SE464788B - Method and device for monitoring computer-controlled position elements - Google Patents

Abstract

Monitoring of position elements has to date been carried out using acoustic or optical sensors, but this method alone has proved to be insufficient in the case of computer-controlled position elements, particularly for security devices. To obtain quicker, more reliable and principally automated monitoring in the case of computer- controlled position elements 12 both the output of the computer 10 and the position output of the position element are monitored. On the basis of the signal samples received, particular interference situations can be ascertained. Thereafter correction or indication of the interference situation can take place. <IMAGE>

Description

464 788 2 len. a failure of this safety device in a dangerous situation can lead to the driver not mastering the situation unfamiliar to him or her and causing an accident.

An example of the need to safely prevent incorrect ejaculations in safety systems is the inflatable gas cushions. If this safety device is suddenly activated at high speeds without any objective reason for it. this can give rise to significant consequential damage as a result of reduced visibility or by frightening the driver.

If the malfunction of these safety devices is monitored and indicated in the usual way. an employee would need to intervene within a fraction of a second and even take appropriate countermeasures based on certain decisive criteria. However, this cannot be mastered and there is a risk that the usefulness of such safety devices in the event of disturbances will be reversed. Also for other computer-controlled adjusting elements, which are not safety-relevant. eg machine tools, disturbances can cause significant damage when a corrective action is taken too late, when standard monitoring methods and devices are used.

DE-A-3 531 901 relates to a method and a switching device for monitoring data-controlled switching elements. consisting of a control computer and at least one of its controlled electrical control elements, wherein only at certain times the computer outputs output and signal samples are logically combined into a binary control signal at the outputs of a data output unit, this control signal being read out by the computer and compared with a predetermined setpoint.

The invention is based on the task of improving a method for monitoring computer-controlled switching elements in such a way that deviations from setpoints occurring can be determined as early as possible. This task is solved by a method for monitoring computer-controlled adjusting elements according to the preamble of claim 1 by the special measures specified in the characterizing part.

As a result of the method according to the invention, it becomes possible as a result of the continuous comparison of signal samples with setpoints to detect disturbances very early.

This constitutes a prerequisite for a fairly early indication of the disturbance or possibly a fairly early remedy, for example through own program corrections or through the introduction of spare rack elements. By taking signal samples from two outputs, the reliability with respect to determination is thereby also improved. that one can distinguish between different disturbances and thus have the disturbance indicated or eliminated.

As a result of reliable determination of disturbances, automatic correction or elimination is also possible, insofar as this can be carried out with regard to the calculation program and the connection technical effort. If this applies to disturbances in the computer program. “Caused by unexpected external effects. this correction can also take place without indication. so that the user does not notice this.

If automatic correction or cure is not possible but only indicates the disturbances, the diagnosis of the disturbances is facilitated as a result of the method according to the invention, so that the repair time and the possible material input are reduced.

According to a further development of the procedure according to the invention, the evaluation coupling is also continuously supplied with the setpoints of the control computer.

In this way, several phases in the computer's data processing can be monitored, so that errors that have occurred in certain circumstances can be determined and corrected at an earlier stage. As a result of the automated correction and the possibility of a cure, the possibility of having a computer-controlled control element monitored according to the invention is further increased as a result of further development. 464 788 4 40 According to a procedure applied in practice, the switching signal is generated. the first time deviation occurs between the signal samples taken from the computer output and the setpoint, of a reset signal fed to a control input on the computer. .

Non-recurring interference can, for example, be caused by radio systems,. electrical discharges or switching pulses on a wiring harness. If these lead to program errors, this can be easily remedied thereby. that the computer is reset and restarted. This also eliminates the disruption in the program process. The loss of time associated with this measure becomes all the more insignificant. the earlier the disturbance is determined.

According to a further development of the method according to the invention, the switching signal is formed in the event of multiple deviations between the signal samples taken from the output on the computer and the setpoint within a predetermined time period. of an alarm signal for activating a first signal transmitter.

Multiple and in particular successive such disturbances indicate an internal program error. whose removal is not possible by restoring the computer. Therefore, this disturbance situation is indicated. The user can then adjust to this and have the disturbance eliminated, for example by replacing an internal program memory. In the case of more complicated systems, the alarm signal could also be used to put an identical replacement computer into operation instead of the previous computer.

According to a procedure carried out in practice, the switching signal is formed in the event of a deviation between the signal samples taken from the positioning element of the positioning element and the setpoint of an alarm signal. which activates a second signal source.

