EP1740815B1 - Electronic control device and method for controlling the operation of motor vehicle components - Google Patents

Description

The present invention relates to a control device and a method for controlling the operation of motor vehicle components, in particular an internal combustion engine or a transmission of a motor vehicle, according to the preamble of claim 1 or 8.

Such control devices and control methods are known per se ( DE 40 04 427 A1 . DE 42 31 432 A1 . DE 44 38 714 A1 . DE 3728 561 A1 ) and are in this case realized by a commonly referred to as "control unit" electronic module in which diverse control and / or monitoring functions for electronic or electrical components are summarized. The steadily increasing requirements in the past regarding the functionalities of such control devices have meant that the desired functions are nowadays largely implemented by using a microcontroller. The term "microcontroller" here refers to an electronic program-controlled control device, which typically, like a PC, has a CPU, a RAM, a ROM and I / O ports, but, unlike a PC, is designed for a very specific application.

The components to be controlled by the control device can be components that are directly attributable to the internal combustion engine, such as a fuel pump, a throttle valve, a fuel injector or a lambda probe, and also other components of the vehicle. On the input side, the control device is required for control Sensor signals or measured variables entered, z. B. relating to the crankshaft rotational speed and position, the engine temperature, the intake air temperature and quantity, the accelerator pedal position, etc. This list of the components to be controlled or sensed is by no means exhaustive and serves only to illustrate the variety of conceivable functions of a control device.

Since a microcontroller or its I / O ports are technologically not usually suitable for direct control of vehicle components of interest here, these components are usually controlled by associated amplifiers, which receive on the input side corresponding control signals of the microcontroller and the output side for activation and deactivation provide the components required voltages or currents, for example, the charging and discharging of a piezaketätigten fuel injection valve. In particular, with regard to the safety-critical functions, the power amplifiers are usually supplied in addition to the control signals and a digital, so-called enable signal, by means of which depending on the enable signal state, a blocking or release of the activation is signaled. This independent of the actual control of the power amplifier release is given by a release control, which is integrated in known control devices in a monitoring device which monitors the proper operation of the microcontroller to take appropriate measures in case of failure, for example, reset the microcontroller (Reset ) and / or set one or more enable signals to the first enable signal state with which each associated power amplifier is disabled.

Such a monitoring device, often referred to as a "watchdog", can in this case be integrated in the microcontroller or arranged separately from it. The function of such a monitoring device is based, for example, on the fact that this device provides the microcontroller from time to time with tasks and determines from the results returned by the microcontroller, whether the microcontroller is working correctly or not.

The electrical connections, which are provided for the transmission of enable signals to the relevant output stages (shutdown paths), can be designed multiple times (redundantly) for reasons of increased security. Furthermore, the ability to shut down power amplifiers by means of the digital enable signals can be checked by means of a self-test in the inactive system state, i. H. at least once per usage cycle. However, erroneously deviating operating conditions from the allowable range, particularly any errors within the microcontroller, including faults caused by faulty software, are most likely to occur during active system operation.

If an error occurs in the active operation of the system, which should be detected by the monitoring device, and output stages should be converted into a state defined as "safe" by means of the digital enable signal, however, then the prior art controllers have in practice shortcomings.

In particular, it may happen that in the event of an error, an enable signal is therefore not transferred to the first, a blocking of the associated output stage causing signal state, because the error in the monitoring device itself or their release control device is present or the error affects the proper functioning of these latter devices.

To solve this problem of often inadequate security of monitoring, it is conceivable to further increase the redundancy of the monitoring and to perform more robustly with regard to errors that arise due to an overvoltage (eg due to a short circuit). However, such solutions are expensive, may reduce reliability in normal operation, and may in practice be limited to more or less specific failure cases for which they are designed.

It is therefore an object of the present invention to provide a control device and a method for controlling the operation of an internal combustion engine of a motor vehicle with a better behavior in the event of a fault.

This object is achieved with a control device according to claim 1 and a motor control method according to claim 8. The dependent claims relate to advantageous developments of the invention.

The control device according to the invention is characterized by a modulation device for periodically modulating the enable signal provided by the enable control device and an evaluation device for analyzing the output signal supplied to the output stage with respect to the periodic modulation and for putting the output stage in a predetermined error state in the absence of the periodic modulation.

