EP0101850B1 - Safety apparatus for idling lorries - Google Patents

Description

State of the art

The invention relates to a safety emergency operation according to the type of the main claim.

It is known for the control of electrical or electromechanical devices or for the control of system functions to use microprocessors or microcomputers which derive control signals for actuating actuators from one or more operating parameters of the system. Such devices are used in motor vehicles, for example for operating injection systems, ignition systems, transmission controls or an idle charge control, each separately or combined in a central logic. It is also known in this connection to provide monitoring devices which monitor the proper functioning of the device and which emit an alarm signal and / or trigger an emergency control if a malfunction occurs.

A SAE Technical Paper No. 810157 describes a microcomputer-controlled internal combustion engine control. The microcomputer or microprocessor used in this way generates control pulses built into its control program, which are processed by the microprocessor and therefore occur regularly if they function properly. A malfunction of the program or the device can then be detected by a memory circuit or another device, since in this case, for example when the computer is at a standstill, no more control pulses are emitted. In the monitoring circuit according to the SAE paper, a monostable multivibrator is provided, the output signal of which can be fed to the injection system and the ignition device. The regular control impulses are suppressed below a prescribed speed of the internal combustion engine, particularly when the internal combustion engine is started up.

A reset circuit for a microcomputer is also known from DE-A-30 35 896, in which the control pulses indirectly open or close. Discharge a capacitor so that the absence of the control pulses can be detected by monitoring the capacitor voltage. If there are changes in the sequence of the control pulses above a predetermined level, the monitoring circuit generates a reset signal which resets the microcomputer. The reset phase is then followed by a release phase in which the system can restart.

From FR-A-2 458 106 a device for the electronic control of an electromagnetic actuator is known, in which the actuator is controlled by an amplifier with a pulse-shaped signal. The control signal and output signal of the output stage are fed to a logic which, in the event of a fault, cancels the control of the actuating device.

Furthermore, an electronic control device with a microcomputer is known from GB-A-2 007 397. A test signal is issued to monitor the processor. If the processor is defective, this test signal is missing. In this case, the control signals are no longer generated by the microprocessor, but by an emergency running device.

Facilities in which reset elements, e.g. Springs are generally known. For example, the book "Die Meisterprüfung im Kfz-Handwerk" (7th edition, part 2; Würzburg (1980)) describes an air slide with a return spring that can be moved in one direction by heat, in the other direction by a return spring is.

Problems can arise in the known devices for monitoring system function when a function has to be monitored that can be safety-critical in the case of undefined malfunction, for example, for example in the case of an idle charge control, the possibility that a two-winding rotary actuator used for such control has a position takes, which corresponds to an unwanted accelerating.

There is therefore a need for a monitoring circuit in connection with an idle charge control which is able to ensure a defined, safety-critical failure behavior of such an idle charge control.

Advantages of the invention

The safety emergency running device according to the Invention with the characterizing features of independent claim 1 has the advantage over the fact that the digital control of the final stage driving the actuator, a perfect detection of errors by feedback of output stage output signals to the controlling computer is possible, which then itself generates a switch-off signal and feeds a separate switch-off stage for the output stage so that the output stage as a whole is de-energized. The output stage is therefore always switched off when component defects occur, for example due to alloyed output stage transistors, wire breaks on the two-winding turntable, errors in the transmission of the motor temperature through the NTC line and the like. The existing correction spring in this case sets an uncritical bypass cross-section for the idle charge control, which prevents unwanted accelerating.

In the event of internal or external faults, which can also be of a longer duration, the power stage is switched off in a pulsed manner using a separate failsafe circuit with a minimum duty cycle, which also results in an emergency function for a computer failure.

The invention takes into account linearity errors in the actuator cross-section caused by correction spring or battery voltage changes in that the safety circuit corrections by querying a memory at micro-rake enabled. In the same way, the microcomputer is designed so that an interruption or non-connection of the NTC resistor supplying an indication of the motor temperature to the computer recognizes and the output stage is switched off in the event of a fault, likewise an interruption of the ignition signals is recognized and the output stage is switched on in the event of a fault.