Such a fault does not constitute a software fault (software) but a switching technical fault (hardware). In order to be able to better distinguish between these disturbances, additional signal transmitters are therefore activated. In addition, it is possible to - by means of the alarm signal - connect a replacement set element to I ~ to take other replacement measures.

I: 40 464 788 According to a further development of this measure, the switching signal is formed in the event of a deviation between the signal samples taken from the positioning element of the positioning element and the setpoint of an alarm signal. which activates another signal transmitter. Such a disturbance can indicate both a fault in the actuating element and a fault in the other coupling, for example in the voltage supply. As a result of an additional signal transmitter, this disturbance situation can be better distinguished from others.

As an additional development, in the event of a coincidence, the switching signal is formed between the signal sample taken from the setting element's output output and the setpoint in dependence on a signal sample taken from the computer output of an alarm signal which activates a third signal transmitter.

This disturbance indicates a fault in the actuating element, while other causes for this are practically excluded. As a result of this measure, faults of a general coupling technical nature can therefore be distinguished from those which are to be limited to the stand element itself. As a result of this measure, the possibility therefore arises of connecting a spare position element or, if such a thing does not exist, to facilitate later fault diagnosis and repair.

The alarm signals are preferably indicated optically and / or acoustically by means of at least one signal transmitter, which determines different meaning contents. As a result of these measures, immediate observation of the alarm signal is ensured and a decision is made with regard to whether the device still has limited functional capacity or not or where the fault can be found and eliminated during later repairs.

In a practically performed procedure, the signal samples taken from the positioning element of the positioning element are converted into a digital signal and further processed as such in the evaluation connection.

As a result of this procedure, the comparison between actual and setpoint is facilitated, especially in the case of very complicated signaling processes. This increases the reliability of the comparison results. 464 788 6 40 In a modified embodiment, lower and upper threshold values are determined by means of a threshold transducer, at which sub- and exceeding switching signals are first generated. f] As a result of this measure, triggers due to operational voltage variations, component tolerances or variations in properties due to aging, which would not yet affect safe operation, can be taken into account. This avoids alarm signals. which, with regard to the operability of the device from an objective point of view, are not yet necessary.

The invention further relates to a switching device for monitoring computer-controlled adjusting elements. in particular for safety devices in motor vehicles such as anti-lock brakes, airbags and seat belts, consisting of a control computer and at least one electronic control element controlled by it.

With this in mind, the invention is based on the task of developing a switching device for monitoring computer-controlled switching elements, which works quickly and reliably and enables as large an automated monitoring as possible.

This object is solved according to the invention by means of a coupling device according to the preamble of claim 11 by the measures specified in the characterizing part. As a result of the monitoring of the output on the computer and the switching output on the switching element, the parameters can be monitored both individually and in combination. In this way, the fault determination is extended to different types of fault. Depending on the type of disturbance, errors can be detected at a very early stage. The errors can then either be indicated or initiate correction and measures for elimination. Such measures may consist of correcting the computer program by restoring and restarting the computer or by connecting a replacement computer or IW replacement element. If only the fault is indicated, this facilitates later fault location and repair.

According to a further development of the switching device according to the invention, the setpoint sensor is controllable and connected to a j - data input or the output on the computer. 40,464,788 As a result of this arrangement, further and in particular current comparisons between setpoint and actual value can also be carried out. Thus, for example by means of the evaluation connection, the entire data processing in the computer can thus be controlled by this connection also being supplied with input data from the computer.

With a simpler design, it would be possible to check the computer's intermediate results. In a further simplified embodiment, the comparison between setpoint and actual value can be limited to control of so-called control signals, which occur at certain time intervals in a computer program. Occurring disturbances can then be determined already considerably before the actual false end result and corrected or brought to an indication.

The switching signal generator is preferably provided with at least two outputs for different switching signals.

The switching possibility arising from the monitoring of two outputs also takes into account the type of disturbances in the generation of determining different disturbances, suitable switching signals are used.

In a practical embodiment, an output of the signal generator is connected to a reset input of the computer. while other outputs are connected to the inputs on the acoustic and / or optical type signal transmitter.

If the fault consists of a single fault in the computer program, caused for example by electrical discharges. switching pulses on a wiring harness, or radio interference, this can be eliminated by resetting the computer and restarting.