The modulation of the enable signal provided by the enable control device and the evaluation of the enable signal in the direction of the output stage with respect to this modulation ensure that an error due to an error in the area of the enable signal generation and / or enable signal transmission is reliable (based on the absence of the modulation). is recognized. The relevant output stage can thus be brought reliably even in such a case in a predetermined error condition, the z. B. is provided as a shutdown or Resetzustand the power amplifier.

In particular, errors in which the enable signal statically (permanently) accepts a specific one of the two enable signal states are detected reliably and correctly as errors.

With the invention thus a "failsafe Abschaltpfad" is realized, which increases the security of the system.

• einen Pulsgenerator zur Erzeugung einer periodischen Folge von Modulationspulsen, und
• eine der Freigabesteuereinrichtung nachgeschaltete Modulationsstufe, welcher das Freigabesignal von der Freigabesteuereinrichtung sowie die periodische Folge von Modulationspulsen von dem Pulsgenerator eingegeben wird und welche zumindest bei Vorliegen des zweiten Freigabesignalzustands das Freigabesignal jeweils für die Dauer eines Modulationspulses invertiert.

In a preferred embodiment, the modulation device comprises:

• a pulse generator for generating a periodic train of modulation pulses, and
• a modulation stage connected downstream of the enable control device, to which the enable signal from the enable control device and the periodic sequence of modulation pulses are input by the pulse generator and which at least in the presence of the second enable signal state inverts the enable signal for the duration of one modulation pulse.

In this case, the evaluation device may include an evaluation stage upstream of the output stage, which input the enable signal from the modulation stage and which analyzes the input enable signal for the presence of the corresponding in accordance with the modulation pulse sequence inverted enable signal sections and in the presence of these inverted enable signal sections, the enable signal passes to the power amplifier and at Absence of these inverted enable signal sections offset the output stage in the predetermined error state.

In a preferred embodiment, the evaluation device is provided such that when a transition of the input enable signal from one to the other enable signal state passed to the power amplifier enable signal is only passed if it can be excluded from the evaluation that the transition of the input signal was only due to the modulation, so was not caused by a corresponding transition of the release control provided by the enable signal. This check of the evaluation device before a change of the issued enable signal state may require a certain amount of time, which is often acceptable in practice. As an alternative, this evaluation of the evaluation device, which is usually associated with a delay, can only be provided if the enable signal changes from the first into the second or from the second into the first enable signal state.

Preferably, the evaluation device is designed such that the modulation of the input enable signal is removed, that is, the output to the output stage enable signal contains no such modulation. It is also conceivable, however, to leave the modulation in the enable signal, be it that the temporal signal curve relatively short-term modulation sections do not significantly affect the control of the relevant output stage or the modulations are filtered away in the final stage.

The pulse generator can be used together with the modulation level z. B. may be provided integrated in the monitoring device, ie in particular together with the other circuit parts of the monitoring device in a common integrated circuit, which may also include the microcontroller.

Preferably, the release control device is integrated in a monitoring device (such as the watchdog mentioned above) which monitors the proper operation of the microcontroller and provides the enable signal in the second enable signal state only upon detection of proper operation. In many applications, such as when a commercially available microcontroller chip is to be used, it is advantageous to provide the monitor including the enable controller and including at least a portion of the modulator (eg, without the pulse generator described below) in a common integrated circuit, which is arranged separately from the microcontroller chip in an electronic module (control unit).

The evaluation device is preferably integrated in an output stage device containing the output stage, that is to say in particular implemented in a common integrated circuit. Apart from the advantage of a cost-effective implementation the evaluation, z. B. without additional electronic components, this results in practice another, very significant advantage in connection with an overvoltage monitoring or in connection with the "failsafe" behavior of the entire system in the special case of error overvoltage.

• Jegliches Verhalten der in der Steuereinrichtung verwendeten elektronischen Bauteile kann nur innerhalb eines begrenzten, technologiebedingten Betriebsbereiches garantiert werden. Sobald dieser Bereich verlassen wird, z. B. bei Vorliegen unzulässig hoher Spannungen an irgendeiner Stelle des Systems, ist jede beliebige Konfiguration der Freigabesignale vorstellbar.

