JPH09105349A - Fail-safe device of electronic control unit - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a fail-safe device that is able to control a controlled system to the safety side even when a control circuit (central processing unit) and its monitoring circuit both fail to function properly (double fault). SOLUTION: In this device which monitors something wrong with a central processing unit constituting a control circuit 80 with a monitoring circuit 200, and in time of trouble judgment, prohibits any drive (fuel injection) of a solenoid spill valve 23 of a fuel injection pump 1, stopping the driving of a diesel engine and simultaneously monitoring the trouble in the monitoring circuit 200 by the central processing unit at the side of the control circuit 80 too, and in time of trouble judgment, lighting a warning lamp 101, thereby informing a driver of this fact, if the central processing unit judges the trouble in the monitoring circuit 200, the judging signal is latched at a trouble time control circuit 3000. Subsequently, when rotational frequency of the diesel engine exceeds the specified upper limit speed, any drive (fuel injection) of the solenoid spill valve 23 by means of the control circuit 80 is prohibited. In consequence, even when the central processing unit goes wrong in time of something wrong with the monitoring circuit 200, the diesel engine is safely drivable.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an electronic control device for controlling a predetermined controlled object such as an internal combustion engine by using a control circuit composed of a CPU, and monitors the control circuit for abnormality and also monitors the circuit. The present invention relates to a fail-safe device that monitors the above abnormality on the control circuit side and controls the controlled object to the safe side when the control circuit and the monitoring circuit are abnormal.

[0002]

2. Description of the Related Art Conventionally, for example, Japanese Patent Laid-Open No. 3-70837.
As described in Japanese Patent Laid-Open Publication No. 3-95636 and the like, in an electronic control device that controls a control target using a control circuit including a CPU, a monitoring circuit monitors an abnormality in the control circuit (that is, the CPU). Not only that, there is known a fail-safe device that monitors the abnormality of the monitoring circuit on the control circuit side and, when an abnormality occurs in the control circuit and the monitoring circuit, controls the controlled object to the safe side. .

For example, in FIG. 5, the fuel injection amount to the diesel engine is controlled by controlling the valve opening timing of the electromagnetic spill valve 142 provided in the distribution type fuel injection pump 140 for injecting fuel to the diesel engine. 2 shows a schematic configuration of the control device 150 for controlling the diesel engine and the distribution type fuel injection pump 140 such as the rotational speed NE of the diesel engine detected by the rotation speed sensor 144. Based on this, a control circuit 152 including a CPU that calculates the fuel injection amount to the diesel engine and determines the valve opening timing of the electromagnetic spill valve 142.
If there is a failure, the diesel engine cannot be operated at the rotation speed requested by the driver, and the rotation speed may become abnormally high.
As a safety measure, a fail safe device is provided.

The fail-safe device has a CPU monitoring circuit 154 including a so-called watchdog timer.
And A provided in the signal path of the control signal input from the control circuit 152 to the drive circuit 160 of the electromagnetic spill valve 142.
When the CPU monitoring circuit 154 determines that the control circuit 152 is abnormal, the CPU monitoring circuit 1 includes an ND circuit 156.
The control signal (high level) for driving the electromagnetic spill valve input from the control circuit 152 to the drive circuit 160 is switched by switching the signal level input from 54 to one of the AND circuits 156 from the high level to the low level. By shutting off the valve, the electromagnetic spill valve 142 is kept open, and fuel injection into the diesel engine is prohibited.

Further, since the CPU monitoring circuit 154 itself may fail, the control circuit 152 side should also monitor the CPU monitoring circuit 154 for abnormality as disclosed in the above publications. When an abnormality of the CPU monitoring circuit 154 is determined, and when the CPU monitoring circuit 1
When 54 determines an abnormality in the control circuit 152, each circuit outputs a determination signal indicating that,
By inputting the determination signal to the drive circuit 162 of the warning lamp 170 via the OR circuit 158, the warning lamp 170 is turned on and the driver is informed accordingly.

[0006]

However, in such a conventional fail-safe device, the control circuit 152 and the CPU are
When either one of the monitoring circuits 154 fails, the fuel injection is prohibited to control the diesel engine to the safe side, or the warning lamp 170 is turned on to notify the driver to that effect. Although it becomes possible to ensure safety when an abnormality occurs, when an abnormality also occurs in the control circuit 152 when the CPU monitoring circuit 154 is abnormal (double failure), the diesel engine is placed on the safe side. There is a case where the engine speed becomes uncontrollable and the rotational speed of the diesel engine becomes abnormally high.

The present invention has been made in view of the above problems, and an electronic control unit capable of controlling a controlled object such as an internal combustion engine to a safe side even when both a control circuit and a monitoring circuit thereof fail. The purpose of the present invention is to provide a fail-safe device.

[0008]

In order to achieve the above object, the invention according to claim 1 calculates the control amount of the controlled object based on the detection signal indicating the operating state of the controlled object, CP for generating a control signal according to the calculation result
An electronic control device provided with a control circuit including U and a drive circuit that drives and controls the control target according to a control signal from the control circuit is provided, and an abnormality of the control circuit is monitored by a monitoring circuit. At the same time, the control circuit monitors the monitoring circuit for an abnormality, and when the monitoring circuit determines an abnormality in the control circuit, the control circuit inputs the control signal to the drive circuit and shuts off. When the control target is operated to the safe side and the control circuit determines an abnormality of the monitoring circuit, a fail-safe process is performed to operate the control target to the safe side by the operation of the CPU. In the safe device, when the control circuit determines an abnormality of the monitoring circuit and outputs an abnormality determination signal indicating that, a latch circuit for latching the signal is provided. When the abnormality determination signal is latched, the abnormal state control is performed to limit the input of the control signal from the control circuit to the drive circuit based on the detection signal so that the control target is not overcontrolled. A circuit is provided.