Since this process proceeds very quickly and can be started especially early as a result of the measures according to the invention. no indication is required for this. An indication of other disturbances also makes no sense, when by connecting a replacement connection such as a replacement computer or a replacement rack element, the plant's operability is still maintained. In order to restore the original reliability, the defective components must be replaced as soon as possible. 464 788 a According to a further development of the invention, the evaluation circuit also comprises a counter for the switching pulses occurring at one output. While program malfunctions can be eliminated through external effects such as restoring and restarting the computer, internal program errors cannot be eliminated in this way. To distinguish them from other disturbances, a counter was used which counts the number of reset signals occurring during a given unit of time. If the number of reset signals is too high. this is interpreted as an internal program error, after which a special switching signal is generated.

The evaluation coupling preferably also comprises a threshold sensor for lower and / or upper threshold values. wherein this sensor is connected to the comparator.

Without these additional measures, even insignificant voltage variations would occur. component tolerances or aging-related property variations of the components lead to fault signaling. But when these deviations do not exceed a certain amount. they do not adversely affect the safe operation of the line. The proposed measures thus enable suppression of the generation of switching signals and associated alarm signals in the event of such deviations.

The evaluation connection is preferably designed as an additional control computer and there is an interface between the inputs on this computer on the one hand and the output on the first computer and the switching output on the switching element on the other hand. This design is particularly advantageous in systems with several computers, as different computers are still combined to solve a common task. Apart from saving space as a result of multiple use of existing computers, no special preparation of data is usually required either. since these are already in mutually readable form. 9 464 788 Optionally, the interfaces are designed as impedance converters or as digital-to-analog converters. With these measures, relaxation of the evaluation connection from the computer and the control element is obtained, so that possible disturbances due to the monitoring itself are avoided. It is expedient to design the interface as a digital-to-analog converter. when, in addition to monitoring digital quantities from the control element, analogues must also be monitored. This is the case, for example. when an actuating element dimensioned as the switch shows disturbances which are within values between the switched-on and disconnected states of the switch.

The invention is described in more detail below in exemplary form with reference to the accompanying drawing. there fig. 1 shows a switching device for monitoring computer-controlled switching elements in the form of a block diagram and fig. 2 graphically shows different signal forms and disturbances derived from them.

I fig. 1 shows a control computer 10 and a control element 12. the operation of which is monitored by an evaluation switch 20. The computer receives via its data input 46 data which it evaluates, after which it emits control signals which are transmitted via its output 28 to the control element 12. The element 12 emits in turn, place order via its position output 30 to a load 14. The load 14 can in this case be intended for a motor vehicle by the ignition device of gas cartridges for inflatable gas cushions at a safety device.

To check the operation of the computer 10 and the actuating element 12, signal samples are taken from the output 28 of the computer 10 and from the actuating output 30 of the actuating element 12. which are supplied with evaluation inputs 16 and 18 on the coupling 20. The dimensions from the computer 10 and from the adjusting element 12 can in this case be adapted to the quantities treated by the coupling 20 by means of interfaces 56 and 58, which depending on the required signal adaptation are designed as impedance converters or as digital-to-analog converters. The switch 20 comprises a setpoint sensor 22, a comparator 24, a switching signal generator 26 and, as a suitable supplement, a counter 52 and a threshold value sensor 54.

In this case, the threshold value sensor 22 can be designed as a fixed or as a controllable sensor. To illustrate the second option, dashed control lines are shown. one of which is connected to the data input 46 of the computer 10. one is connected to a data output 48 and another is connected to the output 28 of the computer 10.

If the setpoints are taken from the data input 46, the sensor 22 could be constructed in the same way as the computer 10 and thus imitate the entire program sequence. A simpler embodiment of the sensor 22 is possible. when via the computer's data output 48 intermediate results are used as a setpoint. Even more simply, the setpoint sensor can be constructed when only control signals at the output 28 of the computer 10 are evaluated and compared with the combined data signal or with a previous or subsequent one.

The comparator 24 compares the setpoints generated by the setpoint sensor 22 with the signal samples. which is supplied to it via inputs 16 and 18. In this case, both comparisons between the individual signal samples and the setpoints are possible and comparisons between combined signal samples and setpoints. The comparison of the combined signal samples. which was previously added to the addition site 64. takes place at an addition site designated 66.

The preparation of the addition sites serves solely for explanation. In a practical embodiment, there can also be only a single addition site. which switches according to the principle l \ for time multiplex. Alternatively, the comparison circuit 24 as well as the other function blocks 22. 26, 52, 54 may be formed by a control computer with the corresponding calculation program.