This advantage requires a more detailed explanation:

• Any behavior of the electronic components used in the control device can only be guaranteed within a limited, technology-related operating range. Once this area is left, z. B. in the presence of impermissibly high voltages at any point of the system, any configuration of the enable signals is conceivable.

If the monitoring device exceeds a certain complexity, then in practice it makes economic sense to carry out this technology in one of the final stages, which are mostly power stages, different technology, namely expediently in a low-voltage technology (such the microcontroller).

If now this monitoring device also takes on the task of overvoltage detection, since the required precision in the switched off power output stages can not be achieved in the rule, it may happen that the permissible voltage range of the monitoring device is exceeded, even if the power amplifier still in their permissible range works, so that a transition to the desired predetermined error state can no longer be guaranteed.

However, if the evaluation has a higher dielectric strength than the microcontroller or those circuit parts of the control device, which are required to provide the enable signal, so the evaluation z. B. in a final stage containing power amplifier device is integrated with a relatively high dielectric strength, the overvoltage failure in the area of the microcontroller or the monitoring device or the release control device can still be reliably detected as long as the overvoltage does not cause a failure of the power amplifier. The latter, however, can be easily ensured by appropriate dimensioning of the dielectric strength of the output stage, which in practice anyway must at least be designed at least for the vehicle electrical system voltage of the vehicle plus a certain safety margin.

The modulation of the enable signal used according to the invention should affect the normal operation of the system as little as possible. In this regard, it is advantageous if the period of the modulation is predetermined such that it is selected to be at most as large as an error reaction time specified for the monitoring device, preferably smaller than this error reaction time. In control devices for the internal combustion engine and / or the transmission of a motor vehicle z. B. periods of less than 100 ms well suited. It is also advantageous if the duty cycle of the modulation is less than 10%, z. On the order of 1%. If, as already mentioned above, the enable signal is inverted by the enable controller for the duration of one modulation pulse, the pulse duration should be proportional to the period So be chosen relatively small and the period itself also be short enough for the application in question to ensure a reaction of the evaluation in case of error considering all tolerances within predetermined error reaction times.

If the evaluation has detected a failure of the modulation and thus an error, so z. B. issued in the first enable signal state release signal to the subsequent output stage or the subsequent output stages to inhibit activation of the controlled components (at least as long as the modulation is absent and / or at least for a predetermined period of time). However, depending on the nature of the controlled components, it is not fundamentally excluded that the failure state in which the final stage is to be offset is to release the activation. It is crucial that in the event of an error that is detected by the absence of modulation, the relevant power amplifier is placed in a predetermined error state. Although it is recommended in most power amplifiers to permanently bring the enable signal to a defined state for this purpose, so it is alternatively or additionally possible to influence the state of the power amplifier in a targeted manner in another way, eg. B. by some kind of fault signal, such. B. a reset signal, which is provided for the relevant power amplifier. Finally, upon detection of an error case, this can also be reported to other circuit parts of the control device, in particular to the microcontroller and / or a supply voltage unit with reset functions, which initially reset or start the individual device components in a defined manner when the control device is put into operation.

Fig. 1

ist ein schematisches Blockschaltbild eines Motorsteuergeräts zur Steuerung des Betriebs eines Einspritzmotors eines Kraftfahrzeugs, und

Fig. 2

ist eine Darstellung des zeitlichen Verlaufs verschiedener, im Motorsteuergerät nach Fig. 1 vorkommender Signale.

The invention will be described in more detail below with reference to an embodiment with reference to the accompanying drawings. They show:

Fig. 1

is a schematic block diagram of an engine control unit for controlling the operation of an injection motor of a motor vehicle, and

Fig. 2

is a representation of the time course of various, in the engine control unit after Fig. 1 occurring signals.

Fig. 1 3 shows essential components of an engine control device, generally designated 10, for a direct injection engine of a motor vehicle, comprising a microcontroller 12 for providing a control signal S for controlling the fuel injection system to be controlled during operation of the internal combustion engine, not shown, a release unit 14 for providing a digital enable signal b, by means of which a first logical enable signal state "Low" (L) is signaled a blocking and by a second logic enable signal state "High" (H) a release of the activation of the fuel injection system, and an output stage 16 for activating and deactivating the component to be controlled, here the fuel injection system, based on the control signal S taking into account one of these output stage 16 input enable signal d. In conventional engine control units, the release signal b outputted from the release unit 14 is directly input to the output stage 16, or the signals b and d are identical. Not so in the illustrated controller 10, as will be described below.

