JPH08147001A - Fail-safe device - Google Patents

Abstract

PURPOSE: To provide the fail-safe mechanism for a backup IC. CONSTITUTION: A CPU 7 is provided with a fail-safe monitor terminal 17 and monitor a fail signal 16 from a B/U IC 15. Further, the CPU 7 is provided with a fail mask output terminal 18 and provided with an OR circuit 22 which switches a fail mask signal 19 from a fail mask output terminal 18 and a fail signal 16 from the B/U IC 15 and supplies it to a buffer circuit 10.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a backup IC (Integrated Circuit) (hereinafter referred to as B / B) used in a vehicle control device.
It is referred to as UIC. ) Fail-safe device.

[0002]

2. Description of the Related Art An ECU (Ele
FIG. 11 shows an overall configuration diagram of the ctronic Control Unit) 100. Inside the ECU 100, a central processing unit for calculating an optimum fuel injection amount and ignition timing suitable for operating conditions.
(Central Processing Unit: hereinafter referred to as CPU) 7 is provided, and as an external input to the CPU 7, a starter signal 1, an engine speed signal 2, a battery voltage 3, a water temperature sensor voltage 4, an O ₂ sensor voltage 5, and the like are provided. Is input. Of these input signals, various sensor outputs such as battery voltage 3, water temperature sensor voltage 4, O ₂ sensor voltage 5
It is supplied to the CPU 7 through the A / D conversion circuit 6.

In particular, the O ₂ sensor 8 is for detecting the oxygen concentration in the exhaust gas, and is indispensable for accurately controlling the air-fuel ratio. However, since the O ₂ sensor 8 largely deviates in characteristics at low temperatures, a heater with a built-in heater is used, and the O ₂ sensor 8 can be activated quickly by energizing the O ₂ heater 9 depending on operating conditions. O ₂
The heater 9 is controlled by turning on / off an output driver 11 via a buffer circuit 10 from a signal from the CPU 7. Further, the buffer circuit 10 will be described later in B.
The output is forcibly turned off by the fail signal 16 supplied from the / UIC 15.

In addition, the CPU 7 has an abnormality in the O ₂ heater 9,
For example, it has a program for detecting battery plus terminal short circuit (hereinafter referred to as + B short circuit) and resistance deterioration, and supplies the terminal voltage of the output driver 11 to the O ₂ heater monitor terminal 12 through the abnormality detection circuit 13. By doing so, the abnormality determination is performed by the determination of the O ₂ heater monitor terminal 12, and when the abnormality occurs, the control of the O ₂ heater 9 is prohibited,
Abnormal code is stored in non-volatile memory 21 (EEPROM etc.)
To memorize.

When the operation of the CPU 7 is stopped or runs out of control, there is a possibility of causing abnormal fuel injection, abnormal ignition, and the like. Therefore, the CPU 7 is programmed to output a normal signal (hereinafter referred to as a WDC pulse signal) 14 every predetermined time, and whether or not the WDC pulse signal 14 is supplied to the ECU 100 within a predetermined time is determined. B / to judge
There is a UIC15. When it is determined that the B / UIC 15 is abnormal, the injection amount and the ignition timing of a fixed amount determined by the B / UIC 15 are switched to, and a fail signal 16 is sent to the buffer circuit 10 to turn on the external actuator (here, the O ₂ heater 9). It can be separated and fixed to the safety side (OFF side).

[0006]

However, the CPU
7 outputs the WDC pulse signal 14 normally, but B / due to radio noise or other noise
When the UIC 15 operates even temporarily and the fail signal 16 outputs a signal indicating an abnormality (LOW), even if the CPU 7 outputs an O ₂ heater output terminal 20 signal to turn on the O ₂ heater 9, The O ₂ heater 9 is turned off by the fail signal 16 via the buffer circuit 10. Therefore, in a system having + B short circuit and deterioration detection, O
₂ Signal (HI) to judge that the heater monitor terminal 12 is abnormal
There are input, O ₂ heater 9 despite normal, O ₂
There is a problem that an abnormality of the heater 9 is detected.

Therefore, an object of the present invention is to provide an ECU that functions normally when the B / UIC 15 temporarily operates due to external factors such as noise under the condition that the CPU 7 normally outputs the WDC pulse signal 14. It is to provide a fail-safe mechanism of.

