JPH09295553A - Multiplex communication apparatus - Google Patents

Abstract

PROBLEM TO BE SOLVED: To prevent a wrong decision on a failure in a main microcomputer by completely disregarding the connection with a sub-microcomputer in the main microcomputer when the sub-microcomputer controlled by the main microcomputer is abnormal. SOLUTION: In the case of failure diagnosis on a main occupant crash protection device 35 by a microcomputer 25, first a switch circuit 32 is turned off, and a switching transistor 31 is turned on for designated time to discharge a backup capacitor 23 through a resistance 30. At this time, the terminal voltage is read to perform abnormality decision, and if abnormal, the switch circuit 32 is turned on to supply a diagnosis request signal to a microcomputer 25' of a sub-occupant crash protection device 46 through a communication circuit 33 and a power supply line 36. After the request signal is output, if a response signal is not supplied, the program runaway of the microcomputer 25' is decided and the microcomputer 25 turns off the switch circuit 32 to disconnect the sub-occupant crash protection device 46.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a multiplex communication device suitable for an occupant protection device and the like, which is provided with a plurality of airbags or the like for protecting an occupant in the event of a front and side collision of a vehicle. .

[0002]

2. Description of the Related Art A conventional multiplex communication device of this type will be described with reference to an occupant protection device shown in FIG. First, the driver airbag (main occupant protection device), which is the main control device surrounded by the broken line 16, will be described below. The booster circuit 3 boosts the input voltage from the battery 1 supplied via the ignition switch 2 and charges the backup capacitor 5 via the resistor 4. The charged electric charge is turned on by the switch circuit 7 when the microcomputer 11 determines a serious collision based on the acceleration signal supplied from the acceleration sensor 10, and the detonator 8, the mechanical type The acceleration switch 9 (which is on at this time, but is normally off) is discharged in series, and the detonator 8 ignites a gunpowder (not shown) to deploy the airbag. The mechanical acceleration switch 9 is disclosed in Japanese Patent Application No. 5-35147 filed by the present applicant.
It has the structure disclosed in No. 0.

The microcomputer 11 has a failure diagnosis function. When diagnosing the capacity of the backup capacitor 5, the microcomputer 13 turns on the transistor 13 for a predetermined time and discharges the charge in the backup capacitor 5 via the resistor 12. The amount of change in the terminal voltage of the backup capacitor 5 at that time is read and the backup capacitor 5 is read.
Diagnose whether the capacitance of is within the specified range,
When it is determined that there is an abnormality (out of the specified value range), the details of the failure are stored in the memory 14, and
The alarm device 15 such as a lamp is driven to notify the occupant. The microcomputer 11 alternately and repeatedly executes the failure diagnosis function and the collision determination function in a very short time.

Further, the microcomputer 11 causes the memory 14 to store failure diagnosis information of the driver side airbag (sub-occupant protection device) 19 which is a sub-control device supplied from a first communication circuit 17, which will be described later. The alarm device 15 is operated based on the failure diagnosis information. When the request signal is supplied from the microcomputer 11 at regular intervals, the first communication circuit 17 supplies the request signal to the second communication circuit 20 of the driver side airbag 19 and the second communication circuit 20 outputs the request signal. When the response signal corresponding to the request signal is supplied, it is supplied to the microcomputer 11.

Next, when a collision from the side of the vehicle occurs,
The driver side airbag 19 which is the sub control device will be described below. This driver side airbag 19 is
This is for protecting the occupant against a collision from the side of the vehicle, and its power is supplied from the backup capacitor 5 and the booster circuit 3 of the driver airbag 16 by a power line such as a harness shown by reference numeral 18. Are connected as. The first communication circuit 17 performs multiplex communication with the second communication circuit 20 of the driver side airbag 19, and sends a request signal transmitted from the microcomputer 11 at regular intervals to the second communication circuit 20. And the response signal (diagnosis result) from the corresponding second communication circuit 20 is received and supplied to the microcomputer 11.

