KR101662406B1 - Apparatus and method for detecting failure in ECU - Google Patents

Abstract

According to the present invention, an ECU (Engine Control Unit) redundancy system detects the failure of an ECU using a clock frequency of the ECU, and switches the governor control path to an ECU having the governor control right according to the detection result. According to the present invention, it is possible to switch the governor control path without delay by the ECU having the governor control right according to the detection result, and to judge the abnormality state of the ECU because the calculation or logic for determining the internal error of the ECU does not enter The load on the CPU can be reduced while reducing the time required for the ECU redundancy system, thereby improving the reliability and reliability of the ECU redundancy system.

Description

[0001] Apparatus and method for detecting failure in an engine controller [0002]

The present invention relates to an engine controller failure detecting apparatus and method, and more particularly, to an engine controller failure detecting apparatus and method for detecting failure of an ECU in an ECU (Engine Control Unit) redundant system.

In general, two or more ECUs are redundantly used in order to prepare for sudden failure or malfunction of ECU (Engine Control Unit).

The first ECU 11 and the second ECU 12 are separated from each other and the first ECU 11 is configured as a control module and the second ECU 12 is configured as a safety module safety module, and they are connected to each other via wires and communication lines to exchange data. The first and second ECUs 11 and 12 exchange data with each other and perform an operation state abnormality and data redundancy in real time.

When the first ECU 11 operates normally, the first ECU 11, which is a control module, controls the governor 30 to control the injection amount of the flown into the engine. On the other hand, when a failure or abnormality occurs in the first ECU 11, the second ECU 12, which is a safety module, acquires the governor control right and transmits a change over signal to the switch module 20, And controls the governor 30 by itself.

However, in such an ECU duplication system, there is a problem that the second ECU 12 has a subject to switch the control signal path of the switch module 20, but there is no subject to judge the failure of the second ECU 12. As a result, if the first ECU 11 and the second ECU 12 fail completely, there is a problem that the engine can not be continuously operated in the case of the medium speed engine for power generation.

Further, there is a problem that it takes a long time to determine the abnormal state of the ECU in accordance with the presence or absence of data transmission by communication. For example, when the first ECU 11 fails, the delay time of several ms is generated when the second ECU 12 determines the abnormal state of the first ECU 11. Improving the communication speed to solve this problem can reduce the time for determining the abnormal state of the ECU, but it may cause an increase in the load of the CPU.

Korean Patent Application No. 2010-0062146 (Korea Electronics and Telecommunications Research Institute) 2010. 6. 10. Patent Document 1 is an apparatus and method for duplicating an electronic control system in a vehicle. In Patent Document 1, The electronic control means in the standby state outputs a request message to the electronic control means in the active state to monitor whether or not the electronic control means is in the abnormal state, And switching to an electronic control means in an activated state upon detection of an abnormality is disclosed. Korean Patent Laid-Open No. 2001-0002085 (Hyundai Motor Company) 2001. 1. 5. Patent Document 2 is an analog / digital scanning apparatus for malfunction diagnosis of an electronic control unit. In Patent Document 2, An analog / digital converter that can directly convert analog data of a plurality of channels output from various sensors for detecting an engine state into digital data having a predetermined task time and a predetermined bit resolution to synchronize with the operation control data of the electronic control unit, A monitoring unit compares the data output from the electronic control unit with the data output from the analog / digital scanning device using the scanning device to grasp the malfunction of the electronic control unit.

SUMMARY OF THE INVENTION The present invention is directed to an ECU (Engine Control Unit) redundant system that detects whether an ECU malfunctions by using a clock frequency of an ECU and controls the governor control path The engine controller failure detection apparatus and method are provided.

According to an aspect of the present invention, there is provided an engine controller failure detecting apparatus including: a switching unit for transmitting a governor control signal transmitted from one of an engine control unit (ECU) and a second ECU to a governor; And a controller for detecting a failure of the first and second ECUs using a first clock frequency of the firstECU and a second clock frequency of the secondECU, signal to the switching unit.

The detecting unit may convert each of the first clock frequency and the second clock frequency into a voltage signal and compare the sum of the converted voltage signals with a reference voltage signal to detect the failure of the first and second ECUs have.