[0008]

In order to solve the above-mentioned problems, the structure of the present invention inputs a control target for stable running of a vehicle and various sensor outputs provided on the vehicle, and responds to the sensor output. An arithmetic processing unit having a function of computing a control signal necessary for a controlled object and outputting a reference signal at every predetermined time; and a storage unit storing the program data and control data required by the arithmetic processing unit. When the reference signal from the arithmetic processing means is within a predetermined time, it is determined to be normal and a normal signal is output, and when the reference signal from the arithmetic processing means is not within the predetermined time, it is determined to be abnormal. When there is a normal signal from the backup IC that outputs an abnormal signal by the backup IC, the control target power is supplied by the control signal from the arithmetic processing means, and the abnormality occurs from the backup IC. When there is an error signal from the backup IC to the output means when the arithmetic processing means inputs the abnormality signal from the backup IC, the vehicle control device is provided with an output means that does not supply power to the controlled object when the error signal is present. Is output to the output means.

The configuration of the second invention is characterized in that the arithmetic processing means outputs the mask signal to the output means after the abnormal signal inputted from the backup IC continues for a predetermined time or longer.

[0010]

The first effect is that the arithmetic processing means is a backup I.
When the abnormal signal is input from C, the mask signal for invalidating the abnormal signal from the backup IC to the output means is output to the output means. (Claim 1) The second effect is that the arithmetic processing means outputs the mask signal to the output means after the abnormal signal input from the backup IC continues for a predetermined time or longer. (Claim 2)

[0011]

The first effect is that when the arithmetic processing means inputs an abnormal signal from the backup IC, the backup I
By outputting a mask signal for invalidating the abnormal signal from C to the output means to the output means, an abnormal signal is generated from the backup IC due to an external factor such as noise within the predetermined time for the reference signal from the arithmetic processing means. In this case, it is possible to supply power to the controlled object without failing to consider the operation processing unit to be abnormal, and to perform fail-safe operation of the backup IC. (Claim 1 and Claim 2) The second effect is that the arithmetic processing means outputs a mask signal to the output means after the abnormal signal input from the backup IC has continued for a predetermined time or longer, whereby the abnormal state is predetermined. If it is less than the time, it is not considered as an abnormality of the backup IC, and if the abnormal state continues for a predetermined time or more, it is considered as an abnormality of the backup IC, and the backup IC is disconnected from the output means, whereby more effective fail safe can be performed. (Claim 2)

[0012]

EXAMPLES The present invention will be described below based on specific examples. FIG. 1 shows the configuration of the first embodiment of the present invention. In this embodiment, a fail monitor terminal 17 is newly provided in the CPU 7 to monitor the fail signal 16 from the B / UIC 15. As a result, the CPU 7 is normally WD
While the C pulse signal 14 is being output, B / UIC 15
Can monitor fail signal 16, the abnormality can be prevented abnormality determination of the O ₂ heater 9 by turning OFF the output of the O ₂ heater 9.

Further, the CPU 7 is provided with a fail mask output terminal 18, and an OR circuit 22 for switching between the fail mask signal 19 from the fail mask output terminal 18 and the fail signal 16 from the B / UIC 15 is provided and supplied to the buffer circuit 10. To do. As a result, the CPU 7 normally operates W
When the fail monitor terminal 17 detects a signal indicating an abnormality (LOW) for a predetermined long period even though the DC pulse signal 14 is being output, the failure mask signal 19 is set to HI after the abnormality is determined. / UIC15 separately from the can control conventional O ₂ heater 9, further O ₂
The abnormality (+ B short circuit or resistance deterioration) detection of the heater 9 can be restarted.

Next, the O ₂ heater 9 in the CPU 7,
The calculation processing procedure for fail signal detection and fail safe of the B / UIC 15 will be described with reference to FIGS. FIG. 2 shows a module that requests whether the O ₂ heater 9 is turned off or turned on depending on the driving state of the vehicle. First, in order to operate the O ₂ heater 9, step 3
Within 2 seconds after ignition on (IG ON) at 01,
Alternatively, when the starter is turned on in step 302, or when the battery voltage is 10 V or less in step 303, that is, when the vehicle is in the starting state, the heater on request flag is turned on in step 306.