The driver side airbag 19 is mounted on the door of the vehicle or in the vicinity thereof, and a reference numeral 10 'therein indicates a lateral acceleration sensor, which is the same as the longitudinal acceleration sensor 10, and its acceleration The sensor 10 is attached to the vehicle by changing the detection direction so that the acceleration from the lateral direction of the vehicle can be detected.

Reference numeral 11 'denotes a microcomputer having a collision judgment function equivalent to that of the microcomputer 11,
When a collision is determined based on the acceleration signal from the lateral acceleration sensor 10 'that detects an acceleration signal generated in the vehicle left-right direction, and if a serious collision is determined, a switch circuit 7' (equivalent to the switch circuit 7 Things) to turn on.

8'is a detonator equivalent to the detonator 8,
Reference numeral 9'denotes a mechanical acceleration switch equivalent to the mechanical acceleration switch 9; 21 a constant voltage circuit;
Booster circuit 3 and backup capacitor 5 via
The constant voltage is supplied to each circuit that constitutes the driver side airbag 19 by receiving the output from the.

That is, since the driver's seat airbag operates in the same manner as that shown in FIG. 4, a detailed description thereof will be omitted, but the driver's side airbag 19 also has a collision determination function like the driver's airbag 16. And a failure diagnosis function, and these programs are alternately and repeatedly executed within a short time.

As a result, the driver side airbag 1
9 receives a boosted voltage from the booster circuit 3 of the driver's airbag 16 and the backup capacitor 5 via the power supply line 18, and the driver's side airbag 19 detects the acceleration due to the collision from the side of the vehicle.
0'detects, and the collision judgment function of the microcomputer 11 'judges that it is a serious accident based on the detection signal,
The driver circuit airbag 16 is controlled by turning on the switch circuit 7 '.
The electric power charged in the backup capacitor 5 is sent in series to the squeeze 8 ′ and the mechanical acceleration switch 9 ′ to ignite the explosive powder and deploy the airbag. It is to be noted that both switch circuits 7 and 7'are not normally turned on at the same time, that is, a collision does not occur from the front of the vehicle and the left and right simultaneously.

Further, the microcomputer 11 'carries out a failure diagnosis of the detonator 8'and the like by a failure diagnosis function, and periodically sends a request signal from the driver's seat airbag 16 via the first and second communication circuits 17, 20. Every time a request signal is supplied, the microcomputer 11 ′ of the driver side airbag 19 returns the diagnosis result as a response signal from the second communication circuit 20 to the first communication circuit 17, and the microcomputer 11 ′ Causes the memory 14 to store the alarm according to the contents and drives the alarm device 15.

[0012]

However, every time the microcomputer 11 of the driver's seat airbag 16 of the occupant protection system shown in FIG. 4 supplies a request signal to the driver's seat side airbag 19 at regular intervals, the driver operates. The response signal from the microcomputer 11 'of the seat side airbag 19 is the microcomputer 1 of the driver airbag 16
Since it is configured to be transmitted to No. 1, there is a problem that a large amount of power is consumed because communication is always performed between the two microcomputers 11 and 11 ', and therefore the capacity of the booster circuit 3 becomes large. It was

In addition, when the microcomputer 11 'of the driver side airbag 19 runs out of control, it is common sense that it is reset by a watchdog timer (not shown) and returned to normal operation, and then it is not a malfunction but a runaway. It is confirmed that it was done, but the time to return to normal is a very short time, and if the response signal is not returned after that short time, it is physically destroyed, Or, it is not known whether the runaway is repeated, and therefore the driver side airbag 1 is controlled from the management of the microcomputer 11 of the driver airbag 16.
There is a problem in that the microcomputer 11 'of 9 becomes unmanaged.