The final stage 16 initiates fuel injection by outputting corresponding drive signals to the various fuel injectors (located at the right edge of FIG Fig. 1 drawn signal lines symbolize the control of four fuel injectors) only if the output signal 16 input to the enable signal d is in the H state. In this case, the injection timing and the injection quantities are essentially determined by the control signal S output by the microcontroller 12. For simplicity of illustration, the transmission of the control signal S is symbolized here only by a line. In fact, depending on the final stage to be driven, this connection can be designed as a more complicated line arrangement. Furthermore, in the presentation of Fig. 1 omits all circuit parts of the controller 10 which are not essential to the understanding of the invention and which may be designed in a conventional manner (eg power supply (s), input signals to the microcontroller for receiving various sensor signals needed in the context of vehicle component control or engine control) ,

A special feature of the illustrated control unit 10 is the generation, transmission and use of a special release signal and will be explained below with reference to only to be understood as an example output stage 16 for a fuel injection system. Of course, the engine control unit 10 in practice further power amplifiers for controlling further vehicle components, in particular engine components, for which the method described below of a particularly "safe" enable signal can also be used.

A modulation device formed by a modulation stage 18 and a pulse generator 20 is immediately downstream of the release unit 14 and provides for a periodic modulation of the release signal b provided by the release control device. If several release units, such as the illustrated release unit 14 are provided, for. B. in a monitoring device, it can be advantageously used a common pulse generator for the modulation of the individual enable signals.

The in Fig. 2 the uppermost (first) curve represents the modulation pulse signal a generated by the pulse generator 20. This signal a consists of a periodic sequence of rectangular modulation pulses having a period Tpuls of a pulse duration of tpuls.

The in Fig. 2 second course represents an example of an output from the release unit 14 enable signal b, which changes at a time t1 from L to H and at a time t2 back to L again.

The modulation stage 18 is inputted these signals a and b, to form therefrom a "modulated" enable signal c, whose course is also in Fig. 2 is shown. It can be seen that the modulation stage 18, the H-state, which signals the release of the activation of the fuel injection system, is interrupted periodically by comparatively short modulation pulses, during which the signal c to a certain extent signals the blocking of the injection system activation. In the example shown, this periodic modulation takes place only in the signal sections in which the signal b is in the H state.

Immediately preceding the output stage 16 is an evaluation stage 22 which is implemented in the same technology (here on the same chip) as the output stage 16 and together with it forms an output stage device 24.

The evaluation signal 22 input to the evaluation stage 22 is analyzed by the evaluation unit 22 with regard to the presence of the periodic modulation in the signal c and, in simplified terms, passed on as the enable signal d to the output stage 16 only when the modulation in the input signal c is detected. In contrast, the evaluation stage 22 interprets a failure of the modulation as an error case and then puts the output stage 16 in a previously defined error state. In the illustrated embodiment, this is done by permanent output of the enable signal d in the low state, regardless of the state of the signal c. Thus, in the illustrated example, regardless of the control signal S, the fuel injection is forcibly terminated.

The in Fig. 2 This shows that the signal transition taking place at time t1 from L to H (in signal c) is not passed on directly to the output stage (in signal d) but rather to the lowest level only after expiration of a fixed increase delay Δt1. This is because the evaluation unit 22 in the illustrated example initially excludes the case in which this transition was caused by a "static" error in the signal c (or the transmission line provided for this purpose). For this purpose, the time period Δt1 is waited to determine the arrival of a modulation pulse. Only if this pulse is actually detected, the evaluation unit 22 also leaves the signal d in go over the H state. Δt1 is slightly larger than the pulse period Tpuls and fixed.

Similarly, the transition in the signal c from time to time t2 from H to L is not reflected directly in the output signal d, but only after a certain time delay (deceleration delay Δt2). This is because the evaluation stage 22 in the present example initially excludes the case in which this transition is caused only by the arrival of a modulation pulse. Accordingly, the time period Δt2 is long-awaited. Only if the signal c does not change back to H within this period, the evaluation stage 22 causes the signal d to go to L. This deceleration Δt2 is also fixed here and slightly larger than the pulse width tpuls.