Advantageous further developments and improvements of the emergency running device specified in the main claim are possible through the measures listed in the subclaims.

drawing

Embodiments of the invention are shown in the drawing and are explained in more detail in the following description. 1 shows the block diagram of the safety circuit with an external failsafe circuit, FIG. 2 shows a first detailed exemplary embodiment of the output stage area with an assigned shutdown stage, FIG. 3 shows in detail a converter for converting voltage signals into a time duration signal that can be evaluated by the computer, FIG. 4 2, FIG. 5 shows a further detailed exemplary embodiment with additional additions, and FIG. 6 signal curves at different circuit points of the exemplary embodiment of FIG. 5.

Description of the embodiments

In the block diagram of FIG. 1, 10 denotes a microcomputer or microprocessor, which is used to control certain system functions, for example an idle charge control in a motor vehicle. The microcomputers 10 are peripherally assigned to the modules provided for system security and the required reaction in the event of a fault; In the special application of the present invention, which relates to an idle charge control and to which application the following description is specifically directed, the microcomputer 10 is supplied with signals to be processed at its input 10a via a data line 11 from a block shown only schematically at 12, those of operating parameters of the to be controlled or controlled. System depend. These operating parameters can, for example, provide information about the actual value of the current speed of the motor vehicle, the setpoint at this time, climatic conditions such as pressure and outside temperature, the position of the throttle valve and the like in the selected application of an idle charge control. be. From this information, which will be followed by a few more, which will be discussed in the following, the microcomputer 10 creates at its signal output 10b a control signal sequence which is used to control actuators via an output stage 13, in the present case a so-called two-winding rotary actuator 14 , which is connected in parallel to the throttle valve in the idle charge control as an air bypass and has a slide 14a, the position of which determines a desired passage cross-section based on the type of supply of clocked signals to the two partial windings 15a, 15b of the two-winding rotary actuator 14 via the output stage 13 results. On the actuator, in the application example on the slide 14a of the two-winding turntable 14, a bias spring 16 also acts, which in the event of a fault mitigates and switches off the possible emergence of dangerous driving situations due to faulty non-activation of the two-winding turntable, in particular, for example, in maneuvering and pushing operation that in this case a bypass cross-section required for driving safety is set mechanically with minimal passage.

Since the two-winding turntable is controlled by a single digital control pulse train, usually a rectangular pulse train via the output stage 13 by the microcomputer 10, it is the duty cycle n of the drive pulse train that determines the position of the slide 14a of the two-winding rotary control, the division of the individual pulses in push-pull is made by the power amplifier 13.

Since the bias spring 16 acts continuously to return the two-winding rotary actuator 14 to the safety position, the steep element receives a non-linear profile and a battery voltage dependency due to the spring characteristic which is dependent on the weight, so that the partial winding 15a, 15b can be partially compensated for the constant spring action.

The function is therefore obtained with a constant control duty cycle n as a measure of the bypass cross section d _s

It is part of the security concept of the present invention to compensate for these additional dependencies and to thereby avoid incorrect settings.

The computer 10 is therefore supplied with a battery _{voltage signal} U _BATT at a connection point 17 and converted into a time duration signal t _s via an interposed analog-digital converter 18 and supplied to the input 10c of the computer. In the same way, a temperature signal of the engine v _MO, which is decisive for the idle charge control, arrives via the analog-digital converter block 19 _! from the connection 20 to the computer input 10d, in turn converted by the converter circuit 19 into a corresponding, temperature-related time duration signal tv. A preferred embodiment of a converter for blocks 18 and 19 is discussed in more detail below with reference to the illustration in FIG. 3.

The temperature and battery voltage signals can also be read into the computer using external (or internal) A / D converters.

