13 and 14 that generate braking force to the rear wheels 7 and 8, and a brake pedal 1, respectively.
Dual brake valve 1 controlled by 5
6. Open the air tank 1 during traction control
Compressed air in 7 is applied to modulator 1 of left and right rear wheels 7, 8.
Traction solenoid valve (hereinafter also referred to as TRC valve) 18,1 which is composed of solenoid valves for feeding to 1, 12 respectively
9. Motor 21, which is a governor actuator that operates a governor link that changes and sets the lower limit of the rotation speed of engine 20, modulators 5, 11, 12 and TRC valves 1
ABS / TRC control unit (hereinafter also referred to as ABS / TRC ECU) which is a central processing unit (hereinafter also referred to as CPU) for controlling the motors 8 and 19 and the motor 21.
22 is provided.

In the figure, reference numeral 23 is an accelerator pedal, and in this example, the ABS / TRC ECU 22 is electrically connected with a potentiometer or the like for detecting the accelerator position. 35 is an exhaust brake cut relay,
27 is a power source, 28 is a safety relay, and 36 is a brake pressure switch. In this ABS / TRC system, the driver has an exhaust brake switch (not shown).
When the engine pedal is operated and the accelerator pedal 23 is released, the engine brake operates.
This engine brake is cut by the exhaust brake cut relay 35 so as not to operate in ABS. In addition, the safety relay 28
When the BS / TRC system is abnormal, modulators 5, 11,
The power to the components such as 12, the TRC valves 18, 19 and the motor 21 is cut off to prevent the components from malfunctioning. Further, the brake pressure switch 36 is turned on when the brake pedal 15 is depressed and the brake pressure is supplied to the modulator 5, and detects the brake-on state.

In the ABS / TRC system thus constructed, the wheel speed signals from the wheel speed sensors 3, 4, 9 and 10 are sent to the ABS / TRC ECU 22. During braking, the ABS / TRC ECU 22 calculates based on these wheel speed signals, and if it is determined that the wheels tend to lock based on the calculation results, the ABS / TRC
The RC ECU 22 outputs a control signal to the modulators 5, 11, 12 corresponding to the wheels that tend to lock. As a result, the modulators 5, 11, 12 adjust the brake pressures of the brake actuators 6, 13, 14 so as to eliminate the lock tendency of the wheels. Thus, A
The BS / TRC ECU 22 performs anti-skid brake control so that the wheel lock tendency is eliminated when the wheel lock tendency tends to occur during braking.

Further, when the propulsive force of the vehicle is increasing at the time of starting the vehicle or during sudden acceleration, the ABS / TRC ECU 22 calculates based on the wheel speed signals from the wheel speed sensors 3, 4, 9 and 10, and If it is determined from the calculation result that the rear wheels 7 and 8 that are the drive wheels tend to idle, this ABS / TRC ECU
The motor 22 outputs a control signal to the modulators 11 and 12 and the TRC valves 18 and 19 corresponding to the rear wheels 7 and 8 that tend to idle, and the motor 2 that operates the governor link.
The control signal is output to 1.

A control signal from the ABS / TRC ECU 22 turns on and opens the TRC valves 18 and 19, and compressed air from the air tank 17 is transferred to the TRC valves 18 and 19.
Double check valves 24 and 25 and modulator 1
It is supplied to the brake actuators 13 and 14 through 1 and 12, and the rear wheels 7 and 8 that tend to idle are braked. By the braking of the rear wheels 7 and 8, the rotational driving force of the rear wheels 7 and 8 is suppressed so that the idling tendency of the rear wheels 7 and 8 which tends to idle is eliminated. In this way, the ABS / TRC ECU22
The traction control is performed so that the idling tendency of the drive wheels is eliminated when the driving wheels tend to idling.

By the way, in such an ABS / TRC system, for example, the modulators 5, 11, 12,
Wheel speed sensors 3, 4, 9, 10 and TRC valves 18, 19
Or ABS / TR such as ABS / TRC ECU22
ABS when each component of the C system fails
Alternatively, the TRC may be erroneously controlled. In order to prevent such erroneous control of ABS or TRC, a safety circuit is conventionally provided.
An example of this safety circuit is a safety circuit as shown in FIG.