Wherein the detector transmits to the switching unit a switching signal for transferring a governor control signal transmitted from the first ECU to the governor when all of the first and second ECUs operate normally or only the second ECU fails, When the first ECU is faulty, the switching unit may transmit a switching signal for transferring the governor control signal transmitted from the second ECU to the governor.

The detecting unit may transmit a governor stop signal to the governor when all of the first ECU and the second ECU have failed.

Wherein the detector comprises: a first converter module converting the first clock frequency transmitted from the first ECU into a first voltage signal and outputting the first voltage signal; A second converter module for converting the second clock frequency transmitted from the second ECU into a second voltage signal and outputting the second voltage signal; An adder module that receives the first voltage signal and the second voltage signal as inputs and outputs a third voltage signal that is a sum of the first voltage signal and the second voltage signal; And a first comparator module receiving the first reference voltage signal and the third voltage signal as inputs and outputting a first switching signal to the switching unit based on the first reference voltage signal and the third voltage signal, Wherein the first comparator module outputs the first switching signal for allowing the governor control signal transmitted from the first ECU to be transmitted to the governor if the third voltage signal is greater than the first reference voltage signal, And outputting the first switching signal for allowing the governor control signal transmitted from the second ECU to be transmitted to the governor if the third voltage signal is smaller than the first reference voltage signal.

The capacity of the second converter module may be less than the capacity of the first converter module.

A second comparator module that receives the first reference voltage signal and the second voltage signal as inputs and outputs a governor stop signal to the governor if the second voltage signal is greater than the first reference voltage signal; And a third comparator module configured to receive a second reference voltage signal and the first voltage signal as input and output a second switching signal to the switching unit if the first voltage signal is greater than the second reference voltage signal , The second reference voltage signal is larger than the first reference voltage signal, and the second switching signal may transmit the governor control signal transmitted from the second ECU to the governor.

According to another aspect of the present invention, there is provided an engine controller failure detecting method for an engine controller failure detecting apparatus, the method including detecting a first clock frequency of a first ECU and a second clock frequency of a second ECU, Detecting whether the first ECU and the second ECU are faulty and generating a switching signal according to a detection result; And transmitting a governor control signal transmitted from one of the first ECU and the second ECU to the governor in accordance with the switching signal.

The failure detection step may include converting each of the first clock frequency and the second clock frequency into a voltage signal; And comparing the sum of the converted voltage signals with a reference voltage signal to detect a failure of the first and second ECUs.

The failure detection step may include generating a switching signal for transferring a governor control signal transmitted from the first ECU to the governor when all of the first and second ECUs operate normally or only the second ECU fails, ; And generating a switching signal for transferring the governor control signal transmitted from the second ECU to the governor when only the first ECU is out of order.

The failure detection step may further include transmitting a governor stop signal to the governor when all of the first ECU and the second ECU have failed.

The fault detection step may include: converting the first clock frequency transmitted from the first ECU into a first voltage signal and outputting the first voltage signal; Converting the second clock frequency transmitted from the second ECU to a second voltage signal and outputting the second voltage signal; Outputting a third voltage signal which is a sum of the first voltage signal and the second voltage signal; And outputting a first switching signal based on the first reference voltage signal and the third voltage signal when the third voltage signal is greater than the first reference voltage signal, The controller transmits a governor control signal transmitted from the first ECU to the governor when the third voltage signal is smaller than the first reference voltage signal, Conversion signal.

The capacity of the converter module used to convert the second clock frequency to the second voltage signal may be less than the capacity of the converter module used to convert the first clock frequency to the first voltage signal.

The fault detection step may include: outputting a governor stop signal to the governor if the second voltage signal is greater than the first reference voltage signal; And outputting a second switching signal if the first voltage signal is greater than a second reference voltage signal, wherein the second reference voltage signal is greater than the first reference voltage signal, May be a switching signal for transmitting the governor control signal transmitted from the second ECU to the governor.

According to the apparatus and method for detecting an abnormality of the engine controller according to the present invention, it is possible to detect whether or not the ECU is faulty by using the clock frequency of an engine control unit (ECU) The governor control path can be switched without delay.

In addition, because there is no calculation or logic for determining an internal error of the ECU, the time for determining the abnormal state of the ECU can be reduced and the load on the CPU can be reduced.

Accordingly, in configuring the ECU redundancy system, the delay time does not occur during switching due to the ECU failure, and the load on the CPU can be reduced, thereby improving the reliability and reliability of redundancy.