In the fail-safe device having the above-mentioned structure, the control circuit and the monitoring circuit mutually monitor the abnormality, and when the monitoring circuit determines the abnormality of the control circuit, the control circuit In order to operate the controlled object to the safe side by shutting off the control signal input to the drive circuit from the control circuit to operate the controlled object to the safe side, and when the control circuit side determines that the monitoring circuit is abnormal. Performs a predetermined fail-safe process.

Further, in the abnormal condition control circuit, when the control circuit side judges an abnormality of the monitoring circuit and outputs an abnormality judgment signal indicating that, the latch circuit latches the signal. When the abnormality determination signal is latched by this latch circuit, the control target is over-controlled by limiting the input of the control signal from the control circuit to the drive circuit based on the detection signal indicating the operating state of the control target. To prevent

Therefore, according to the present invention, not only can the controlled object be controlled to the safe side when the control circuit or the monitoring circuit fails, but a double failure occurs in which the control circuit fails when the monitoring circuit fails. In this case, it is possible to prevent the controlled object from being overcontrolled by an erroneous control signal output from the control circuit.

Further, in the present invention, as a safety measure against such a double failure, the input of the control signal from the control circuit to the drive circuit is restricted so that the controlled object is not overcontrolled. As long as the control circuit operates normally and the controlled object is not over-controlled, the control signal is not limited. Therefore, even though the control circuit is operating normally, the control signal is not limited, and during normal operation of the control circuit, the control target can be controlled according to its operating state.

The invention according to claim 2 is the fail-safe device according to claim 1, wherein the electronic control device is a control device for an internal combustion engine for controlling the internal combustion engine, and the abnormal condition control circuit is A control signal for controlling a fuel supply amount or an intake air amount to the internal combustion engine is limited so that the rotation speed of the internal combustion engine does not exceed a predetermined upper limit speed.

That is, the fail-safe device according to claim 2 is a fail-safe device of an electronic control device for controlling an internal combustion engine such as a diesel engine, and when the control device determines an abnormality of the monitoring circuit, the abnormal-time control circuit However, the rotation speed of the internal combustion engine is prevented from exceeding a predetermined upper limit speed by limiting the control signal for controlling the fuel supply amount or the intake air amount to the internal combustion engine.

Therefore, according to the present invention, even if the control circuit fails when the monitoring circuit fails, the rotation speed of the internal combustion engine can be limited to a predetermined upper limit speed or less, and the internal combustion engine can be operated safely. Then, when the internal combustion engine to be controlled is a vehicle internal combustion engine mounted on a vehicle as a power source of the vehicle, the traveling safety of the vehicle can be enhanced.

Next, the invention according to claim 3 is the fail-safe device according to claim 2, wherein the abnormal-time control circuit operates during idle operation of the internal combustion engine in which the driver does not operate the accelerator. An upper limit speed switching circuit that switches the upper limit speed according to the operating state of the internal combustion engine so that the upper limit speed becomes smaller than that during load operation of the internal combustion engine in which a person performs an accelerator operation. .

That is, in the apparatus according to the second aspect, the upper limit speed of the rotation speed of the internal combustion engine, which is limited when the monitoring circuit and the control circuit have a double failure, is set during idle operation of the internal combustion engine and during load operation of the internal combustion engine. If the same value is set in and, the idle rotation speed of the internal combustion engine becomes too high, and loud noise is generated, or conversely, the rotation speed of the internal combustion engine is suppressed too much.
It is possible that the internal combustion engine will stall.
Therefore, in the fail-safe device according to claim 3, the upper limit speed limited by the abnormal condition control circuit is switched between the idling operation and the load operation of the internal combustion engine, thereby changing the rotational speed of the internal combustion engine under each operating condition. An abnormal rise can be favorably suppressed, and an internal combustion engine can be better safely operated when a double failure occurs in the monitoring circuit and the control circuit. For this reason, particularly when the internal combustion engine is a vehicle internal combustion engine, the vehicle can be reliably made to evacuate in the event of a double failure, and the running safety of the vehicle can be further enhanced.

[0018]

Embodiments of the present invention will be described below. First, FIG. 2 shows a schematic configuration of an automobile diesel engine system of an embodiment to which the present invention is applied.

As shown in FIG. 2, in the automobile diesel engine system of this embodiment, a distributed fuel injection pump (hereinafter referred to as a fuel injection pump) 1 has a drive pulley 3, and the drive pulley 3 is a diesel engine 2 Is connected to the crankshaft 40 via a belt or the like. Then, the drive pulley 3 is rotationally driven by the crankshaft 40 and the fuel injection pump 1 is driven, so that the fuel injection provided for each cylinder of the diesel engine 2 (here, four cylinders are provided). Fuel is pressure-fed to the nozzle 4 through the fuel pipe 4a.

The fuel injection nozzle 4 is an automatic valve having a built-in needle valve and a spring for adjusting the valve opening pressure of the needle valve, and is opened when a fuel pressure of a predetermined level or higher is obtained. Therefore, the fuel pressure-fed from the fuel injection pump 1 applies a fuel pressure of a predetermined level or higher to the fuel injection nozzle 4, so that the fuel is injected from the nozzle 4 to the diesel engine 2.

A drive shaft 5 is provided in the fuel injection pump 1, and a drive pulley 3 is attached to the tip of the drive shaft 5. Drive shaft 5
A fuel feed pump (developed by 90 degrees in this figure) 6 made up of a vane type pump is provided in the middle of. A disc-shaped pulsar 7 is attached to the base end side of the drive shaft 5. On the outer peripheral surface of the pulsar 7, the same number as the number of cylinders of the diesel engine 2, that is, four teeth in this embodiment (a total of "eight") are formed at equal angular intervals. In addition, 14 protrusions (a total of "56") are formed at equal angular intervals between each toothless portion. The base end of the drive shaft 5 is connected to the cam plate 8 via a coupling (not shown).