In FIG. 4, 27 is a battery as a power source, 28 is a safety relay, 29 is a drive circuit driven by the safety relay 28, 30 is a forced stop circuit, 31 is a reset monitoring circuit, 32 is a voltage drop circuit, and the CPU 22 is a CPU. _Res is the safety relay 2 by the reset monitoring circuit 31.
The reset terminal to which the OFF signal of 8 is input,
The PA is a safety relay drive signal output terminal that outputs a drive signal for the safety relay 28 by the safety relay control device 34, the PC of the CPU 22 is connected to the diagnostic device 33 in the CPU 22, and the disconnection and short circuit of the coil of the safety relay 28 are checked. A check signal input terminal for inputting a signal. The diagnostic device 33 in the CPU 22 is
Modulators 5, 11, 12, TRC valves 18, 19,
A check signal is also output to the motor 21 and the exhaust cut relay 35.

The safety relay 28 includes a battery 27, modulators 5, 11, 12 and wheel speed sensors 3, 4, 9 ,.
10, TRC valves 18, 19 and ABS / TRC E
The connection and disconnection with each component of the ABS / TRC system such as the CU 22 is conducted and cut off, and the safety relay 28 is controlled as follows.

When the ABS / TRC ECU 22 detects a failure of each component of the ABS system and determines that the ABS of all brake channels needs to be stopped due to this failure, the ABS / TRC ECU 22
The OFF signal of the safety relay 28 is output from the PA terminal of the CU 22 to the drive circuit 29, and the drive circuit 29 turns off the safety relay 28. This ensures that all ABS
Is stopped.

Further, the reset monitoring circuit 31 monitors the power source and the ABS / TRC ECU 22, and as a result of this monitoring, the reset monitoring circuit 31 supplies the power source and the ABS / T.
By turning off the safety relay 28 according to the state of the RC ECU 22, the following three resets are performed. The first reset is a power-on reset, and when the power is turned on, the safety relay 28 is turned off for a certain period of time until the power supply voltage of the ABS / TRC ECU 22 stabilizes. Two
The third reset is a low voltage reset and ABS / TR
When the power supply voltage of the ECU 22 drops, the safety relay 28 is turned off. The third reset is a watchdog timer reset, which turns off the safety relay 28 when the pulse signal from the ABS / TRC ECU 22 to the reset monitoring circuit 31 is interrupted, that is, when the ABS / TRC ECU 22 is abnormal and stopped.

Further, the forced stop circuit 30 monitors the turning off of the safety relay 28 by the reset monitoring circuit 31, and the reset monitoring circuit 31 causes the safety relay 28 to turn off.
Is turned off more than a predetermined number of times within a certain time,
The forced stop circuit 30 holds the safety relay 28 in the off state. As a result, if a repetitive reset occurs due to a power supply voltage fluctuation such as cranking or a runaway of the ABS / TRC ECU 22, the safety relay 28 will repeatedly turn on and off unnecessarily, so that the safety relay 28 remains in the off state. By holding it, the safety relay 28 is prevented from being repeatedly turned on and off.

On the other hand, in order to detect the failure of each component of the ABS system, the ABS / TRCE has been conventionally used.
The CU 22 checks each component for fail. As shown in FIG. 5, the fail check process is performed by the safety relay 28 in step ST1.
Is determined to be off. To determine whether the safety relay 28 is off, the ABS / TRC ECU 22 P
Judging from the voltage state of the A terminal, the safety relay 28 is off when the voltage of the PA terminal is high, and the safety relay 28 is on when the voltage of the PA terminal is low.

When it is determined that the safety relay 28 is on, the modulator 5,
Check 11 and 12, TRC in step ST3
After the valves 18 and 19 are checked, the exhaust brake cut relay 35 is checked in step ST4, and the safety relay 28 is checked in step ST5, the fail check process ends. If it is determined in step ST1 that the safety relay 28 is not on, the process proceeds to step ST5, the safety relay 28 is checked, and the fail check process ends.

This fail check is designed to be carried out at regular intervals and at regular intervals.
It is designed to be executed when there is no safety relay off signal from the PA terminal of U22.

[0018]

However, in such a control method and a fail check method of the safety relay 28, when the forced stop circuit 30 is operating and the safety relay 28 is off, the ABS /
Since the voltage of the PA terminal of the TRC ECU 22 is low, the safety relay 28 is erroneously determined and a fail check is performed, and each component is erroneously determined to be failed.