1 is a block diagram for explaining a conventional engine control duplication system.
2 is a block diagram for explaining an engine controller failure detecting apparatus according to a preferred embodiment of the present invention.
3 is a block diagram for explaining an example of the engine controller failure detecting apparatus shown in Fig. 2 in more detail.
4 is a block diagram for explaining another example of the engine controller failure detecting device shown in Fig. 2 in more detail.
5 is a flowchart illustrating an engine controller failure detection method according to a preferred embodiment of the present invention.
FIG. 6 is a flowchart for explaining an example of the failure detection step shown in FIG. 5 in more detail.
FIG. 7 is a flowchart for explaining another example of the failure detection step shown in FIG. 5 in more detail.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, preferred embodiments of an engine controller failure detecting apparatus and method according to the present invention will be described in detail with reference to the accompanying drawings.

First, an engine controller failure detecting apparatus according to a preferred embodiment of the present invention will be described with reference to FIG.

2 is a block diagram for explaining an engine controller failure detecting apparatus according to a preferred embodiment of the present invention.

Referring to FIG. 2, the engine controller failure detecting apparatus 100 according to the present invention detects the failure of the ECU using the clock frequency of the ECU in an ECU (Engine Control Unit) redundancy system, Thus, the governor control path is switched to the ECU having the governor control right.

The engine controller failure detecting apparatus 100 is connected to the first ECU 210 and the second ECU 220 and outputs a governor control signal transmitted from the first ECU 210 or the second ECU 220 to a governor 300).

That is, the engine controller failure detecting apparatus 100 detects the failure of the first ECU 210 and the second ECU 220 based on the first clock frequency transmitted from the first ECU 210 and the clock frequency transmitted from the second ECU 220, .

Then, the engine controller failure detecting apparatus 100 switches the signal transmission path through a change over signal generated according to the detection result. Here, the signal transmission path is a path for transmitting the governor control signal transmitted from one of the first ECU 210 and the second ECU 220 to the governor 300.

An example of an engine controller failure detecting apparatus according to a preferred embodiment of the present invention will now be described in detail with reference to FIG.

3 is a block diagram for explaining an example of the engine controller failure detecting apparatus shown in Fig. 2 in more detail.

Referring to FIG. 3, the engine controller failure detecting apparatus 100 includes a detecting unit and a switching unit 170.

The detection unit detects the failure of the first ECU 210 and the second ECU 220 using the first clock frequency of the first ECU 210 and the second clock frequency of the second ECU 220, And transfers the switching signal to the switching unit 170.

More specifically, the detecting unit converts each of the first clock frequency and the second clock frequency into a voltage signal. Here, the capacity of the frequency to voltage (F / V) converter module used to convert the second clock frequency to the second voltage signal is the capacity of the F / V converter module used to convert the first clock frequency to the first voltage signal ≪ / RTI > For example, if the capacity of the F / V converter module for converting the first clock frequency to the voltage signal is 5V, the capacity of the F / V converter module for converting the second clock frequency to the voltage signal is 2.5V ≪ / RTI > Hereinafter, it is assumed that the capacity of the F / V converter module for converting the first clock frequency to the voltage signal is '5V' and the capacity of the F / V converter module for converting the second clock frequency to the voltage signal is '2.5V' .

The detector may detect the failure of the first ECU 210 and the second ECU 220 by comparing the sum of the converted voltage signals with a preset reference voltage signal. The predetermined reference voltage signal is a reference value for determining whether the ECUs 210 and 220 fail or not, and may be varied depending on the capacity of the F / V converter module for converting the first clock frequency and the second clock frequency into voltage signals . Hereinafter, it is assumed that the preset reference voltage signal is '3V'.

For example, the detector compares the sum of the first voltage signal and the second voltage signal with a preset reference voltage signal to detect whether the first ECU 210 and the second ECU 220 are faulty, as shown in [Table 1] below.