A roller ring 9 is provided between the pulsar 7 and the cam plate 8. Also, the roller ring 9
A plurality of cam rollers 10 facing the cam face 8a of the cam plate 8 are mounted in the circumferential direction of. The cam faces 8a are provided in the same number as the number of cylinders of the diesel engine 2. Further, the cam plate 8 is biased by a spring 11 so as to be engaged with the cam roller 10.

A proximal end of a plunger 12 for pressurizing fuel is attached to the cam plate 8 so as to be integrally rotatable.
Then, the cam plate 8 and the plunger 12 are
As the drive shaft 5 rotates, the drive shaft 5 is integrally rotated. That is, the rotational force of the drive shaft 5 is transmitted to the cam plate 8 via the coupling, so that the cam plate 8 is rotated while engaging with the cam roller 10. As a result, the cam plate 8 is reciprocated in the horizontal direction in the figure by the same number as the number of cylinders while being rotated, and the plunger 12 is reciprocated in the same direction while being rotated. That is, the plunger 12 is moved forward (lifted) while the cam face 8 a rides on the cam roller 10 of the roller ring 9. Conversely, the plunger 12 is moved back (down) while the cam face 8a rides on the cam roller 10.

A cylinder 14 is formed in the pump housing 13, and the plunger 12 is fitted in the cylinder 14. A high-pressure chamber 15 is provided between the tip surface of the plunger 12 and the bottom surface of the cylinder 14. In addition, suction grooves 16 and distribution ports 17 are formed on the outer periphery of the distal end side of the plunger 12 by the same number as the number of cylinders. Further, corresponding to the suction groove 16 and the distribution port 17,
A distribution passage 18 and an intake port 19 are formed in the pump housing 13, respectively. Then, the drive shaft 5 is rotated and the fuel feed pump 6 is driven, so that the fuel supply port 2 from the fuel tank (not shown) is driven.
Fuel is introduced into the fuel chamber 21 through 0. Also,
In the intake stroke in which the plunger 12 is returned and the high pressure chamber 15 is depressurized, one of the intake grooves 16 communicates with the intake port 19 so that fuel is introduced from the fuel chamber 21 to the high pressure chamber 15. On the other hand, in the compression stroke in which the plunger 12 is moved forward and the high pressure chamber 15 is pressurized, fuel is pressure-fed and injected from the distribution passage 18 to the fuel injection nozzle 4 of each cylinder through the fuel pipe 4a.

In the pump housing 13, the high pressure chamber 1
A spill passage 22 for causing fuel to overflow (spill) is formed between the fuel chamber 5 and the fuel chamber 21. An electromagnetic spill valve 23 is provided in the spill passage 22. The electromagnetic spill valve 23 is provided in the high pressure chamber 15
Opened and closed to adjust the spill of fuel from. The electromagnetic spill valve 23 is a normally open type valve, and when the coil 24 is in the non-energized (off) state, the spill passage 22 is opened by the valve body 25, that is, the valve is opened, and the fuel in the high pressure chamber 15 is filled with fuel. Be spilled. On the other hand, when the coil 24 is energized (turned on), the valve body 25 causes the spill passage 22
Are closed (that is, the valve is closed), and the high pressure chamber 15 to the fuel chamber 2
The fuel spill to 1 is cut off.

Therefore, the electromagnetic spill valve 23 is controlled to be turned on / off by energization, so that the valve 23 is controlled to be closed / opened, and the spill of fuel from the high pressure chamber 15 to the fuel chamber 21 is adjusted. Then, by opening the electromagnetic spill valve 23 during the compression stroke of the plunger 12, the fuel in the high pressure chamber 15 is decompressed and the fuel injection from the fuel injection nozzle 4 is stopped. That is, even if the plunger 12 is moving forward, the fuel pressure in the high pressure chamber 15 does not rise and the fuel injection from the fuel injection nozzle 4 is not performed while the electromagnetic spill valve 23 is opened. Also, plunger 1
During the forward movement of 2, the opening timing of the electromagnetic spill valve 23 is controlled, so that the fuel injection amount from the fuel injection nozzle 4 is controlled.

Below the pump housing 13, a timer device (developed by "90 degrees" in this figure) 26 for controlling the fuel injection timing to the advanced side or the retarded side is provided. . The timer device 26 changes the rotational position of the roller ring 9 with respect to the rotational direction of the drive shaft 5 to change the timing at which the cam face 8a engages with the cam roller 10, that is, the timing at which the plunger 12 reciprocates. belongs to.

The timer device 26 is driven by control hydraulic pressure, and has a timer housing 27 and a timer piston 28 fitted in the housing 27. Further, both sides of the timer piston 28 in the timer housing 27 are a low pressure chamber 29 and a pressure chamber 30, respectively. Then, in the low pressure chamber 29, the timer piston 2
A timer spring 31 for urging the pressure 8 into the pressurizing chamber 30 is provided. Further, the timer piston 28 is connected to the roller ring 9 via a slide pin 32.

Fuel pressurized by the fuel feed pump 6 is introduced into the pressurizing chamber 30. The position of the timer piston 28 is determined by the equilibrium relationship between the fuel pressure and the urging force of the timer spring 31. Also, by determining the position of the timer piston 28,
The position of the roller ring 9 is determined, and the reciprocating timing of the plunger 12 via the cam plate 8 is determined.

The fuel pressure in the fuel injection pump 1 is used as the control hydraulic pressure of the timer device 26. In order to adjust the fuel pressure, the timer device 26 is provided with a timer control valve (TCV) 33. That is, a communication passage 34 is provided between the pressurizing chamber 30 and the low pressure chamber 29 of the timer housing 27, and the communication passage 34 is provided.
The TCV 33 is provided in the middle of. TCV33 is
This is an electromagnetic valve that is opened / closed by a duty-controlled energization signal, and the fuel pressure in the pressurizing chamber 30 is adjusted by opening / closing controlling the TCV 33. And
By adjusting the fuel pressure, the plunger 12
The reciprocating timing of is controlled, and thus the fuel injection timing from the fuel injection nozzle 4 is controlled to the advance side or the retard side.