The present invention has been made in view of the above circumstances, and an object thereof is to stop a fail check when the forced stop circuit is activated and the safety relay is held off. It is an object of the present invention to provide a fail-safe device for a vehicle-mounted electronic control system that can prevent erroneous determination of a component fail check and a diagnostic method for this system.

[0020]

In order to solve the above-mentioned problems, the invention of claim 1 provides a predetermined number of components of an electronic control system mounted on a vehicle, a power supply connected to these components, A central processing unit that controls each of the components, a safety relay that connects and disconnects each of the components and the power source, and a safety that is provided in the central processing unit and that controls ON / OFF of the safety relay. A safety relay off signal is provided to the safety relay control device when a failure check of the components and the safety relay is performed and the failure of the components and the safety relay is detected, provided in the relay control device and the central processing unit. Diagnostic device for outputting the power, the power source and the central unit A reset monitoring circuit that monitors the processing device and turns off the safety relay at a predetermined time, and a forced stop that keeps the safety relay off when the safety relay is turned off a predetermined number of times within a certain time by the reset monitoring circuit. A circuit and a check stop signal that is provided in the central processing unit and that stops the fail check of the diagnostic device when it detects that the forced stop circuit is operating by monitoring the operating condition of the forced stop circuit. And a forced stop circuit monitoring device for outputting to the diagnostic device.

The invention according to claim 2 is characterized in that the electronic control system is at least one of an anti-skid brake control system and a traction control system.

Further, the invention of claim 3 is based on the diagnostic circuit.
A fail check of a predetermined number of components of an electronic control system mounted on a vehicle and a safety relay for connecting / disconnecting each of the components and a power source is performed, and a reset monitoring circuit is used to reset the power source and each component and the safety. When the safety relay is turned off at a predetermined time by monitoring the central processing unit controlling the relay and the safety relay is turned off a predetermined number of times within a certain time by the reset monitoring circuit, the safety relay is turned on by the forced stop circuit. Is kept off, and when it is detected that the forced stop circuit is operating, the fail check of the diagnostic device is stopped.

[0023]

In the fail-safe device for an on-vehicle electronic control system and the method for diagnosing this system of the present invention thus constructed, when the safety relay is held off by the operation of the forced stop circuit. Is
The diagnostic device is not checked for fail. As a result, even if the forced stop circuit is activated due to fluctuations in the power supply voltage such as cranking or runaway of the electronic control unit, erroneous determination of the fail check can be prevented.

[0024]

Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a circuit diagram showing an embodiment of a fail-safe device for an on-vehicle electronic control system according to the present invention.
The ABS / TRC system to which this embodiment is applied is the same as the above-mentioned conventional ABS / TRC system, and the fail-safe device of this ABS / TRC system is also the same as the circuit of the above-mentioned conventional fail-safe device. Therefore, the present embodiment will be described by using the same reference numerals as those of the conventional ABS / TRC system and the fail-safe device.

As shown in FIG. 1, in this embodiment, in order to monitor the operating condition of the forced stop circuit 30, the output side of the forced stop circuit 30 is connected to the CPU 22 via the forced stop circuit monitor signal input terminal PB of the CPU 22. It is connected to the forced stop circuit monitoring device 37 inside. This forced stop circuit device 3
7 sends a fail check prohibition signal to the diagnostic device 33 so that the diagnostic device 33 does not perform the fail check when the forced stop circuit 30 is operating.

Next, the operation of the present embodiment having such a configuration will be described using the flow of the fail check process shown in FIG. It should be noted that the same steps as those in the flow of the conventional fail check processing shown in FIG.

As shown in FIG. 2, in this embodiment, first, in step ST6, the forced stop circuit 3 is entered before the safety relay OFF judgment process in step ST1.
It is determined whether 0 is active. Forced stop circuit 3
If it is determined that 0 is not operating, the same fail check process as the conventional fail check process, that is, each process of steps ST1 to ST5 is performed.
If it is determined in step ST6 that the forced stop circuit 30 is operating, the process returns to the start without performing the fail check processes of ST1 to ST5.