The first ECU 210
The first voltage signal

The second ECU 220
The second voltage signal

Sum signal


Malfunction


5V

2.5V

7.5V

The first ECU 210 and the second ECU 220,
All normal operation status

5V

0

5V

Only the second ECU 220 is in a failure state

0

2.5V

2.5V

Only the first ECU 210 is in a failure state

0

0

0

The first ECU 210 and the second ECU 220,
All fault conditions

In addition, the detection unit may transmit the switching signal generated according to the detection result to the switching unit 170. [ For example, the detector compares the sum of the first voltage signal and the second voltage signal with a preset reference voltage signal as shown in [Table 2] below and generates a switching signal according to the detected result.

Sum signal

Reference voltage signal

Switching signal


7.5V


3V

The first ECU 210 has the governor control right

A switching signal for allowing the governor control signal transmitted from the first ECU 210 to be transmitted to the governor 300


5V


3V

The first ECU 210 has the governor control right

A switching signal for allowing the governor control signal transmitted from the first ECU 210 to be transmitted to the governor 300


2.5V


3V

The second ECU 220 has the governor control right

A switching signal for allowing the governor control signal transmitted from the second ECU 220 to be transmitted to the governor 300

0

3V

-

That is, when all of the first ECU 210 and the second ECU 220 operate normally or only the second ECU 220 fails, the detector transmits the governor control signal transmitted from the first ECU 210 to the governor 300 To the switching unit (170). In contrast, when only the first ECU 210 fails, the detector transmits a switching signal to the switching unit 170 to transfer the governor control signal transmitted from the second ECU 220 to the governor 300. At this time, if the first ECU 210 and the second ECU 220 are all failed, the detecting unit may transmit the governor stop signal to the governor 300. [

To this end, the detection unit may include a first converter module 110, a second converter module 120, an adder module 130, and a first comparator module 140.

The first converter module 110 converts the first clock frequency transmitted from the first ECU 210 into a first voltage signal and outputs the first voltage signal.

The second converter module 120 converts the second clock frequency transmitted from the second ECU 220 into a second voltage signal and outputs the second voltage signal. Here, the second converter module 120 may be an F / V converter module having a capacity smaller than that of the first converter module 110, as described above. For example, if the capacity of the first converter module 110 is '5V', the capacity of the second converter module 120 may be '2.5V', which is 1/2.

The adder module 130 receives the first voltage signal and the second voltage signal, and outputs a third voltage signal that is a sum of the first voltage signal and the second voltage signal.

The first comparator module 140 receives the first reference voltage signal and the third voltage signal and outputs the first switching signal to the switching unit 170 based on the first reference voltage signal and the third voltage signal. Here, the first reference voltage signal is a reference value for determining whether the ECUs 210 and 220 fail or not, and may be determined depending on the capacities of the converter modules 110 and 120 for converting the first clock frequency and the second clock frequency into voltage signals Can be varied. For example, the first reference voltage signal may be '3V'.

That is, if the third voltage signal is larger than the first reference voltage signal, the first comparator module 140 outputs a first switching signal for transferring the governor control signal transmitted from the first ECU 210 to the governor 300, (170). If the third voltage signal is smaller than the first reference voltage signal, the first comparator module 140 switches the first switching signal for transmitting the governor control signal transmitted from the second ECU 220 to the governor 300 And outputs the result to the unit 170.

The switching unit 170 transmits the governor control signal transmitted from one of the first ECU 210 and the second ECU 220 to the governor 300 according to the switching signal provided from the detecting unit.

Thus, by detecting the failure of the ECU by using the clock frequency of the ECU as the analog system, it is possible to switch the governor control path without delay by the ECU having the governor control right according to the detection result. In addition, because there is no calculation or logic for determining an internal error of the ECU, the time for determining the abnormal state of the ECU can be reduced and the load on the CPU can be reduced. Accordingly, in configuring the ECU redundancy system, the delay time does not occur during switching due to the ECU failure, and the load on the CPU can be reduced, thereby improving the reliability and reliability of redundancy.

Next, another example of the engine controller failure detecting apparatus according to the preferred embodiment of the present invention will be described in detail with reference to FIG.

4 is a block diagram for explaining another example of the engine controller failure detecting device shown in Fig. 2 in more detail.

Since the engine controller failure detecting apparatus 100 shown in Fig. 4 is substantially the same as the engine controller failure detecting apparatus 100 shown in Fig. 3, only the difference from the engine controller failure detecting apparatus 100 described above This will be described below.

Referring to FIG. 4, the detecting unit of the engine controller failure detecting apparatus 100 may further include a second comparator module 150 and a third comparator module 160.