A rotation speed sensor 35 composed of an electromagnetic pickup coil is mounted above the roller ring 9 so as to face the outer peripheral surface of the pulsar 7. This rotation speed sensor 3
The reference numeral 5 detects the passages of the pulsar 7 when it is traversed by the protrusions of the pulsar 7 and outputs the detected passages as pulse signals. That is, the rotation speed sensor 35 outputs a pulse signal corresponding to the engine rotation for each constant crank angle. In addition, the rotation speed sensor 3
Reference numeral 5 outputs an engine rotation pulse signal corresponding to a constant crank angle due to the missing tooth of the pulsar 7 as a reference position signal.
Further, the rotation speed sensor 35 outputs a series of engine rotation pulse signals as a signal for obtaining the rotation speed NE. Since the rotation speed sensor 35 is integrated with the roller ring 9, it is possible to output a reference engine rotation pulse signal with respect to the reciprocating movement of the plunger 12 at a constant timing regardless of the control operation of the timer device 26. .

Next, in the diesel engine 2, the cylinder bore 41, the piston 42 and the cylinder head 43
A main combustion chamber 44 corresponding to each cylinder is formed. Further, the cylinder head 43 is formed with auxiliary combustion chambers 45 that communicate with the respective main combustion chambers 44. Then, fuel is injected into each sub-combustion chamber 45 from each fuel injection nozzle 4. Further, each sub-combustion chamber 45 is provided with a well-known glow plug 46 as a start-up assist device.

The diesel engine 2 is also provided with an intake pipe 47 and an exhaust pipe 50 which communicate with each cylinder. Further, the intake pipe 47 is provided with a compressor 49 of a turbocharger 48 that constitutes a supercharger, and the exhaust pipe 50 is provided with a turbine 51 of the turbocharger 48. Further, the exhaust pipe 50 is provided with a waste gate valve 52. As is well known, the turbocharger 48 uses the energy of the exhaust gas to rotate the turbine 51, and the compressor 4 located coaxially therewith.
9 is rotated to increase the pressure of the intake air. Then, the intake air is pressurized so that high-density air is generated in the main combustion chamber 4
A large amount of fuel that has been sent to the engine 4 and injected through the auxiliary combustion chamber 45 is burned, and the output of the diesel engine 2 is increased. Further, by opening / closing the waste gate valve 52, the boosting level of intake air by the turbocharger 48 is adjusted.

On the other hand, an exhaust gas recirculation passage (EGR) is provided between the intake pipe 47 and the exhaust pipe 50.
A passage 54 is provided. The EGR passage 54 causes a portion of the exhaust gas in the exhaust pipe 50 to flow into the intake pipe 47.
Is recirculated near the suction port 53 at. Also,
An EGR valve 55 is provided in the middle of the EGR passage 54, and the EGR valve 55 allows the exhaust gas recirculation amount (EG
R amount) is adjusted. The EGR valve 55 is opened and closed under the control of a vacuum switching valve (VSV) 56.

Next, a throttle valve 58 is provided in the middle of the intake pipe 47, and the valve 58 is opened / closed in conjunction with the depression of the accelerator pedal 57. In addition, the intake pipe 4
7, the bypass passage 5 is arranged side by side with the throttle valve 58.
9 is provided, and the passage 59 is provided with a sub-throttle valve 60. A two-stage diaphragm chamber actuator 63 is provided to open and close the sub-throttle valve 60, and two vacuum switching valves (VSV) 61 and 62 are provided to drive the actuator 63. Has been. Then, the VSVs 61 and 62 are on / off controlled, and the actuator 63 is driven, so that the sub-throttle valve 60 is opened / closed. The sub-throttle valve 60 is normally controlled in a half-open state to reduce noise and vibration during idle operation, is controlled to a fully open state during normal load operation, and is smoothly stopped with less vibration during operation stop. It is controlled to the fully closed state.

Then, the electromagnetic spill valve 23 and TC provided in the fuel injection pump 1 and the diesel engine 2 are described.
V33, glow plug 46, and each VSV 56, 61,
The electronic control devices 62 are electrically connected to the electronic control device 71, and the drive timing of the electronic control devices 62 is controlled by the electronic control device 71.

As a sensor for detecting the operating state of the diesel engine 2, the following various sensors are provided in addition to the rotation speed sensor 35 described above. That is, an intake air temperature sensor 72 that detects the intake air temperature and outputs a signal according to the magnitude of the detected value is provided near the air cleaner 64 provided at the inlet and outlet of the intake pipe 47. Further, in the vicinity of the throttle valve 58, an accelerator opening sensor 73 is provided which detects an accelerator opening corresponding to an engine load from the open / close position of the valve 58 and outputs a signal corresponding to the magnitude of the detected value. ing. Also, suction port 5
An intake pressure sensor 74 that detects the pressure of intake air and outputs a signal according to the magnitude of the detected value is provided in the vicinity of 3. Furthermore, the temperature of the cooling water of the diesel engine 2,
That is, a water temperature sensor 75 is provided which detects the cooling water temperature and outputs a signal corresponding to the magnitude of the detected value. Further, there is provided a crank angle sensor 76 which detects a rotation reference position of the crankshaft 40, for example, a rotation position of the crankshaft 40 with respect to a top dead center of a specific cylinder, and outputs a signal corresponding to the rotation position.

In the electronic control unit 71, based on the signals output from these sensors, the electromagnetic spill valve 23,
TCV93, glow plug 46, and each VSV56,6
1, 62 and the like are preferably controlled. FIG. 3 shows the internal configuration of the electronic control unit 71. Therefore, the outline of the electronic control unit (hereinafter referred to as ECU) 71 will be described with reference to FIG.