The pulse period Tpuls, the pulse width tpuls and the "filter times" .DELTA.t1, .DELTA.t2 are suitable to choose according to the relevant system requirements. The duty cycle (tpuls / Tpuls) should be as small as possible in most applications, z. B. less than 10%, in particular less than 1%. On the other hand, with regard to short fault reaction times of the evaluation stage 22, the shortest possible period Tpuls is advantageous. In the example shown for the fuel injection z. B. a Tpuls in the order of about 10 ms conceivable.

• Das Signal c ist im H-Zustand und ein erster Modulationspuls von voller Länge (Pulsbreite tpuls) wird daraufhin erfasst. (-> enable)
• Das Signal c ist länger als die maximal zu erwartende Pulsbreite im L-Zustand. (-> disable)
• Das Signal c ist im H-Zustand und innerhalb des doppelten der zu erwartenden Periode Tpuls bleibt ein Modulationspuls aus. (-> disable)
• Das Signal c besitzt einen undefinierten Pegel. Dies kann z. B. durch eine Unterspannung im Bereich der Freigabesignalerzeugung hervorgerufen werden. (-> disable)

The evaluation stage 22 can, for example, cause an H state (enable) or L state (disable) of the signal d on the basis of specific criteria:

• The signal c is in the H state and a first modulation pulse of full length (pulse width tpuls) is then detected. (-> enable)
• The signal c is longer than the maximum expected pulse width in the L state. (-> disable)
• The signal c is in the H state and within a period of the expected period Tpuls a modulation pulse remains off. (-> disable)
• The signal c has an undefined level. This can be z. B. caused by an undervoltage in the field of release signal generation. (-> disable)

For most applications, it is preferable to give priority to the L (disable) transition over the H (enable) transition.

In a conceivable development, it can be provided that the evaluation stage 22 also checks the time interval between successive pulses when pulses are detected in the signal to determine whether it is in line with the predetermined modulation period. Thus, a proper modulation pulse train z. B. be more accurately demarcated by a caused by a fault pulse sequence.

In known manner, the release unit 14 is contained in a monitoring device 26 which communicates via a communication link 28 with the microcontroller 12, in particular to monitor its proper operation and depending on the result of this monitoring z. B. set the enable signal b accordingly.

In the example shown, the evaluation stage 22, due to its microelectronic integration in the area of the output stage device 24, has a relatively high dielectric strength (eg 36 V) in comparison to the microcontroller 12 and / or the monitoring device 26. The evaluation stage 22 can therefore also advantageously still reliably take fallback measures, in particular block or switch off the output stage 16, if circuit parts of the control unit 10 were impaired or destroyed by an overvoltage that is involved in the provision of the enable signal. The fail-safe behavior of the overall system is therefore due to the modulation not only particularly reliable but somewhat autonomous, which concerns a caused by overvoltage failure of logic devices such as the microcontroller. The additional logic in the output stage device 24 results in an automatic, permanent shutdown of the output stage 16 as soon as a static state of the shutdown path is detected, which transmits the signal c. In the described solution, the required dynamics must be generated only in error-free system operation, so that a limited operating mode is made possible if only the Abschaltpfad is faulty, but not the control logic. In the event of a fault, the power amplifier behaves under the critical operating conditions as specified.

Advantageously results in a hedge of the enable or switch-off signal from the control of a signal driver in the enable control device to read this signal through an input comparator of a power output stage (ie, for example, completely from one IC to another IC). Only the function itself within the power output stage (in the event of a fault) must be ensured. The inventive Solution covers any root cause of a faulty shutdown path. To realize additional, especially discrete additional components, not mandatory, which is favorable in terms of cost and failure rate. The effectiveness of the protection in operation can be ensured continuously, with certain logic functions can remain usable, if only one switch-off is defective. The solution according to the invention can be implemented by the monitoring device or a monitoring module backwards compatible with conventional output stages (possibly with slight adaptation measures). A return from an unauthorized to a permitted operating range of the monitoring device does not change the effectiveness of the shutdown path realized according to the invention.