If the engine is in a state after starting, step 3
04, step 305, the condition of the engine speed NE is checked, and the region where the exhaust temperature is predicted to be low (for example,
(500 to 2800 rpm), the heater on request flag is turned on in step 306. At the same time, in step 312, the contradictory heater off request flag is turned off.

Next, in order to stop the O ₂ heater 9, first in step 307, the heater on request flag is set to OF.
F, except for the above-described heater operating conditions or other than the starting state, when the engine speed NE is 200 rpm or less in step 308, that is, when the engine is on the verge of being stalled or in an stalled state, or in step 309, during fuel cut, or in step In 310, if the vehicle is in a high rotation range (for example, 3200 rpm or higher) and the exhaust temperature is predicted to be sufficiently high, the heater off request flag is turned ON in step 311. Here, there are two heater on / off request flags in order to protect the output driver 11 by providing a hysteresis condition for operating the O ₂ heater 9.

FIG. 3 shows a module for actually controlling the O ₂ heater 9 in response to the O ₂ heater request flag shown in FIG. Although step 401 and step 402 are newly added in the present invention, they will be described later together with the description of FIG. Normally, when the B / UIC 15 is normal, in step 403, the O ₂ heater abnormality detection flag that is turned ON / OFF in the process of the flowchart of FIG. 4 described later is checked. When the abnormality of the O ₂ heater 9 is not detected, the current state of the O ₂ heater 9 is checked in step 404.

If the O ₂ heater 9 is ON, step 40
In step 6, it is checked whether or not there is a heater-off request. If yes, in step 408 the O ₂ heater 9 is turned off. If the O ₂ heater 9 is off, it is checked in step 405 if there is a heater on request, and if there is a heater on request, it is turned on in step 407. Already in the step 403, if it is finished the abnormality detection of O ₂ heater 9, O ₂ heater 9 in step 408
Is forcibly turned off to protect the output driver 11.

FIG. 4 shows the detection of an abnormality of the O ₂ heater 9 (+ B
This is a module that performs short circuit or deterioration resistance.
Here, in the present invention, step 501 and step 50
2 is newly added, which will be described later with the description of FIG.
+ B short circuit or resistance deterioration detection, O ₂ heater 9
Since it can be detected only in the N-state, the state of the O ₂ heater 9 is detected in step 503.

If the O ₂ heater 9 is ON, the state of the O ₂ heater monitor terminal 12 is checked in step 504. If the HI state indicates an abnormality, the O ₂ heater abnormality detection flag is turned ON in step 506. The O ₂ heater 9 is turned on in steps 403 and 408 described above.
The output driver 11 can be protected by FF. If the LOW state indicating normal is found in step 504, step 505
Turns off the O ₂ heater abnormality detection flag.

FIG. 5 shows the CPU 7 to B / UIC W
This module outputs the DC pulse signal 14. WD
The C pulse signal 14 is interrupted in order to be output to the B / UIC 15 every predetermined time. First, in step 601, the WDC counter is incremented. This WDC counter is cleared (CL
If the CPU 7 or the like locks due to a runaway or the like, the WDC counter is not cleared, and the inversion output of the WDC pulse signal 14 is stopped after the elapse of a predetermined time (100 ms) in step 602. Thereby, the abnormality of the CPU 7 can be determined by the B / UIC 15.

On the contrary, when the normal CPU 7 is normal, the WDC counter is always cleared within a predetermined time (within 100 ms). Therefore, the state of the WDC output terminal 23 is checked in step 603, and if it is HI, step 605. At LOW
On the contrary, if it is LOW, a regular inversion signal can be supplied to the B / UIC 15 by performing HI in step 604.

In the present invention, the processing shown in FIG. 6 is added to monitor the fail signal 16 of the B / UIC 15 and determine the abnormality. In addition, the processing timing is performed immediately after the CPU 7 outputs the WDC pulse signal 14 (inverts the WDC output terminal 23), so that the WDC pulse signal 14 is processed.
B / UIC15 only by monitoring the fail signal 16 of B / UIC15 without monitoring the B / UIC15 by another circuit.
Can detect abnormalities.