The second comparator module 150 receives the first reference voltage signal and the second voltage signal, and outputs the governor stop signal to the governor 300 if the second voltage signal is greater than the first reference voltage signal.

The third comparator module 160 receives the second reference voltage signal and the first voltage signal and outputs the second switching signal to the switching unit 170 when the first voltage signal is larger than the second reference voltage signal . Here, the second reference voltage signal may be a reference value for determining whether the clock frequency of the first ECU 210 is abnormal, and may be variable according to the capacity of the first converter module 110 converting the first clock frequency into the voltage signal . For example, the second reference voltage signal may be '5V'. The second switching signal may be a switching signal for allowing the governor control signal transmitted from the second ECU 220 to be transmitted to the governor 300.

Generally, when the ECU malfunctions, the clock frequency is not output, or it is outputted as a square wave in a normal operation state, but it may be outputted as a triangle wave in an abnormal state. At this time, the output voltage signal of the F / V converter module is lower than the output voltage signal in the steady state when the output is a triangular wave. However, there may be a case where an abnormal operation occurs in which the ECU outputs a clock frequency higher than the clock frequency output in the normal operation state of the ECU.

When the second voltage signal converted from the second clock frequency of the second ECU 220 is larger than the first reference voltage signal, the engine controller failure detecting apparatus 100 according to the present invention, Even if the second ECU 220 determines that all of the second ECU 220 has failed and transmits the governor stop signal to the governor 300 so that the second ECU 220 outputs a clock frequency higher than the clock frequency outputted in the steady state, It is judged that an abnormal operation is performed, so that the stability and reliability of the ECU duplication system can be improved.

If the first voltage signal converted from the first clock frequency of the first ECU 210 is larger than the second reference voltage signal, the engine controller failure detecting apparatus 100 determines that the first ECU 210 has failed, Even if the first ECU 210 outputs a clock frequency higher than the clock frequency outputted in the steady state by switching the signal transmission path for transmitting the governor control signal transmitted from the governor 220 to the governor 300, 210 are judged to operate abnormally, so that the stability and reliability of the ECU duplication system can be improved.

A method of detecting an engine controller failure according to a preferred embodiment of the present invention will now be described with reference to FIG.

5 is a flowchart illustrating an engine controller failure detection method according to a preferred embodiment of the present invention.

5, the engine controller failure detection apparatus 100 detects the failure of the first ECU 210 and the second ECU 220 using the first clock frequency of the first ECU 210 and the second clock frequency of the second ECU 220, And generates a switching signal in accordance with the detection result (S110).

More specifically, the engine controller failure detecting apparatus 100 converts each of the first clock frequency and the second clock frequency into a voltage signal. Here, the capacity of the frequency to voltage (F / V) converter module used to convert the second clock frequency to the second voltage signal is the capacity of the F / V converter module used to convert the first clock frequency to the first voltage signal ≪ / RTI >

The engine controller failure detecting apparatus 100 can detect the failure of the first ECU 210 and the second ECU 220 by comparing the sum of the converted voltage signals with a preset reference voltage signal. The predetermined reference voltage signal is a reference value for determining whether the ECUs 210 and 220 fail or not, and may be varied depending on the capacity of the F / V converter module for converting the first clock frequency and the second clock frequency into voltage signals .

Further, the engine controller failure detecting apparatus 100 can generate the switching signal in accordance with the detection result. That is, when all of the first ECU 210 and the second ECU 220 operate normally or only the second ECU 220 fails, the engine controller failure detecting apparatus 100 outputs the governor control signal transmitted from the first ECU 210 And transmits a switching signal to be transmitted to the governor 300 to the switching unit 170. If only the first ECU 210 fails, the engine controller failure detecting apparatus 100 transmits a switching signal for causing the governor control signal transmitted from the second ECU 220 to be transmitted to the governor 300 to the switching unit 170 do. At this time, if the first ECU 210 and the second ECU 220 are all failed, the engine controller failure detecting apparatus 100 may transmit a governor stop signal to the governor 300. [

Then, the engine controller failure detecting apparatus 100 transmits the governor control signal transmitted from one of the first ECU 210 and the second ECU 220 to the governor 300 according to the switching signal (S130).

An example of the failure detection step according to the preferred embodiment of the present invention will now be described in more detail with reference to FIG.