The switching signal generator 26 is connected to the comparator 24. which is provided with a number corresponding to the number of possible disturbance situations 464 788 ll down inputs and outputs 32, 34, 36 and 38.

The output 32 of the generator 26 is connected to a reset input 50 of the computer 10. while the other outputs are connected to optical and / or acoustic signal transducers 40, 42, 44.

To count the reset signals occurring at output 32, a counter 52 is used, which is connected to an input of generator 26 and acts on output 38. Finally, there is also the threshold sensor 54, which generates upper and lower threshold values. which are supplied with additional addition points 68 and 70 for suppressing switching signal generation when certain threshold values are exceeded or exceeded.

The mode of action of the coupling will now be explained on the basis of several assumed disturbance situations. From the beginning, it is assumed that a program error has occurred as a result of a switching fault. The setpoint sensor 22 now generates a signal at a certain time. which, however, is absent at the output 28 of the counter 10.

The sensor 22 then emits a signal to the addition point 60 of the comparator 24, while no signal is emitted from the evaluation input 16. The comparator 24 thus determines a deviation. which is transmitted to the signal generator 26 and causes it to transmit via its output 32 a reset signal to the reset input 50 of the computer 10. The computer 10 is then reset and restarts and the program error is eliminated.

But if it is about such a program error. which would have arisen by changing the storage contents in an internal memory, the same process as described previously occurs at the beginning. After the computer 10 is restarted by resetting via the input 50, the same disturbance reappears. which consequently leads to renewed recovery. The individual reset signals are now counted by the counter 52 and the signal sensor 44 is activated when a maximum value is reached within a predetermined time period. In this case, the system could either be disconnected or a replacement computer could be connected. 464 788 12 As a further disturbance, a voltage change or an interruption at the actuating element 12 is assumed. The signal sample taken from the actuating output 30 on the actuating element is transmitted via the evaluation input 18 to the addition point 62 and compared m; with a setpoint fed from the sensor 22. Since the signal sample deviates from this setpoint, the signal generator 26 is caused by the comparator 24 to activate the signal sensor 42 via its output 36. This now indicates a general switching error.

However, if the deviation of the operating voltage is below a certain threshold value. disturbance of the signal generator 26 is suppressed by the addition point 68 in connection with the threshold value supplied from the sensor 54.

Finally, as a fourth disturbance, a change in the transmission properties of the actuating element is assumed. For an output signal at the output 28 of the computer 10, the output signal at the output of the actuator 12 does not change or does not change sufficiently. The signal samples at the two outputs 28 and 30 are transferred to the evaluation inputs 16 and 18 on the connection 20. Here, a comparison of the two signals takes place at the beginning of the addition point 64. A deviation between the signals is fed from here to the addition point 66, where it is compared with a setpoint generated from the sensor 22. In the event of a deviation, the generator 21 is now caused to activate the signal transmitter 40 via its output. If the deviation is less than a threshold value. so that one can still speak of conformity (coincidence), by means of the addition site 70 in conjunction with the sensor 54 control of the signal generator 26 is suppressed.

Since, when comparing the two outputs 28 and 30, a disturbance can be reduced to the actuating element 12., it would be possible) C in connection with the switching signal at the output 34, which here activates the signal sensor 40, also to connect a t; intended as a replacement set element.

Fig. 2 shows graphically the described disturbances, each time to the left the signals appearing at the output 28 of the computer 10 and to the right of this the signals appearing at the output 30 1: 464 788 of the actuating element 12. Fig. 2a first illustrates interference-free operation. during which the signal at the output 28 of the counter 10 appears at the intended time and the signal at the output 30 of the actuating element 12 then follows.

Two signal cycles are displayed each time.

Fig. 2b shows the signal sequence in the event of a program disturbance caused by external effects. The signal expected at a predetermined time at the output 28 of the computer 10 is absent. but occurs after resetting the computer 10 during the next cycle at the correct time.

Fig.2c shows the case of an internal program malfunction. At the predetermined time, no signal appears at the output 28 of the computer.

Fig. 2d illustrates a stationary disturbance at the outlet 30 of the actuating element 12.

Finally, Fig. Ze also illustrates the signaling process at the outputs 28 and 30. which would occur in the event of a disturbance of the transmission characteristics of the actuating element 12.