The processing contents of FIG. 6 will be described. In step 701, the state of the fail monitor terminal 17 is checked, and if it is HI, that is, normal, in step 703 B / UIC
The fail flag is turned off, the fail counter is cleared in step 705, and the fail mask output terminal 18 is also set to LOW in step 708. Alternatively, step 701
When LOW, that is, when a signal indicating an abnormality is input (noise or the like), the B / UIC fail flag is turned on in step 702, and the fail counter is incremented in step 704.

In step 706, it is judged whether or not the fail counter has passed a predetermined long time, and if not, the fail mask output terminal 18 makes the step 708.
If the fail state continues for more than a predetermined long time (for example, for one second or if normal restoration is impossible), the B / UI is determined in step 707.
In order to mask the fail signal 16 from C15, the fail mask output terminal 18 is set to HI.

As a result, the signal output from the OR circuit 22 is irrelevant to the fail signal 16 from the B / UIC 15, and the buffer circuit 10 can always operate normally in the H level.
I signal is supplied and O is disconnected from B / UIC 15
₂ It becomes possible to operate the heater 9 and determine abnormality. Further, in step 709, the fail code memory flag is turned on, the fail code can be stored in the non-volatile memory 21 by the flag, and by reading the code at the time of periodic inspection of the vehicle, the abnormality of the B / UIC 15 has occurred. Can be detected.

Regarding fail-safe, FIG. 3 and FIG.
Steps 401 and 501 check the state of the B / UIC fail flag. If it is OFF, normal normal operation is performed. If it is ON, the O ₂ heater 9 is controlled and the O ₂ heater 9 is abnormal depending on the B / UIC 15 fail state. It is determined in steps 402 and 502 whether detection is to be performed. If the B / UIC 15 fails for a short time, for example, if it fails due to noise or the like, since the fail mask output terminal 18 is LOW in step 402, step 4
The O ₂ heater 9 is fixed to OFF by 08, similarly, stop abnormality detection of O ₂ heater 9 in step 502, it is possible to prevent abnormal determination of the O ₂ heater 9.

Further, when the fail of the B / UIC 15 continues for a long time (for example, 1 second), the fail mask output terminal 18 is set to HI in step 707 of FIG. control of _second heater 9, the abnormality detection of O ₂ heater 9 can again be carried out. Further, the target actuator is not only an ON / OFF-controlled actuator such as the O ₂ heater 9, but a linear actuator that continuously changes the output according to the amount of current to be energized by controlling the duty ratio value. A solenoid may be used.

The present invention is not limited to the above embodiment. For example, regarding the failure detection of the B / UIC 15 of FIG. 6, after detecting the abnormality of the B / UIC 15 in a relatively long time, the O ₂ heater is again detected. 9 does not need to be detected, as shown in FIG. 7, the HI / LOW setting of the fail mask output terminal 18 (step 70 in FIG. 6).
7, step 708) may be omitted. At this time, the fail mask output terminals 18, O of the CPU 7 in FIG.
The R circuit 22 can also be omitted, and step 402 in FIG. 4 and step 502 in FIG. 5 can be omitted.

If it is desired to detect the abnormality of the O ₂ heater 9 while detecting the abnormality of the B / UIC 15 for a relatively long time, as shown in FIG. Set LOW (step 907, step 908) to ON / OF of B / UIC fail flag
This can be achieved by performing before the F set (steps 902 and 903).

Further, the fail monitor terminal 17 may be an edge detection port. In this case, FIG. 9 and FIG.
As shown in, the fail detection routine of the B / UIC 15 is not called for each WDC pulse output, but is called for each edge detection. That is, when an edge is detected, the WDC counter value is first checked in step 1110, and if it is longer than a predetermined time (for example, 100 ms), the CPU 7 determines that the edge is detected by stopping the WDC pulse, so that the normal reset is performed. , Then step 1
B / UIC fail flag OFF at 103, step 1
Clear the fail counter at 105, step 1108
Then, the fail mask output terminal 18 is set to LOW.

If the WDC counter is within a predetermined time, the edge level of the fail monitor terminal 17 is checked at step 1101. If it is a LOW edge, B / U is detected.
If any abnormality occurs in IC15, step 11
At 02, the B / UIC fail flag is turned on, and thereafter, the abnormality detecting means similar to that in FIG. 6 is stepped on. Fail monitor terminal 1
If 7 is a HI edge, it is regarded as a normal return from a fail, and the same steps as the normal reset are taken to clear all flags, counters, and terminals.