Therefore, the present invention has been made in view of the above problems, and when the operation of the sub-microcomputer managed by the main microcomputer is a little abnormal,
The main microcomputer aims at completely ignoring the connection with the sub-microcomputer so that the main microcomputer does not make a wrong decision.

[0015]

A first invention relating to this multiplex communication apparatus is to supply power from a first DC power supply, generate a first control signal based on a detection signal from a first sensor, and to provide each circuit. Power is supplied from a main controller having a function of monitoring a part to perform a failure diagnosis, and a second direct current power source connected to the first direct current power source through a harness, and a first signal is supplied based on a detection signal from a second sensor. Two sub-control devices are provided, and at least one sub-control device having a function of monitoring each circuit unit is provided. The main control device periodically sends a request signal to the sub-control device. The sub-control device is a multiplex communication device that sends back a response signal including at least the monitoring result of each circuit unit to the main control device, and the main control device supplies the request signal. After that it from the sub-control Corresponding response signal is obtained so as to stop power supply to the second DC power source of the sub-control unit determines that there is a disconnection state when not sent back over a predetermined time, and outputs a warning signal.

A second aspect of the present invention is provided with a function of supplying power from the first DC power source, creating a first control signal based on a detection signal from the first sensor, and monitoring each circuit section to perform a failure diagnosis. The main controller and a second DC power source connected to the first DC power source via a harness,
The second control signal is generated based on the detection signal from the sensor, and at least one sub control device having a function of monitoring each circuit unit is provided, and the main control device is the sub control device. The sub-control device is a multiplex communication device that periodically sends a request signal to the main control device and returns a response signal including the monitoring result of each circuit unit to the main control device. After supplying the request signal, the main control device determines that the sub-control device is in a disconnection state when the corresponding response signal is not returned from the sub-control device for more than a predetermined time, and inputs the response signal from the sub-control device. It has been banned.

According to a third aspect of the present invention, the request signal output from the main control device and the response signal output from the sub control device are communicated using the harness as a signal line.

[0018]

BEST MODE FOR CARRYING OUT THE INVENTION

Embodiment 1. The first embodiment according to the present invention will be described with reference to FIG. First, the main occupant protection device 35 which is a driver airbag will be described. That is, 21 is a booster circuit that boosts the input voltage from the battery 1 supplied via the ignition switch 2 to charge the backup capacitor 23 via the resistor 22 and is also inserted in series in the power supply line 36. Switch circuit 32, resistor 3
The boosted voltage is supplied to the auxiliary occupant protection device 46, which is a passenger side air bag, via 4. Reference numeral 24 denotes a longitudinal acceleration sensor for detecting acceleration generated in the longitudinal direction of the vehicle. An acceleration signal as a detection signal is supplied to a microcomputer 25 described later.

The microcomputer 25 has a collision judging function and turns on the switch circuit 26 when a serious collision is judged on the basis of the acceleration signal supplied from the longitudinal acceleration sensor 24, so that the backup capacitor 23 is turned on. Charged charge is discharged by diode 2
Discharge through 7, detonator 28, mechanical acceleration switch 2
Ignition current is sent in series to 9 to deploy the airbag attached to the steering wheel, while the switch circuit 26 '
Is turned on and the detonator 28 'is turned on, and at the same time, the pretensioner is operated. It goes without saying that the mechanical acceleration switch 29 is turned on at this time.

The microcomputer 25 has a function of diagnosing the backup capacitor 23, the detonator 28, and the like. In the capacity diagnosis of the backup capacitor 23, a signal line Y is used immediately after the ignition switch 2 is turned on. Then, the switching transistor 31 is turned off and the charge stored in the backup capacitor 23 is prevented from being discharged as a dark current of each circuit of the auxiliary occupant protection device 46. That is, the auxiliary occupant protection device 46, which will be described later, loads the backup capacitor 23. After that, the switching transistor 31 is turned on after the main occupant protection device 35 and the sub occupant protection device 46 are electrically disconnected from each other, and the charge charged in the backup capacitor 23 is removed. Through resistor 30 The microcomputer 25 reads the voltage change amount of the terminal voltage of the backup capacitor 23 at the time of discharging, during a predetermined time, and thereby calculates the electrostatic capacity to perform the capacity diagnosis and determine that the capacity value is abnormal. In such a case, the alarm device 37 such as a lamp is used to notify the occupant and the content of the abnormality is stored in the memory 38.