The ECU 71 is a central processing unit (CPU) 8
1. A read-only memory (ROM) 82 in which a predetermined control program and a map are stored in advance;
M) 83, a backup R that stores the stored data
It is equipped with AM84 and the like. Then, the ECU 71 uses the respective units 81 to 84, the input port 85, and the output port 86.
And the like are connected by a bus 87, a clock oscillator 90 that supplies a clock signal for operation to the control circuit 80, and a power supply from a battery to receive the ECU 7
1. A power supply circuit 91 that generates a constant voltage to be supplied to each part in
, A / D converter 92, input buffer 93, waveform shaping circuit 94, drive circuit 95, and constant current drive circuit 96
And a CPU monitoring circuit 200 and a CPU monitoring circuit abnormal time control circuit 300.

At the input port 85, the intake temperature sensor 72, the accelerator opening sensor 73, the intake pressure sensor 74,
The input voltage (that is, the battery voltage) + B to the water temperature sensor 75 and the power supply circuit 91 is connected via the A / D converter 92. Similarly, the input port 85 is connected with an ignition switch 97, an idle switch 98, and a starter switch 99, which are not shown in FIG. 2, via the input buffer 93, and the rotation speed sensor 35 and the crank angle sensor 76 described above are connected. Are connected via the waveform shaping circuit 94. The CPU 81 reads these sensor signals and the state (ON / OFF) of each switch as input values via the input port 85.

On the other hand, the output port 86 has a driving circuit 95.
Through the glow plug 46, VSV 56, 61,
In addition to 62 and TCV33, a relay 100, a warning lamp 101, etc., which are omitted in FIG. 2, are connected. The electromagnetic spill valve 23 is connected to the output port 86 via the AND circuit 202 and the constant current drive circuit 96. Then, the CPU 81 outputs a control signal for driving each of these parts from the output port 86 while executing a predetermined calculation based on the input value read via the input port 85, and the drive circuit 95 or the AND circuit 202.
And these respective parts are drive-controlled via the constant current drive circuit 96. The constant current drive circuit 96 is used for the electromagnetic spill valve 2
3 for accurately controlling the valve opening timing of 3, that is, the fuel injection end timing.
When the level signal is input, the electromagnetic spill valve 23
Apply a constant current to the solenoid spill valve 23 to close the AND
When a low level signal is input from the circuit 202, the electromagnetic spill valve 23 is de-energized and the electromagnetic spill valve 23 is opened.

Next, the CPU monitoring circuit 200 is connected to the input port 85 and the output port 86, and the CPU 81
Outputs a pulse signal for status monitoring to the CPU 8
Input the pulse signal for status monitoring output from 1.
Then, the CPU 81 and the CPU monitoring circuit 200 monitor (mutual monitor) the operation state of each other by determining whether each of these pulse signals is a preset signal. The CPU monitoring circuit 200 also includes an AND circuit 202.
Is also connected to the constant current drive circuit 96 via the AND circuit 202 so as to control whether or not to input the control signal from the output port 86. Also, C
The PU monitoring circuit abnormal time control circuit (hereinafter, referred to as abnormal time control circuit) 300 controls the upper limit of the rotation speed by limiting the fuel injection amount when the CPU monitoring circuit 200 is abnormal. And an AND circuit 202.

FIG. 1 shows a CPU monitoring circuit 200 and an abnormality control circuit 3 which are the main parts of the fail-safe device of the present invention in the configurations shown in FIGS.
00 is a more detailed configuration of the part related to 00. Hereinafter, the operations of the control circuit 80 (specifically, the CPU 81), the CPU monitoring circuit 200, and the abnormal time control circuit 300 will be described with reference to FIG.

First, the mutual monitoring operation between the CPU 81 and the CPU monitoring circuit 200 will be described. CPU81 is CP
A pulse signal having a preset period is output to the U monitoring circuit 200. The CPU monitoring circuit 200 receives the pulse signal, determines that the CPU 81 is normal if the signal has a preset predetermined cycle, and conversely determines that the CPU 81 is abnormal if the pulse signal does not have the predetermined cycle. To do.

That is, if the CPU 81 becomes abnormal, CP
Since the pulse signal output from the U81 to the CPU monitoring circuit 200 has a period other than the preset period, or the pulse signal is not output from the CPU monitoring circuit 200, the CPU monitoring circuit 200 determines the period of the pulse signal. From the CPU 81, it is determined whether the CPU 81 is normal or abnormal.

The CPU monitoring circuit 200 also includes the CPU 8
As in the case of 1, the CPU 8 outputs a pulse signal having a preset cycle.
Output to 1. Then, the CPU 81 receives this pulse signal and judges whether this signal has a preset cycle, like the CPU monitoring circuit 200, to determine whether the CPU monitoring circuit 200 is normal or abnormal. To judge.

The CPU monitoring circuit 200 is a CPU
When it is determined that 81 is normal, a high-level signal is output to the AND circuit 202, and when it is determined that the CPU 81 is abnormal, the AND circuit 202 is output.
Output a low level signal to. As a result, when the CPU monitoring circuit 200 determines that the CPU 81 is normal, the output of the AND circuit 202 is controlled according to the outputs from the CPU 81 and the abnormal time control circuit 300, and C
When the PU monitoring circuit 200 determines that the CPU 81 is abnormal, the output of the AND circuit 202 is the CPU
81 and the output from the abnormal time control circuit 300,
Holds low. Therefore, when the CPU monitoring circuit 200 is operating normally when the CPU 81 is abnormal, the electromagnetic spill valve 23 is normally opened, and the diesel engine 2
Fuel injection into the diesel engine 2 is prohibited and the diesel engine 2 is stopped.