As a reference to the switching signals triggered as a result of these disturbances, in each case, in addition to the diagrams, the outputs activated on the signal generator 26 in the event of these disturbances are also indicated.

Claims (19)

nu: v44 464 788 10 15 20 25 30 35 14 Patent claim 1. l. Ways to monitor computer-controlled control elements. in particular for safety devices in motor vehicles, eg brake lock protection, airbags or seat belts, consisting of a control computer and at least one of these controlled electronic control elements, characterized in that signal samples are taken both from the computer output and from the control output on the control element and a common output is applied and are continuously compared with setpoints and that switching signals are generated in the event of a deviation between the signal samples and the setpoints and are supplied to the computer and / or a signal transmitter. 2. A method according to claim 1, in which hearing values from the computer are also continuously supplied to the evaluation circuit. 3. A method according to claim 1 or 2, characterized in that the switching signal, the first time a deviation occurs between the signal samples taken from the computer output and the setpoint,. is formed by a reset signal fed to a control input on the computer. 4. A method according to claim 1 or 2, characterized in that the switching signal in the event of multiple deviations between the signal samples taken from the computer output and the setpoint within a predetermined time period is formed by an alarm signal. which activates a first signal transmitter. 5. A method according to claim 1 or 2, characterized in that the switching signal in the event of a deviation between the signal samples taken from the switching element of the switching element and the setpoint is formed by an alarm signal. which activates an additional signal f) sensor. 6. A method according to claim 5, characterized in that the switching signal in the event of a constant deviation between those from the switchgear - 10 15 20 25 30 35 40 15. 464 788 the set output of the element the sampled signal samples and the setpoint are formed by an alarm signal. which activates a second signal sensor. 7. A method according to claim 5, characterized in that the switching signal in the event of a coincidental deviation between the signal sample taken from the switching element's output output and the setpoint, depending on a signal sample taken from the computer output, is formed by an alarm signal. which activates a third signal transmitter. A method according to any one of claims 1-7. characterized in that the alarm signals are indicated optically and / or acoustically by means of at least one signal transmitter, which determines different meaning contents. 9. A method according to any one of claims 1-8, characterized in that the signal sample taken from the positioning element of the positioning element is converted into a digital signal and as such is further processed in the evaluation connection. 10. A method according to claim 9, characterized in that lower and upper threshold values are determined by means of a threshold value sensor, at which under- or exceeded first switching signals are generated. 11. ll. Coupling device for monitoring computer-controlled adjusting elements, in particular for safety devices in motor vehicles, eg brake lock protection. airbags or seat belts. consisting of a control computer (10) and at least one electronic control element (12) controlled by it, characterized by an evaluation connection (20) provided with two evaluation inputs (16} 18). which includes a setpoint generator (22). a comparator (24) controllable by means of this sensor (22) and a switching signal generator (26) controlled by said inputs (16, 18), one switching input generator (26), one evaluation input (16) being connected to an output (28). ) on the computer and the second input (18) with a set output (30) on the set element (12) and outputs (32. 34, 36. 38) on the signal generator (26) are connected to the computer (10) and / or to at least one signal transmitter (40. 42. 44). 464 788 “10 15 20 25 30 35 Device according to claim 11, characterized in that the threshold sensor (22) is controllable and connected to a data input (46) or an output (48, 28) on the computer (10). Device according to claim 11 or 12, characterized in that the signal generator (26) has at least two outputs (32, 34, 36. 38) for different switching signals. Device according to claim 13, characterized in that one output of the generator (26) is connected to a reset input (50) on the computer (10) and other outputs (34, 36, 38) to the inputs of the signal transducer (40). 42. 44) for generating acoustic and / or optical signals. Device according to claim 14, characterized in that the evaluation switch (20) further comprises a counter (52) for switching signals fed to one output (32). Device according to any one of claims 11-15. characterized in that the evaluation coupling (20) further comprises a threshold sensor (54) for lower and upper threshold values. which is connected to the comparator (24). Device according to any one of claims 11-16. know that the evaluation connection forms an extra control computer (20). between each inputs (16. 18) on the one hand and the output (28) of the first computer (10) and the set output (30) of the actuating element (12) on the other hand interfaces (56, 58) are connected. Device according to claim 17, characterized in that the interfaces are designed as impedance converters (S6. 58). Device according to claim 17, characterized in that the interfaces are formed by digital-to-analog converters (56. S8). _! Deal