Further, when the microcomputer 25 outputs the request signal through the signal line X as shown in FIG. 3 (A) and the response signal is not transmitted through the signal line Z for a predetermined period of time ( In FIG. 3B, an input prohibition signal is supplied to the input control unit 39 described later (see FIG.
(C)), and the switching transistor 31 is turned off via the signal line Y. As described above, when the response signal to the request signal is not supplied within the predetermined time T after the microcomputer 25 outputs the request signal, the input control unit 39 blocks the input from the signal line Z. Output a signal.

The disconnection diagnosis of the detonators 28, 28 ', 28 "is judged by the microcomputer 25 based on the voltage and the voltage difference across the detonators 28, 28', 28", and the disconnection. In this case, the occupant is notified by using the alarm device 37 such as a lamp as in the above. Further, the microcomputer 25 inputs response signals such as various diagnostic signals from the auxiliary occupant protection device 46 through the signal line Z and performs the same diagnosis as described above. A request signal from the first communication circuit 33 to the auxiliary occupant protection device 46 via X (see FIG.
It goes without saying that after transmitting (A), the microcomputer 25 'of the auxiliary occupant protection device 46 returns it.

Next, the auxiliary passenger protection device 46 will be described. Reference numeral 24 ′ is the same acceleration sensor as the longitudinal acceleration sensor 24, which has a different detection direction from the longitudinal acceleration sensor 24 and is attached to a Doppler or the like so as to detect the lateral acceleration of the vehicle. The signal is supplied to the microcomputer 25 '. The microcomputer 25 'is the microcomputer 25
Similarly to the above, the vehicle has a collision determination function, and determines the scale of a collision from the side of the vehicle based on an acceleration signal supplied from the lateral acceleration sensor 24 'and a switch signal supplied from an acceleration switch 40 described later. Then, the judgment result is output as a response signal together with the diagnosis result via the second communication circuit 33 ′.

Further, the microcomputer 25 'has a diagnostic function similar to the microcomputer 25, and carries out a failure diagnosis of the lateral acceleration sensor 24', the acceleration switch 40, etc., and the power line 36 from the first communication circuit 33. Each time a request signal is supplied through the main occupant protection device via the second communication circuit 33 '(the same as the first communication circuit 33), the power supply line 36, and the signal line Z, the diagnosis result is used as a response signal. 35 to the microcomputer 25.

Further, the microcomputer 25 'is
When the watchdog timer 45 is connected and the program runs out of control, it is reset by a reset signal from the watchdog timer 45. Microcomputer 25 '
When the program runs out of control, the microcomputer 25 'cannot recognize even if the request signal is supplied, so that the output of the response signal is stopped. The acceleration switch 40 is composed of a semiconductor acceleration sensor and a comparison circuit for inputting the detection output of the semiconductor acceleration sensor, and outputs a switch signal when the output from the semiconductor acceleration sensor exceeds the reference value of the comparison circuit.

Reference numeral 41 'is a switching transistor such as a field effect transistor, which is a signal indicating a collision signal which is on / off controlled by the output signal of the second communication circuit 33'.
It outputs response signals such as various diagnostic signals. Reference numeral 42 'denotes a resistor interposed between the switching transistor 41' and the power supply line 36, which is connected in series with the resistor 34 via the power supply line 36 so that the voltage on the anode side of the backflow prevention diode 43 is When the switching transistor 41 or 41 'is turned on, the minimum level of the input of the constant voltage circuit 44 does not become 0 level and is maintained at a constant voltage or more, so that the constant voltage circuit 44 described later can always be supplied with a constant voltage. I have to. The constant voltage circuit 44 always receives the input voltage and supplies electric power to each circuit constituting the auxiliary passenger protection device 46.