In normal operation, it preferably determines Microcomputer 10 designed in the manner of a PID controller uses the input parameters to determine the required basic duty cycle η and corrected for the influence of the battery voltage and the stored spring force (non-linear characteristic curve) by querying an external data memory, which is identified by 21 in the block diagram in FIG. 1 and a PROM, EPROM, etc. can be; the flow of data from the data memory 21 after appropriate addressing by the computer 10 is illustrated by the multi ^f achleitungen suggestive arrows.

The circuit is completed by, so to speak, a computer-internal first control and safety function, which is based on the corresponding inputs 10e and 10f of the computer being fed via feedback lines 22, 23 to the actuating signals of the two respective end stages which are responsible for one of the partial windings of the two-winding rotary actuator, so that the computer, in the event of a deviation of the returned duty cycle n 'of the windings of the two-winding rotary actuator from the duty cycle n of the control signal sequence predetermined by itself, can supply a shutdown signal via an intermediate OR gate 25 to a blocking block 26 which switches off the output stage; since the computer also outputs so-called failsafe pulses or control pulses at its output 27, the occurrence of which ensures that the computer works properly, in addition to the security concept according to the invention, an external security or so-called fail-safe circuit 28 can also be provided the same OR gate 25 also supply a shutdown signal to the shutdown block 26 in the event of a fault. This switch-off signal also serves as a reset signal for the microcomputer 10 and is therefore fed to the input 10g.

In the more detailed representation of FIG. 2, which comprises the output stage 13, the switch-off block 26 and the OR gate 25, it can be seen that the output stage 13 comprises two output stage semiconductor switches, namely the switching transistors T1 and T2, the collector of T1 over the connection point M1 is connected to the first partial winding 15a and the collector of the switching transistor T2 is connected via connection point M2 to the second partial winding 15b of the two-winding turntable 14. The two collectors are then each connected to the positive battery voltage via diodes D1 and D2 which are polarized in the reverse direction and to which connection point (M +) the two merged connections of the partial windings 15a, 15b are also connected. The two switching transistors T1 and T2 of the output stage 13 are driven by an upstream driver transistor TO, to which the drive pulse sequence with the pulse duty factor r ₁ is supplied from the output 10b of the microcomputer 10 at the connection point 29. The control signal sequence passes from the driver transistor TO to the first switching transistor T1, which then controls the collector of the second switching transistor T2 connected to it via the voltage divider resistors R1, R2. In accordance with the pulse duty factor of the drive pulse sequence, the two output stage transistors T1 and T2 work alternately in push-pull on the partial windings, the relative position of the slide 14a on the two-winding rotary actuator resulting from the respective, relative time periods of the pulses (current time areas) supplied to the corresponding partial windings.

The current switching states on the two-winding turntable 14 are monitored by detecting the control signals at the switching points M1 and M2 to the partial windings 15a, 15b and are passed via resistors R7, R8 with correspondingly assigned calming or pulse-shaping stages from diodes D5, D4, capacitors C1 connected in parallel and C2 and resistors R9, R10 as actuator signals U1 and U2 indicating the current duty cycle n 'to the inputs 10e, 10f of the microcomputer 10.

It is switched off via the switch-off stage 26, which comprises a series transistor T5 with its emitter against ground, the collector of which is connected to the two combined emitters of the switching transistors T1 and T2 of the output stage 13. The triggering of the series transistor T5, which, depending on whether it is switched on or off, can also turn off the output stage 13, takes place via an upstream further transistor T4, whose input terminal 30 is supplied with the switch-off signal from the output 24 of the microcomputer 10. Oring with the reset signal of the safety circuit 28 present at the other input connection 31 is effected in that the reset signal is supplied via a diode D1 at the connection point of two resistors R14, R13 in the control circuit between the pre-stage transistor T4 and the base of the series transistor T5. so that a reset signal going to zero or ground potential blocks the series transistor T5 and thereby disconnects the output stage 13. In the same way, there is a switch-off function for the output stage 13 when the switch-off signal at the input 30 is high or high, as a result of which the pre-stage transistor T4 blocks and therefore takes away the positive potential present at its collector, which brings the series transistor T5 into the blocked state. In order to simplify the potential distributions, the terms high, which have been found to be practicable and introduced in electronics, are used continuously for high potential by convention and low for low or ground potential.