As described above, in the present embodiment, when the forced stop circuit 30 is operating, the components and the safety relay 28 are not checked, so that the forced stop circuit 30 operates due to cranking or the like. Therefore, even if the safety relay 28 is turned off, the diagnostic device 33 does not erroneously determine that each component is abnormal.

In the above-mentioned embodiment, the case where the ABS system and the TRC system are incorporated together is explained, but the present invention is provided independently.
It can also be applied to BS and TRC systems. Also,
As long as the safety relay 28 is turned off by the operation of the forced stop circuit 30 due to cranking or the like, the present invention can be applied to other electronic control systems mounted on vehicles other than the ABS system and the TRC system. Can be applied.

[0030]

As is apparent from the above description, according to the fail-safe device for an on-vehicle electronic control system and the method for diagnosing this system according to the present invention, each component is operated when the forced stop circuit is operating. Since the safety relay is not checked, even if the safety relay is turned off due to the operation of the forced stop circuit due to cranking or the like, it is possible to reliably prevent erroneous judgment by the fail check.

[Brief description of drawings]

FIG. 1 is a circuit diagram showing an embodiment of a fail-safe device for an in-vehicle electronic control system according to the present invention.

FIG. 2 is a diagram showing a flow of a fail check process in this embodiment.

FIG. 3 is a diagram showing an example of a conventional ABS / TRC system.

FIG. 4 is a diagram showing a conventional fail-safe device.

FIG. 5 is a diagram showing an example of a flow of a conventional fail check process.

[Explanation of symbols]

1, 2 ... Left and right front wheels (non-driving wheels), 3, 4.9, 10 ... Wheel speed sensor, 5, 11, 12 ... Modulator for anti-skid control, 6, 13, 14 ... Brake actuator,
7, 8 ... Left and right rear wheels (driving wheels), 15 ... Brake pedal, 16 ... Dual brake valve, 17 ... Air tank, 18, 19 ... Traction electromagnetic valve (TRC valve), 20 ... Engine, 21 ... Motor, 22 ... ABS /
TRC control unit (ABS / TRC EC
U), 23 ... Accelerator pedal, 24, 25 ... Double check valve, 27 ... Battery, 28 ... Safety relay, 29 ... Drive circuit, 30 ... Forced stop circuit, 31 ... Reset monitoring circuit, 32 ... Voltage drop circuit, 33 ... Diagnostic device,
34 ... Safety relay control device, 35 ... Exhaust brake cut relay, 36 ... Brake pressure switch,
37 ... Forced stop circuit monitoring device

Claims (3)

[Claims] 1. A predetermined number of components of an electronic control system mounted on a vehicle, a power supply connected to these components, a central processing unit that controls each of the components, and between the components and the power supply. A safety relay for connecting and disconnecting the safety relay, a safety relay control device provided in the central processing unit for controlling on / off of the safety relay, and a safety relay control unit provided in the central processing unit for each component and the safety. A diagnostic device that outputs a safety relay OFF signal to the safety relay control device when a failure check of the relay and a failure of the component and the safety relay is detected, and the power supply and the central processing unit are monitored and at a predetermined time. Reset to turn off the safety relay A monitoring circuit, a forced stop circuit for holding the safety relay off when the safety relay is turned off a predetermined number of times within a fixed time by the reset monitoring circuit, and provided in the central processing unit,
A forced stop circuit monitoring device that outputs a check stop signal to the diagnostic device to stop the fail check of the diagnostic device when it detects that the forced stop circuit is operating by monitoring the operating condition of the forced stop circuit; A fail-safe device for a vehicle-mounted electronic control system. 2. The fail-safe device for an on-vehicle electronic control system according to claim 1, wherein the electronic control system is at least one of an anti-skid brake control system and a traction control system. 3. A diagnostic circuit performs a fail check of a predetermined number of components of an electronic control system mounted on a vehicle and a safety relay for connecting and disconnecting each of the components and a power source, and a reset monitoring circuit. A central processing unit that controls the power supply and each component and the safety relay is monitored, and the safety relay is turned off at a predetermined time. The reset monitoring circuit turns off the safety relay a predetermined number of times or more within a predetermined time. When the forced stop circuit holds the safety relay off and it is detected that the forced stop circuit is operating,
A method for diagnosing a vehicle-mounted electronic control system, characterized in that the fail check of the diagnostic device is stopped.