The power supply line 36 is connected to the main occupant protection device 3.
5 and the auxiliary occupant protection device 46 are communicating, the voltage waveform is as shown in FIG. That is, in FIG. 2, the voltage V1 is the switching transistors 41, 4
The output voltage V3 of the booster circuit 21 when 1'is turned on is a resistance-divided value with the resistors 34 and 42 ', and the voltage V2 is the voltage when the switching transistor 41 (or 41') is turned off. It depends on the value.

Next, the operation of the above configuration will be described. When the diagnostic function operates, the ignition switch 2 is turned on, the microcomputer 25 of the main occupant protection device 35 starts to operate, and when performing the capacitance diagnosis, the microcomputer 25 activates the switch circuit 32 via the signal line Y. With turning off
The switching capacitor 31 is turned on for a predetermined time, and the backup capacitor 2 is fully charged.
3 is discharged through the resistor 30 for a predetermined time, and the microcomputer 25 reads the terminal voltage of the backup capacitor 23 at that time, whereby the microcomputer 25 obtains the voltage change amount of the terminal voltage of the backup capacitor 23. Then, it is judged whether or not the electrostatic capacity is a prescribed value, and when it is abnormal, it is stored in the memory 38 and the alarm device 37 is activated to notify it. Further, when the detonators 28, 28 ', 28 "are diagnosed for disconnection or the like and it is determined that there is a failure, the details of the failure are stored in the memory 38 and the alarm device 37 is activated.

Thereafter, the switch circuit 32 is turned on, and a diagnostic request signal is supplied to the microcomputer 25 'of the auxiliary occupant protection device 46 via the first communication circuit 33 and the power supply line 36. The microcomputer 25 'receiving the request signal reads the terminal voltage of each part in the auxiliary passenger protection device 46, for example, the lateral acceleration sensor 24', and turns on the switching transistor 41 'according to the output of the second communication circuit 33'. When it is turned off, it is transmitted to the microcomputer 25 of the main occupant protection device 35 via the power line 36 via the signal line Z, and the microcomputer 25 makes a diagnosis. As a result, when it is determined that there is a failure, In the same manner as above, the contents are stored in the memory 38, and the alarm device 37 is activated.

When the collision determination function operates When the vehicle has a frontal collision after the above-mentioned various diagnoses have been completed (or when it has not been performed), the main occupant protection device 3
When the mechanical acceleration switch 29 of No. 5 is turned on and the microcomputer 25 determines that there is a serious collision based on the acceleration signal from the longitudinal acceleration sensor 24, the microcomputer 25 turns on the switch circuits 26 and 26 'to back up. The electric charge charged in the capacitor 23 is supplied to the detonators 28, 28 'through the discharging diode 27, the airbag in the driver's seat is inflated, and the pretensioner is operated to protect the occupant from a frontal collision. However, since the acceleration acts in the front-rear direction of the vehicle at this time, the left-right acceleration sensor 24 ′ of the auxiliary occupant protection device 46.
No signal is output from the acceleration switch 40, and no ignition current is supplied from the backup capacitor 23 to the detonator 28 ″.

When the vehicle is laterally collided,
Since the mechanical acceleration switch 29 of the main occupant protection device 35 is not turned on and the front-rear direction acceleration sensor 24 does not output an acceleration signal having a magnitude corresponding to the acceleration signal associated with the forward collision, the primer 28 is ignited. No current is supplied.