The function in both cases of the shutdown (via the microcomputer 10 or the failsafe circuit 28) can be explained on the basis of the signal curves shown in FIG. 4 at different points in the circuit.

In FIG. 4, the control signal curve with the pulse duty factor _{'1 is} shown at a), the times t ₁ and t ₂ each being able to change relatively corresponding to r ₁ , and at b) and c) the signal curves at the switching points M1 and M2 shown corresponding to the collectors of T1 and T2; the waveform at d) represents the shutdown signal issued by the microcomputer 10 itself; the waveforms corresponding to e) and f) are the tuned actuator signals Ü1 and Ü2 with the current duty cycle n '; the signal curve at g) indicates the reset signal which comes from the failsafe circuit and at h) the failsafe or control pulses issued by the microcomputer 10 are shown which are fed to the failsafe circuit 28.

It can be seen that until the interruption shown, the signal curves characterize an emergency detected by the microcomputer 10 itself, while the failsafe circuit comes into operation after the interruption.

The computer 10 checks whether the read signals U1, U2 during times t ₁ and t ₂ correspond to the required signal curve with the duty cycle n.

As soon as an impermissible state occurs, for example transistor T1 permanently conductive, short circuit between collector and emitter on one of the transistors, wire break at M1 or M2, which means that Ü1 or Ü2 can either be permanently low or permanently high, this is recognized by the computer (see the at A in the curve f) of FIG. 4, error of the actuator signal U2, which went high before t1). The computer then switches off the output stage 13 via the shutdown stage 26 either directly or after averaging over time, depending on its programming, for example averaged over three to five period durations. Accordingly, the switch-off signal corresponding to d) goes high at time t _o and thus de-energizes the switching transistors T1 and T2, so that their collectors corresponding to b) and c) assume high signals. This high-level signal passes from the switching point M + to the collectors via the partial windings 15a, 15b. This shutdown of the computer can only be canceled by switching off the engine and restarting.

On the other hand, the failsafe circuit 28 serves to compensate for internal and external faults, also on the computer itself or, if appropriate, a voltage drop. In the event of a fault, the failsafe pulses supplied to the failsafe circuit 28 by the computer corresponding to h) in FIG. 4 are omitted, so that the failsafe circuit 28 with its reset signal corresponding to g) going low via the OR link 25 to the series transistor T5 switches off the power amplifier and at the same time provides a hardware reset for the computer.

The failsafe circuit is designed so that in the event of a fault it then works itself as a free-running oscillator; it comprises at least one capacitor continuously charged by the control pulses of the microcomputer 10, so that an input signal tapped via this capacitor arrives at an input of a threshold value comparator circuit and, in the absence of the control pulses, the comparator output is switched according to the low potential of the reset signal with a subsequent release signal of shorter duration by feedback of the output to the input. In the general case, the failsafe circuit therefore works in the manner of a monoflop, with the release time being designated t ₃ and the reset time t ₄ in curve profile g) of FIG. 4.

Since one of the windings 15a, 15b of the two-winding rotary actuator carries current during this release time t ₃ , depending on the state of the duty cycle control signal present at the output stage, this has an influence on the bypass cross section set by the spring 16. Therefore, the duty cycle of the reset signal should be below 5% in the event of a real error.

Another fault can be the additional dependencies of the bypass cross-section set by the two-winding rotary actuator on the battery voltage, the spring characteristic and the motor temperature. It is initially assumed that the time signals received by the microcomputer 10 in accordance with the conversion at its inputs 10c, 10d are within the usual limit values. In this case, the computer carries out corresponding corrections or additions to the duty cycle setting by querying the memory 21.