Although not shown in FIG. 3, a warning lamp 101 for connecting the output port 86 and the drive circuit 95 is connected.
An OR circuit 204 is provided on the signal line for lighting,
The CPU monitoring circuit 200 is connected to one input terminal of the OR circuit 204. Then, the CPU monitoring circuit 20
When 0 determines that the CPU 81 is normal, 0
It outputs a low level signal to the R circuit 204, and the CPU 81
If it is determined that is abnormal, a high level signal is output to the OR circuit 204. As a result, the CPU monitoring circuit 20
When 0 determines that the CPU 81 is abnormal, the output of the OR circuit 204 is held at the high level regardless of the output from the CPU 81, and when the CPU 81 is abnormal, the CPU monitoring circuit 200 is operating normally. Then, the warning lamp 101 is turned on via the drive circuit 95, and the vehicle driver is informed (warning) to that effect.

Further, the CPU 81 is the CPU monitoring circuit 20.
When it is determined that 0 is normal, output port 8
6 outputs the low level control signal to the OR circuit 204, but when it determines that the CPU monitoring circuit 200 is abnormal, the control signal output from the output port 86 to the OR circuit 204 is inverted to the high level and driven. The warning lamp 101 is turned on via the circuit 95. As a result, the vehicle driver can change the ECU 71 from the lighting state of the warning lamp 101.
Abnormality (more specifically, CPU 81 or CPU monitoring circuit 200
It is possible to perform safe driving by detecting (abnormality).

Further, the CPU 81 is the CPU monitoring circuit 20.
When an abnormality of 0 is judged, a judgment signal (High
Level) is output to the control circuit 300 at the time of abnormality. Then
The abnormality control circuit 300 sends this determination signal to the latch circuit 3
It latches at 02 and limits the upper limit of the rotation speed of the diesel engine 2.

Next, the structure and operation of the abnormal time control circuit 300 will be described. Abnormal control circuit 300
In addition to the latch circuit 302, an F / V conversion circuit 306 that performs F / V conversion (frequency-voltage conversion) of the engine rotation pulse signal from the rotation speed sensor 35 that is input via the waveform shaping circuit 94, and a power supply. A series circuit of a resistor R1, a resistor R2 and a transistor TR1 provided between a constant voltage output line from the circuit 91 and a ground line, and a resistor R
Resistor R3 and transistor TR connected in parallel to 2
2 and the positive side input terminal (+) receives the connection point voltage of the resistors R1 and R2, and the negative side input terminal (-) receives the output voltage from the F / V conversion circuit 306. The comparator 304 that determines the magnitude of each voltage and outputs an output signal representing the determination result to the AND circuit 202.
And

Here, the latch circuit 302 includes the CPU 81.
Latches the determination signal output from the output port 86 to output a high-level signal. Once the determination signal is latched, the reset signal is input thereafter (for example, the ECU 71 Until the reset signal is input to the latch circuit 302 after the power supply to the circuit is temporarily cut off and then the ECU 71 is restarted, the state is maintained.

Further, the F / V conversion circuit 306 converts the frequency of the engine rotation pulse signal corresponding to the rotation speed of the diesel engine 2 into a voltage signal, so that the rotation speed of the diesel engine 2 is limited to the upper limit of the power supply voltage VCC. Generates a voltage signal that increases with increasing. That is, the output from the F / V conversion circuit 306 becomes a voltage signal proportional to the rotation speed of the diesel engine 2.

On the other hand, the transistors TR1 and TR2 are both NPN type bipolar transistors,
The transistor TR1 has its emitter grounded, and receives the output signal from the latch circuit 302 at its base, so that it is turned on when the output of the latch circuit 302 is at the high level. Further, the transistor TR2 has an emitter connected to the collector of the transistor TR1 and receives an ON / OFF signal from the idle switch 98 input via the input buffer 93 at its base, whereby the idle switch 98 is turned on. At some time (that is, during idle operation of the diesel engine 2), it is turned on.

Therefore, in the abnormality control circuit 300, if the CPU 81 has not determined that the CPU monitoring circuit 200 is abnormal and the output from the latch circuit 302 is at a low level, the transistor TR1 is turned off. ,
The output voltage (constant voltage) Vcc from the power supply circuit 91 is input to the positive input terminal (+) of the comparator 304, and the output of the comparator 304 is always at the high level.
The output of the ND circuit 202 is the CPU monitoring circuit 200 or C.
It will be controlled according to the output from the PU 81.

On the other hand, the CPU 81 controls the CPU monitoring circuit 20.
When the abnormality of 0 is determined, the latch circuit 302 latches the determination signal, and when the output of the latch circuit 302 becomes High level, the transistor TR1 is turned on. Then, at this time, if the idle switch 98 is in the off state and the diesel engine 2 is in the load operating state, the transistor TR2 is also in the off state, so the constant voltage Vcc is applied to the positive input terminal (+) of the comparator 304. Resistor R1 and resistor R2
The constant voltage V1 divided by is input, and if the output voltage from the F / V conversion circuit 306 is less than or equal to this voltage V1, the comparator 304 outputs a high level, F
When the output voltage from the / V conversion circuit 306 exceeds this voltage V1, a low level signal is output.

That is, when the diesel engine 2 is under load operation, the comparator 304 uses the voltage V1 divided by the resistors R1 and R2 as a reference voltage and outputs the reference voltage V1 from the F / V conversion circuit 306. By comparing the output voltage with the output voltage, it is determined whether the rotation speed of the diesel engine 2 exceeds a predetermined upper limit speed determined by the reference voltage V1, and the rotation speed of the diesel engine 2 exceeds the upper limit speed. If not, by outputting a high level signal to the AND circuit 202, the output of the AND circuit 202 is controlled according to the output from the CPU monitoring circuit 200 or the control circuit 80, and the rotation speed of the diesel engine 2 is the reference. When the upper limit speed corresponding to the voltage V1 is exceeded, a low level signal is output to the AND circuit 202, which causes AN
The output of the D circuit 202 is forcibly set to the low level regardless of the outputs from the CPU monitoring circuit 200 and the control circuit 80, the energization of the electromagnetic spill valve 23 is prohibited, and the electromagnetic spill valve 23 is opened.