On the other hand, if the microcomputer 25 'of the auxiliary occupant protection device 46 determines that a serious collision has occurred based on the switch signal from the acceleration switch 40 and the acceleration signal from the lateral acceleration sensor 24', the microcomputer 25 '. Controls the switch circuit 26 'to be turned on to supply the charge charged in the backup capacitor 23 to the detonator 28 "to deploy the airbag provided on the seat to protect the occupant from a side collision.

The above is the normal microcomputer 2
5, 25 'operation, the microcomputer 2
If 5'runs out of control for some reason, it is initialized by the operation of the watchdog timer 45, or if a predetermined time or more is spent for initialization, that is, a request signal is output and then a response signal to that is output for a predetermined time. If not supplied, the microcomputer 25 puts the input control unit 39 into the input prohibited state and switches the switch circuit 32.
Is turned off to disconnect the auxiliary occupant protection device 46 from the main occupant protection device 35.

As a method for the main occupant protection device 35 to disconnect the operation of the auxiliary occupant protection device 46, the input control section 39 is used.
It suffices to only activate the switch or switch off the switch circuit 32.

[0035]

As described above, according to the first aspect of the invention, when the main control device determines that the communication with the sub control device is not normal for a predetermined time, the sub control device is in an inoperable state early. Therefore, the effect of improving the reliability of the device is exhibited.

According to the second aspect of the invention, when the main control device determines that the communication with the sub control device is not normal for a predetermined time, a program for preventing the response signal from the sub control device from being input (ignored) Therefore, the effect that the configuration suitable for the microcomputer can be obtained is exhibited.

According to the third invention, since the communication line can be shared with the power supply line, the effect that the number of harnesses can be reduced is exhibited.

[Brief description of drawings]

FIG. 1 is a circuit block diagram of an occupant protection device according to a first embodiment of the present invention.

FIG. 2 is a waveform diagram of a power supply line 36 in FIG.

FIG. 3 is a circuit block explanatory diagram of a second embodiment of the occupant protection system according to the present invention.

FIG. 4 is a circuit diagram of a conventional example of the present invention.

[Explanation of symbols]

 24, 24 'Accelerometer 25, 25' Microcomputer 26, 26 ', 32 Switch circuit 28, 28' Detonator 33, 33 'Communication circuit 34, 42 Resistor 31, 41 Switching transistor 40 Acceleration switch

Claims (3)

[Claims] 1. A main controller having a function of supplying power from a first DC power source, creating a first control signal based on a detection signal from a first sensor, and monitoring each circuit section to perform a failure diagnosis. And a function of supplying power from a second DC power supply connected to the first DC power supply via a harness, creating a second control signal based on a detection signal from a second sensor, and monitoring each circuit unit. And at least one sub-control device, the main control device periodically supplies a request signal to the sub-control device, the sub-control device to the main control device. In the multiplex communication device that returns a response signal including the monitoring result of at least each circuit unit, the main control device, after supplying the request signal, the corresponding response signal from the sub control device for a predetermined time. Must be returned beyond A multiplex communication device characterized in that it is judged to be in a disconnection state, power supply to the second DC power supply of the sub-control device is stopped, and an alarm signal is output. 2. A main controller having a function of supplying power from a first DC power source, creating a first control signal based on a detection signal from a first sensor, and monitoring each circuit section to perform a failure diagnosis. And a function of supplying power from a second DC power supply connected to the first DC power supply via a harness, creating a second control signal based on a detection signal from a second sensor, and monitoring each circuit unit. And at least one sub-control device, the main control device periodically supplies a request signal to the sub-control device, the sub-control device to the main control device. In the multiplex communication device that returns a response signal including the monitoring result of at least each circuit unit, the main control device, after supplying the request signal, the corresponding response signal from the sub control device for a predetermined time. Must be returned beyond A multiplex communication device, characterized in that it is judged to be in a disconnection state and the input of a response signal from the sub control device is prohibited. 3. The multiplex communication device, wherein the request signal output from the main control device and the response signal output from the sub control device communicate with each other using the harness as a signal line.