An embodiment of a converter, to which an input voltage Us to be converted into a period of time, which can be the battery voltage or a voltage proportional to the engine temperature, is supplied below with reference to the illustration in FIG. 3. In Fig. 3, the connection point with the voltage to be converted is designated 32; this voltage reaches a capacitor C3 via the transistor T6, which is turned on at the input 33 in the absence of an interrogation signal by the microcomputer. This capacitor is constantly charged to the voltage Us to be converted. If the query pulse appears at connection 33 from the computer, transistor T6 is blocked and capacitor C3 discharges via a circuit, which is initially shown as adjustable resistor R18, until the reference voltage present at resistors R19, R20 at a downstream comparator K1 falls below is. At this moment, the comparator K1 changes its output signal U _a, for example from high to low, and feeds this signal to the computer. The computer is designed so that it counts the time from the setting of the interrogation pulse to the appearance of the comparator signal, so that there is a proportionality between the determined time t _{s and} the voltage Us. If a linear relationship between these two quantities is desired — if the computer cannot or should not compensate for a nonlinear relationship by correspondingly querying the memory 21, the capacitor C3 can also be discharged via a constant current source.

Another important malfunction is an interruption in the line feeding the converter 19 in FIG. 1 the temperature signal, for example from an NTC resistor near the motor to watch. In this case, the computer normally increases the bypass cross-section accordingly due to its warm-up program, so that an increase in speed can also occur. On the other hand, in normal operation, the resistance range of the NTC resistor used here, for example, for temperature measurement, only extends within predefined limits (in the preferred exemplary embodiment between approximately 26 kilohms, which corresponds to a maximum voltage applied to the converter 19 and a maximum duration t that can be determined by the computer), approximately -30 ° C, up to less than 400 ohms, which then corresponds to the minimum voltage and the minimum duration pulse, at about + 80 ° C). Since an NTC resistance value of infinite arises when the line is interrupted or not connected, the instruction is entered in the microcomputer 10 to recognize this irregular case, so that the computer immediately or after averaging over two to five query periods for the motor temperature sets an uncritical value that corresponds, for example, to the room temperature of + 20 ° C or a regulated value of + 80 ° C. As soon as regular query pulses appear again, ie within the expected range of a time duration signal t, the computer gives up this safety function.

Furthermore, an interruption of the ignition signal is important as a fault, since in this case the actual speed value n, _st supplied to the microcomputer 10 is significantly smaller than a desired speed value n _should . Accordingly, the computer _is simulated in this case n _{is ,} and the computer sets the bypass completely in order to avoid the engine going out, so that there may be a dangerous speed increase.

This incident covers the computer by an additional software routine from characterized, that the failure _is in the range n _to ≥n -1000 ^n-1 recognized by ignition pulses and depending on the requirements according to the absence zon two to about five ignition pulses with a disconnection of the output stage responds becomes. This switch-off can then be canceled again with the corresponding speed position after the arrival of new ignition pulses, if the line originating from terminal 1 of the internal combustion engine has a loose connection.

The exemplary embodiment shown in FIG. 5 of a completed safety emergency running device with a large number of optional configurations shows the individual assemblies in dashed lines, components identical to the preceding exemplary embodiments and carrying out the same functions being identified by the same reference numerals; comparable components are marked with the same reference symbol and additionally with a comma at the top.

The circuit shown in FIG. 5 comprises the block 35, which is responsible for the control and regulation of the system functions and contains microprocessors, microcomputers, logic control or sequence circuits, with a microcomputer 10 ', memory 21' and a stabilizer circuit 36, the output stage 13 ', the block 26 'for the output stage shutdown, a failsafe or safety circuit 28', a circuit 37 for processing the output stage monitoring signals Ü1 and Ü2 and an emergency operation circuit 38.

The emergency running circuit 38 is only provided as an option; if it is present, then in the practical exemplary embodiment the output stage shutdown 26 ′ and possibly also the conditioning of the output stage monitoring signals by the circuit 37 can be dispensed with.