FIG. 6 is a flowchart for explaining an example of the failure detection step shown in FIG. 5 in more detail.

Referring to FIG. 6, the engine controller failure detecting apparatus 100 converts a first clock frequency to a first voltage signal (S111). Then, the engine controller failure detecting apparatus 100 converts the second clock signal to the second voltage signal (S112).

Then, the engine controller failure detecting apparatus 100 outputs a third voltage signal which is a sum of the first voltage signal and the second voltage signal (S113).

If the third voltage signal is greater than the first reference voltage signal (S114-Y), the engine controller failure detecting apparatus 100 switches the governor control signal transmitted from the first ECU 210 to the governor 300 (S115). Here, the first reference voltage signal is a reference value for determining whether the ECUs 210 and 220 are malfunctioning. The first reference voltage signal may vary depending on the capacities of the F / V converter modules for converting the first clock frequency and the second clock frequency into voltage signals .

On the other hand, if the third voltage signal is smaller than the first reference voltage signal (S114-N), the engine controller failure detecting apparatus 100 causes the governor control signal transmitted from the second ECU 220 to be transmitted to the governor 300 And generates a switching signal (S116).

Thus, by detecting the failure of the ECU by using the clock frequency of the ECU in analog form, it is possible to switch the governor control path without delay by an ECU having the governor control right according to the detection result. In addition, because there is no calculation or logic for determining an internal error of the ECU, the time for determining the abnormal state of the ECU can be reduced and the load on the CPU can be reduced. Accordingly, in configuring the ECU redundancy system, the delay time does not occur during switching due to the ECU failure, and the load on the CPU can be reduced, thereby improving the reliability and reliability of redundancy.

Hereinafter, another example of the failure detection step according to the preferred embodiment of the present invention will be described in more detail with reference to FIG.

FIG. 7 is a flowchart for explaining another example of the failure detection step shown in FIG. 5 in more detail.

Since the failure detection step shown in FIG. 7 is substantially the same as the failure detection step shown in FIG. 6, only the difference from the failure detection step described above will be described below.

Referring to FIG. 7, if the first voltage signal is greater than the second reference voltage signal (S117-Y), the engine controller failure detecting apparatus 100 transmits the governor control signal transmitted from the second ECU 220 to the governor 300 (Step S118). Here, the second reference voltage signal is a reference value for determining whether the clock frequency of the first ECU 210 is abnormal, and may be variable according to the capacity of the F / V converter module for converting the first clock frequency into the voltage signal.

If the second voltage signal is larger than the first reference voltage signal (S119-Y), the engine controller failure detecting apparatus 100 may output the governor stop signal to the governor 300 (S120).

If the second voltage signal converted from the second clock frequency of the second ECU 220 is larger than the first reference voltage signal, it is determined that the first ECU 210 and the second ECU 220 have all failed, It is determined that the second ECU 220 performs an abnormal operation even when the second ECU 220 outputs a clock frequency higher than the clock frequency outputted in the steady state, Reliability can be improved.

If the first voltage signal converted from the first clock frequency of the first ECU 210 is larger than the second reference voltage signal, it is determined that the first ECU 210 has failed, and the governor control signal transmitted from the second ECU 220 It is determined that the first ECU 210 performs an abnormal operation even when the first ECU 210 outputs a clock frequency higher than the clock frequency outputted in the steady state by switching the signal transmission path for transmitting the clock frequency to the governor 300 The reliability and reliability of the ECU duplication system can be improved.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, but, on the contrary, It will be understood by those skilled in the art that various changes may be made and equivalents may be substituted without departing from the scope of the appended claims.

100: engine controller failure detecting device, 110: first converter module,
120: second converter module, 130: adder module,
140: first comparator module, 150: second comparator module,
160: third comparator module, 170: switching section,
210, 220: ECU, 300: governor

Claims (14)