In summary, in the control of the operation of an internal combustion engine using a microcontroller with associated amplifiers for controlling motor components of a power amplifier in addition to the actual control signal and a digital enable signal is supplied, by means of which depending on the signal state blocking or release of the power amplifier is signaled. In case of an error in the area of the microcontroller, the output stage can be switched off. By a modulation of the enable signal and the evaluation of the output stage led to the enable signal ensures that an error in the area of the release signal generation and / or enable signal transmission is detected by the absence of modulation and the power amplifier can be turned off very reliably in case of error.

Claims (8)

1. Electronic control device for controlling the operation of motor vehicle components, especially of an internal combustion engine or of a transmission of a motor vehicle, comprising

   - A microcontroller (12) for providing at least one control signal (S) for control of at least one component to be controlled in the operation of the motor vehicle,

   - A monitoring device (26) for monitoring the correct operation of the microcontroller (12),

   - A release control device (14) for providing a digital release signal (b), by means of which
   if the monitoring device (26) establishes that the microcontroller (12) is not operating correctly, a first release signal state (L) signals a disabling and
   if the monitoring device (26) establishes that the microcontroller (12) is operating correctly, a second release system state (H) signals an enabling of the activation of the component to be controlled, and

   - An output stage (16) for activating and deactivating the component to be controlled based on the control signal (S) taking into account of the release signal (b, c, d),

   in which case the control device further comprises:

   - A modulation device (18, 20) for periodic modulation of the release signal (b) provided by the release control device (14), and

   - an evaluation device (22) for analyzing the release signal (c) fed to the output stage (16) in respect of the periodic modulation and to put the output stage (16) into a predetermined error case state if the periodic modulation is absent.
2. Control device according to claim 1, in which case the modulation device (18, 20) comprises:

   - A pulse generator (20) for generating a periodic sequence of modulation pulses, and

   - A modulation stage (18) connected downstream from the release control device (14), into which the release signal (b) of the release control device (14) as well as the periodic sequence of modulation pulses is input from the pulse generator (20) and which at least if the second release signal state (H) is present, inverts the release signal for the duration (tpuls) of a modulation pulse in each case,

   and whereby the evaluation device (22) is embodied as the evaluation stage connected upstream from the output stage (16), into which the release signal (c) of from the modulation stage (18) is input and which analyzes the input release signal (c) in respect of the presence of the release signal pulse sequence inverted in accordance with the modulation pulse sequence and, if these inverted release signal sections are present, forwards the release signal (d) to the output stage (16) and if these inverted release signal sections are absent, puts the output stage (16) into the predetermined error case state.
3. Control device according to claim 1 or 2, whereby the release control device (14) is integrated into the monitoring device (26).
4. Control device according to claim 1, 2 or 3, whereby the evaluation device (22) is integrated into an output stage device (24) containing the output stage (16).
5. Control device according to claim 4, whereby the evaluation device (22) has a greater dielectric strength than the monitoring device (26) and/or the microcontroller (12).
6. Control device according to one of the previous claims, whereby the period (Tpuls) of the modulation is predetermined so that this is at most as large, preferably smaller, than an error reaction time specified for the monitoring device (26) of the control device.
7. Control device according to one of the previous claims, whereby the pulse duty ratio (tpuls/Tpuls) of the modulation is less than 10%.
8. Method for controlling operation of motor vehicle components, especially of an internal combustion engine or of a transmission of a motor vehicle, by means of a control device, which comprises:

   - A microcontroller (12) for provision at least of one control signal (S) for control of at least one component to be controlled in the operation of the motor vehicle,

   - A monitoring device (26) for monitoring the correct operation of the microcontroller (12),

   - A release control device (14) for providing a digital release signal (b), by means of which
   if the monitoring device (26) establishes that the microcontroller (12) is not operating correctly, a first release signal state (L) signals a disabling and
   if the monitoring device establishes that the microcontroller (12) is operating correctly, a second release signal state (H) signals an enabling of the activation of the component to be controlled, and

   - An output stage (16) for activating and deactivating the component to be controlled based on the control signal (S), taking into account the release signal (b, c, d),

   whereby the method comprises:

   - Periodic modulation of the release signal (b) provided by the release control device (14),

   - Analysis of the release signal (c) fed to the output stage (16) in respect of the periodic modulation, and

   - Putting the output stage (16) into a predetermined error case state if the periodic modulation is absent.

Images