Further, the CPU 81 controls the CPU monitoring circuit 20.
When the abnormality of 0 is determined and the transistor TR1 is in the on state by the output from the latch circuit 302, the idle switch 98 is in the on state, and when the diesel engine 2 is in the idle operation state, the transistor TR2 is in the on state. Therefore, the positive voltage input terminal (+) of the comparator 304 is supplied with the constant voltage Vcc, the resistor R1 and the resistor R1.
The constant voltage V2 (V2 <V1) divided by the parallel circuit of 2 and the resistor R3 is input, and the comparator 304 determines that the output voltage from the F / V conversion circuit 306 is less than or equal to this voltage V2. For example, when the output voltage from the F / V conversion circuit 306 is High level and exceeds this voltage V2, a signal which is Low level is output. That is, diesel engine 2
During the idle operation, the comparator 304 compares the reference voltage V2 and the output voltage from the F / V conversion circuit 306 with the voltage V2, which is smaller than that during the load operation, as a reference voltage, thereby rotating the diesel engine 2 It is determined whether or not the speed exceeds a predetermined upper limit speed which is determined by the reference voltage V2 and is smaller than that during load operation. If the rotation speed of the diesel engine 2 does not exceed the upper limit speed, A
By outputting a high level signal to the ND circuit 202, the output of the AND circuit 202 is output to the CPU monitoring circuit 200.
Alternatively, control is performed according to the output from the control circuit 80, and when the rotation speed of the diesel engine 2 exceeds the upper limit speed corresponding to the reference voltage V2, a low level signal is output to the AND circuit 202, thereby The output is CP
Regardless of the output from the U monitoring circuit 200 or the control circuit 80, the electromagnetic spill valve 23 is forcibly turned to a low level to prohibit energization, and the electromagnetic spill valve 23 is opened.

As described above, in the present embodiment, the control circuit 80
In the CPU 81 and the CPU monitoring circuit 200, which are included in the
When the CPU 81 determines that the CPU 81 is abnormal, the electromagnetic spill valve 23 is forcibly opened to prohibit fuel injection into the diesel engine 2 and stop the diesel engine 2, and at the same time notify the vehicle driver. Further, when the CPU 81 determines the abnormality of the CPU monitoring circuit 200, not only the vehicle driver is informed of that, but also the abnormality control circuit 300
When the rotation speed of the diesel engine 2 exceeds a predetermined upper limit speed after that, the electromagnetic spill valve 23 is forcibly opened and fuel injection into the diesel engine 2 is prohibited. The rotation speed of the engine 2 is limited to the upper limit speed or less.

Therefore, according to this embodiment, the CPU 81
Alternatively, when the CPU monitoring circuit 200 malfunctions,
Not only can the operation of the diesel engine 2 be stopped or the vehicle driver can be notified of that fact, but also when a double failure occurs in which the CPU 81 malfunctions when the CPU monitoring circuit 200 malfunctions, an output from the control circuit It is possible to prevent an abnormal increase in the rotational speed of the diesel engine 2 due to the injection of a large amount of fuel into the diesel engine 2 due to the incorrect control signal. Therefore, the traveling safety of the vehicle equipped with the diesel engine 2 can be improved.

Further, particularly in the present embodiment, the upper limit speed for limiting the rotation speed of the diesel engine 2 after the abnormality determination of the CPU monitoring circuit 200 is controlled by the resistor R3 and the transistor TR2 serving as a switching circuit to idle the diesel engine 2. The operating speed and the load operation are switched to each other, and the rotational speed of the diesel engine 2 is limited so that the diesel engine 2 operates at a lower speed than the load operation during the idle operation. For this reason, according to the present embodiment, the rotational speed of the diesel engine 2 becomes abnormally high during idle operation, which causes large noise, or conversely, the diesel engine 2
It is possible to operate the diesel engine 2 better and prevent the diesel engine 2 from stalling because the rotational speed is restricted too much during the load operation of the vehicle, and it is possible to further improve the running safety of the vehicle. become.

Here, in the above embodiment, the CPU 81 executes C
Once the abnormality of the PU monitoring circuit 200 is determined,
The AND circuit 2 is output according to the output from the abnormal time control circuit 300.
The output of 02 is limited so as to prevent the rotational speed of the diesel engine 2 from exceeding a predetermined upper limit speed. For example, as shown in FIG. The rotational speed of the diesel engine 2 may be prevented from exceeding the upper limit speed by correcting the control signal output to the drive circuit 95 for controlling the intake air amount.

That is, in this embodiment, the intake air amount of the diesel engine 2 is set to the VSV 61, 62 and the actuator 6
The sub-throttle valve 60 is controlled by controlling the opening of the sub throttle valve 60 via the intake throttling mechanism 110 composed of three components.
If high level control signals are output to the drive circuit 95 as control signals for controlling 2 respectively, the sub throttle valve 60 can be fully opened.
By outputting low-level control signals to 5 respectively, the sub-throttle valve 60 can be fully closed, and the drive circuit 95 can be supplied with a control signal in which one is at high level and the other is at low level. For example, the sub throttle valve 60
Can be in a half-open state. And the CPU 81
Outputs a pair of low and high control signals from the output port 86 to reduce the noise and vibration during the idle operation of the diesel engine 2 to control the sub-throttle valve 60 to a half-opened state, thereby reducing the normal load. During operation, the sub-throttle valve 60 is controlled to be fully open by outputting a control signal from the output port 86, both of which are at high level.

Therefore, as shown in FIG. 4, the output port 86
From the drive circuit 95 to the drive circuit 95, two signal lines for controlling the sub-throttle valve 60 are provided with three-input AND circuits 210 and 212, respectively.
12, the pair of control signals output from the output port 86, the output signal from the abnormal time control circuit 300, and the CP
The output signal from the U monitoring circuit 200 is configured to be input respectively.