According to the above-described embodiment, the present invention provides B / U under the condition that the CPU 7 normally outputs the WDC pulse.
Even if the IC 15 operates due to noise from the outside or the like and outputs an abnormal signal continuously for a predetermined time, it is not regarded as an abnormality of the CPU 7, and the O ₂ heater 9 can be normally controlled. Therefore, the fail safe of the B / UIC 15 can be sufficiently performed, and the quality of the vehicle control device can be improved.

[Brief description of drawings]

FIG. 1 is a block diagram showing a configuration of a first embodiment according to the present invention.

FIG. 2 is a flowchart showing a processing procedure for checking the state of an O ₂ heater according to the first embodiment of the present invention.

FIG. 3 is a flowchart showing a processing procedure for controlling an O ₂ heater according to the first embodiment of the present invention.

FIG. 4 is a flowchart showing a processing procedure of abnormality detection of an O ₂ heater according to the first embodiment of the present invention.

FIG. 5 is a flowchart showing a processing procedure of outputting a WDC pulse according to the first embodiment of the present invention.

FIG. 6 is a flowchart showing a processing procedure for failure detection of the B / UIC according to the first embodiment of the present invention.

FIG. 7 is a flowchart showing a processing procedure when it is not necessary to detect the O ₂ heater abnormality again after detecting the B / UIC abnormality for a relatively long time.

FIG. 8 is a flowchart showing a processing procedure when it is desired to detect the O ₂ heater abnormality even while the B / UIC abnormality is detected for a relatively long time.

FIG. 9 is a flowchart showing a processing procedure of outputting a WDC pulse when the fail monitor terminal is an edge detection port.

FIG. 10 is a flowchart showing a processing procedure of B / UIC failure detection when the fail monitor terminal is an edge detection port.

FIG. 11 is an overall configuration diagram showing a configuration of a conventional ECU.

[Explanation of symbols]

1 Starter signal 2 Engine speed signal 3 Battery signal 4 Water temperature sensor voltage 5 O ₂ sensor voltage 6 A / D conversion circuit 7 CPU 8 O ₂ sensor 9 O ₂ heater 10 Buffer circuit 11 Output driver 12 O ₂ Heater monitor terminal 13 Abnormal Detection circuit 14 WDC pulse signal 15 B / U IC 16 Fail signal 17 Fail monitor terminal 18 Fail mask output terminal 19 Fail mask signal 20 O ₂ Heater output terminal 21 Non-volatile memory 22 OR circuit 23 WDC output terminal 100, 200 ECU NE engine Number of rotations

─────────────────────────────────────────────────── ─── Continuation of the front page (51) Int.Cl. ⁶ Identification code Office reference number FI technical display location G05B 7/02 B 7531-3H 15/02

Claims (2)

[Claims] 1. A control target for stable running of a vehicle and various sensor outputs provided on the vehicle are input, a control signal required for the control target is calculated according to the sensor output, and at predetermined time intervals. An arithmetic processing means having a function of outputting a reference signal, a storage means for storing program data and control data required by the arithmetic processing means, and a reference signal from the arithmetic processing means every predetermined time. In this case, it is determined that the signal is normal and a normal signal is output, and when the reference signal from the arithmetic processing means is not within each predetermined time,
A backup IC that determines that there is an abnormality and outputs an abnormality signal
When there is a normal signal from the backup IC, power is supplied to the control target by the control signal from the arithmetic processing means, and when there is an abnormal signal from the backup IC, it is regarded as abnormal and power is supplied to the control target. In the vehicle control device including a non-output unit, the arithmetic processing unit, when the abnormal signal is input from the backup IC, outputs a mask signal for invalidating the abnormal signal from the backup IC to the output unit to the output unit. A fail-safe device for a backup IC, which is characterized by outputting. 2. The arithmetic processing means is configured to backup the backup I.
The fail-safe device for a backup IC according to claim 2, wherein the mask signal is output to the output means after the abnormal signal input from C continues for a predetermined time or more.