A switching unit for transferring a governor control signal transmitted from one of a first ECU (Engine Control Unit) and a second ECU to a governor; And
A first clock frequency of the first ECU and a second clock frequency of the second ECU are converted into a voltage signal and the sum of the converted voltage signals and the reference voltage signal are compared with each other, A detector for detecting a failure and transmitting a change over signal generated according to a detection result to the switching unit;
And an engine controller failure detection device. delete The method of claim 1,
Wherein the detector transmits to the switching unit a switching signal for transferring a governor control signal transmitted from the first ECU to the governor when all of the first and second ECUs operate normally or only the second ECU fails, And transmits a switching signal to the governor to forward the governor control signal transmitted from the second ECU to the switching unit when only the first ECU fails. 4. The method of claim 3,
Wherein the detector transmits a governor stop signal to the governor when all of the first ECU and the second ECU fail. The method of claim 1,
Wherein:
A first converter module for converting the first clock frequency transmitted from the first ECU into a first voltage signal and outputting the first voltage signal;
A second converter module for converting the second clock frequency transmitted from the second ECU into a second voltage signal and outputting the second voltage signal;
An adder module that receives the first voltage signal and the second voltage signal as inputs and outputs a third voltage signal that is a sum of the first voltage signal and the second voltage signal; And
A first comparator module receiving the first reference voltage signal and the third voltage signal as inputs and outputting a first switching signal to the switching unit based on the first reference voltage signal and the third voltage signal;
/ RTI >
The first comparator module outputs the first switching signal for allowing the governor control signal transmitted from the first ECU to be transmitted to the governor if the third voltage signal is greater than the first reference voltage signal, And outputs the first switching signal for allowing the governor control signal transmitted from the second ECU to be transmitted to the governor if the third voltage signal is smaller than the first reference voltage signal. The method of claim 5,
Wherein the capacity of the second converter module is smaller than the capacity of the first converter module. The method of claim 5,
Wherein:
A second comparator module which receives the first reference voltage signal and the second voltage signal as inputs and outputs a governor stop signal to the governor if the second voltage signal is larger than the first reference voltage signal; And
A third comparator module which receives the second reference voltage signal and the first voltage signal as inputs and outputs a second switching signal to the switching unit when the first voltage signal is larger than the second reference voltage signal;
Further comprising:
Wherein the second reference voltage signal is greater than the first reference voltage signal,
Wherein the second switching signal is a switching signal for transferring the governor control signal transmitted from the second ECU to the governor. A method for detecting an engine controller failure in an engine controller failure detecting apparatus,
The first and second ECUs are connected to the first and second ECUs. The first and second ECUs are connected to each other. Generating a switching signal according to a detection result; And
Transmitting a governor control signal transmitted from one of the first ECU and the second ECU to the governor according to the switching signal;
And an engine controller failure detection method. delete 9. The method of claim 8,
Wherein the failure detection step comprises:
Generating a switching signal for transferring a governor control signal transmitted from the first ECU to the governor when all of the first and second ECUs operate normally or only the second ECU fails; And
Generating a switching signal to forward the governor control signal transmitted from the second ECU to the governor when only the first ECU fails;
And an engine controller failure detection method. 11. The method of claim 10,
Wherein the failure detection step further includes forwarding a governor stop signal to the governor when all of the first ECU and the second ECU have failed. 9. The method of claim 8,
Wherein the failure detection step comprises:
Converting the first clock frequency transmitted from the first ECU into a first voltage signal and outputting the first voltage signal;
Converting the second clock frequency transmitted from the second ECU to a second voltage signal and outputting the second voltage signal;
Outputting a third voltage signal which is a sum of the first voltage signal and the second voltage signal; And
Outputting a first switching signal based on the first reference voltage signal and the third voltage signal;
/ RTI >
Wherein the first switching signal is a switching signal for causing the governor control signal transmitted from the first ECU to be transmitted to the governor if the third voltage signal is greater than the first reference voltage signal, Wherein the control signal is a switching signal for transmitting a governor control signal transmitted from the second ECU to the governor if the reference signal is smaller than the reference voltage signal. The method of claim 12,
Wherein the capacity of the converter module used to convert the second clock frequency to the second voltage signal is less than the capacity of the converter module used to convert the first clock frequency to the first voltage signal . The method of claim 12,
Wherein the failure detection step comprises:
Outputting a governor stop signal to the governor if the second voltage signal is greater than the first reference voltage signal; And
Outputting a second switching signal if the first voltage signal is greater than a second reference voltage signal;
Further comprising:
Wherein the second reference voltage signal is greater than the first reference voltage signal,
Wherein the second switching signal is a switching signal for transferring the governor control signal transmitted from the second ECU to the governor.

Images