In this way, the CPU 81 causes the CP
Once the abnormality of the U monitoring circuit 200 is determined, thereafter,
Until the latch circuit 302 is reset, a low level signal is input from the abnormal time control circuit 300 to the AND circuits 210 and 212 each time the rotation speed of the diesel engine 2 exceeds the upper limit speed. The output of each AND circuit 210, 212 always becomes Low level without being affected by other input signals, and the sub throttle valve 6
0 will be controlled to a fully closed state.

Therefore, the CPU monitoring circuit 200 and the CPU 8
Even if a double failure occurs in 1 and 2, the intake air amount to the sub-throttle valve 60 and thus the diesel engine 2 can be limited so that the rotation speed of the diesel engine 2 becomes equal to or lower than the upper limit speed. It is possible to safely drive the diesel engine 2, and thus the vehicle, by preventing the rotational speed of the engine from abnormally increasing.

Further, with the above configuration, even when the CPU monitoring circuit 200 determines that the CPU 81 is abnormal,
Since a low level signal is input to the AND circuits 210 and 212 and the sub-throttle valve 60 is controlled to the fully closed state, the intake air amount can be suppressed also in this case. Then, similarly to the conventional device shown in FIG. 5, if the input of the control signal to the constant current drive circuit 96 via the AND circuit 202 is restricted by the output from the CPU monitoring circuit 200, the CPU monitoring circuit When 200 determines the abnormality of the CPU 81, not only the fuel injection to the diesel engine 2 can be prohibited but also the intake air amount to the diesel engine 2 can be suppressed, so that the operation of the diesel engine 2 can be stopped more smoothly. Will be able to.

Although the embodiments in which the fail-safe device of the present invention is applied to a diesel engine system for automobiles have been described above, the present invention is not limited to these embodiments and can take various forms. it can. That is, the present invention can be applied to the control system for controlling the fuel injection amount, the ignition timing, etc. of the gasoline engine in the same manner as in the above-mentioned embodiment to obtain the same effect. Any control device other than the above can be applied as long as the control amount of the controlled object is calculated and controlled by the control circuit including the CPU.

Further, in the above embodiment, the electronic control device provided with the CPU 81 and the CPU monitoring circuit 200 for monitoring the abnormality thereof has been described.
By providing two monitoring circuits each and complementing each other's operation between the two CPUs, and monitoring the operation of each CPU by the CPU monitoring device, the reliability of the control device is further enhanced and abnormalities are detected. Even in the case of a device that also secures the safety of time (for example, the device disclosed in Japanese Patent Laid-Open No. 3-70837), if the present invention is applied, when the CPU monitoring circuit is abnormal, the CPU is abnormal. The safety when it occurs can be further enhanced.

[Brief description of the drawings]

FIG. 1 is an explanatory diagram showing in detail a configuration of a portion related to a CPU monitoring circuit and an abnormal time control circuit which constitute a fail-safe device in an embodiment.

FIG. 2 is a schematic configuration diagram showing a configuration of an automobile diesel engine system of an embodiment.

FIG. 3 is a block diagram illustrating an internal configuration of an electronic control device according to an embodiment.

FIG. 4 is an explanatory diagram showing another configuration example of the fail-safe device of the embodiment.

FIG. 5 is an explanatory diagram showing a configuration of a conventional fail-safe device.

[Explanation of symbols]

1 ... Distribution type fuel injection pump 2 ... Diesel engine
23 ... Electromagnetic spill valve 60 ... Sub throttle valve 61, 62 ... VSV 63 ... Actuator 71 ... Electronic control device (EC
U) 80 ... Control circuit 81 ... CPU 82 ... ROM 83 ... RAM 8
5 ... Input port 86 ... Output port 87 ... Bus 93 ... Input buffer 94 ... Waveform shaping circuit 95 ... Drive circuit 96 ... Constant current drive circuit 98 ... Idle switch 101 ... Warning lamp 1
10 ... Intake throttle mechanism 200 ... CPU monitoring circuit 202, 210, 212 ...
AND circuit 204 ... OR circuit 300 ... Abnormality control circuit 30
2 ... Latch circuit 304 ... Comparator 306 ... F / V conversion circuit R1, R2, R3 ... Resistor TR1, TR2 ... Transistor

Claims (3)

[Claims] 1. A control circuit comprising a CPU, which calculates a control amount of the controlled object based on a detection signal representing an operating state of the controlled object, and generates a control signal according to the operation result.
According to a control signal from the control circuit, a drive circuit for driving and controlling the controlled object, and provided in an electronic control device, and monitors the abnormality of the control circuit by a monitoring circuit,
The control circuit monitors the monitoring circuit for an abnormality, and when the monitoring circuit determines an abnormality in the control circuit, the control circuit shuts off the input of a control signal from the control circuit to the control circuit. A fail-safe device that operates a target on the safe side and, when the control circuit determines an abnormality of the monitoring circuit, performs a predetermined fail-safe process for operating the control target on the safe side by the operation of the CPU. In the above, when the control circuit determines an abnormality of the monitoring circuit and outputs an abnormality determination signal indicating that, a latch circuit for latching the signal is provided, and the latch circuit latches the abnormality determination signal. The control signal at the time of abnormality is limited based on the detection signal so as to prevent the control target from being over-controlled when the control signal is input to the drive circuit. A fail-safe device for an electronic control device, which is provided with a path. 2. The electronic control device is a control device for an internal combustion engine for controlling an internal combustion engine, and the abnormal time control circuit comprises:
The control signal for controlling the fuel supply amount or the intake air amount to the internal combustion engine is limited so that the rotation speed of the internal combustion engine does not exceed a predetermined upper limit speed. Fail-safe device for electronic control unit. 3. The upper limit speed of the abnormal-time control circuit is set to be smaller during idle operation of the internal combustion engine where the driver does not operate the accelerator than during load operation of the internal combustion engine where the driver operates the accelerator. The fail safe device for an electronic control device according to claim 2, further comprising: an upper limit speed switching circuit that switches the upper limit speed according to an operating state of the internal combustion engine.