Different from the exemplary embodiment shown in FIGS. 1 and 2 is first of all that the failsafe circuit 28 ', which can also be referred to as a so-called watch-dog circuit, as control pulses now the control signal pulses THV issued by the microcomputer 10', which the Duty cycle n contained according to the bypass cross-section required by the computer for the respective operating state, are supplied.

At the same time, the THV pulses reach the output stage 13 'via a comparator K1 which is additionally provided, the reference input generated at 39 being fed to the other input of K1.

The basic function is as follows, the special structure of the failsafe circuit 28 'and the emergency running generator being discussed further below. Since the switching transistors T1 and T2 can only work alternately, however, for safety reasons, as can easily be seen, only the "opening" of the two-winding turntable by means of the transistor T2, which was last actuated as agreed, is basically only necessary for the microcomputer 10 ' the collector signal of the transistor T2, pulse-shaped by the one pulse shaping stage 37a from the series resistor R8, followed by the parallel connection of the diode D4, the resistor R10 and the capacitor C2 as a final stage monitoring signal U2.

The computer then queries the pulse ratio via Ü2 for correctness very shortly before and very shortly after each new duty cycle output. If the computer detects a deviation in the duty cycle, it itself sets the output EA (output stage shutdown) to low and the output stage switching transistors T1 and T2 are de-energized via the additional comparator K2 and the transistors T4 and T5 already mentioned above. As a result, the two-winding turntable, which is connected to the switching points M1, M2 and M +, is de-energized and the spring pulls it back to the specified safety cross-section, which, for example, corresponds to a speed of around 1400 n- ¹ when the engine is warm.

It is important to include the failsafe Switching into the safety concept in that the failsafe circuit 28 'on the one hand monitors the output of the control signal pulse train THV from the computer and also switches off the output stage via K2, T4 and T5 via the reset signal it issues and the diode ü3 when the failsafe lmpulse = no duty cycle impulses from the computer, for example in the event of a computer fault, at start-up and the like.

The structure and function of the failsafe circuit are as follows. The THV drive pulses from the computer reach a transistor T6 via a diode D6, which charges a storage capacitor C3. The storage capacitor C3 is connected to an inverting input of a threshold stage, which is represented in a known manner by a comparator K4 with appropriate wiring. A resistor R16 and a series connection of a resistor R17 and a diode D7 are arranged in a negative feedback branch to the inverting input. Thus, depending on the logic low or high level at the output of the comparator K4, the storage capacitor C3 is either discharged or charged, the switching times and thus the pulse duty factor, which is contained in the reset signal output before the failsafe circuit 28 ', can be freely set in wide ranges. It is therefore in this embodiment, if the THV control pulses from the microcomputer 10 'fail, which can correspond to a computer continuous fault, the failsafe circuit 28', which takes over and as a square wave oscillator with a duty cycle of low, for example 135 ms and high, about 18 ms in reset Signal works. The reset signal then goes, as already explained further above, to the reset and restarting to the microcomputer 10 'and reaches the output stage switch-off 26' via the diode D3, which due to the high phases and the resulting influence on the emergency running cross-section on the two-winding Rotary adjuster idle speed changes between 200 to 300 n- ¹ up or down can result.

The alternative embodiment with the emergency running generator 38 comprises a free-running oscillator 01, formed by a comparator K3, which is also coupled via a resistor R18 and is negatively coupled via a resistor R19, a capacitor C4 being connected in parallel with the resistor R20 to ground from the inverting input is. The emergency operation signal 'NOT, as indicated by the dashed connecting line L1, reaches the inverting input of the comparator K1 connected upstream of the driver transistor TO, but can also control the output stage at another point, for example directly at the base of the driver transistor T0. The limp-home generator 28 can be started by the reset signal of the failsafe circuit 28 'via a diode D8, but it can also oscillate continuously with a predetermined pulse duty factor such that in normal operation this is within the pulse duty factor sequence of the drive pulse sequence THV typically output by the microcomputer 10' and therefore in this case does not come into effect. If the emergency stage duty cycle is supplied to the end stage 13 'by the generator 38, then neither the shutdown via the end stage shutdown 26' nor the return of the end stage monitoring signals Ü1, Ü2 to the microcomputer 10 '; however, an advantageous embodiment of the invention can include both measures, because in the event of an error in the power stage shutdown 26 ', the emergency operation signal then brings the position of the slide of the two-winding rotary actuator into an uncritical range.

In a further embodiment of the present invention, the pulse shaper stages 37a, 37b are connected in parallel in front of the respective connection resistors R8 and R7, that is to say in each case starting from the circuit points M1 and M2, interference protection zener diodes D9, D10; Furthermore, with regard to the security concept, it can be useful to carry out the generation of the output stage monitoring signals U1, U2 with high impedance by inserting comparators into the two connecting lines back to the computer, as indicated at 40, which makes it possible to switch off the Decisive current at least in the UP winding of the two-winding turntable. A simple transistor stage (emitter circuit) is also useful here if the semiconductors are integrated on an IC or hybrid.

A further embodiment includes the insertion of an additional emitter resistor Rx from the emitter of the output stage cut-off series resistor T5 to ground and, in parallel with the base-emitter resistor, the arrangement of a zener diode D11 in this transistor, optionally in series with a further diode D12. This results in an effective current limitation which, based on the duty cycle output by the computer, also absorbs an actuator short circuit.

Similarly, for the purpose of current limitation, the switching transistors T1 and T2 can optionally have an additional emitter resistor R21, R22 and a limiting diode path parallel to the resistor connected from the base to ground, either from the series connection of a zener diode D12, D13 with a further diode D14, D15 or be equipped only from the Zener diode D12, D13.

The basic function of the circuit of FIG. 5 is explained below on the basis of the signal curves shown in FIG. 6.

The duty cycle control signal THV output by the microcomputer 10 'passes via the comparator K1 and the driver transistor TO to the first switching transistor T1 of the output stage. Since the signal designations of the pulse sequences are indicated on the individual curve profiles of FIG. 6, the further functional sequence can be followed by observing the signal pulse sequences. When THV = Iow, the first switching transistor T1 is conductive, it then leads the one connected to it the UP winding of the two-winding turntable nominal current and the second switching transistor T2 is blocked by the divided saturation voltage of the transistor T1. The CLOSE winding of the two-winding turntable is de-energized.

With THV = _hi g _h , the first switching transistor T1 is blocked, the UP winding, which is connected to the switching point M1, only carries the base current for the second switching transistor T2, which in an exemplary embodiment shown can be approximately 1/22 of the winding current. The CLOSE winding carries nominal current.

The opening cross-section on the two-winding turntable is directly proportional to the ratio of the currents in the switch-on times. The characteristic curve shift in the UP direction caused by the base current of the transistor T2, which is also dependent on the duty cycle, can be taken into account when constructing the two-winding rotary actuator. The output signal at the collector of transistor T2 is inverted to the THV control signal; This signal is limited by the simply constructed pulse shaper stage 37a and fed back to the microcomputer 10 'as a Ü2 output stage monitoring signal. During an active rest phase (the reset signal is low), the output stage shutdown signal EA, which is output by the microcomputer 10 ', is clamped to low by the direct link via the diode D3 to the output of the failsafe circuit 28', whereby the comparator K2 and the driver transistor T4 block the series transistor T5 to the output stage switching transistors and the two-winding turntable windings are accordingly de-energized. Only the signal shaping stage 37a and possibly 37b draw a current from the CLOSE winding or the OPEN winding which is additionally reduced by comparators 40 which are optionally connected downstream. The built-in spring adjusts an emergency running cross-section for the two-turn turntable.

After the reset phase has elapsed at time t ₁ and after the completion of initialization routines up to time t _2, the microcomputer 10 'begins with the output of an emergency duty cycle according to its design, until it receives the data on the speed it has received , Temperature and other parameters. This emergency duty cycle of the computer itself can have a duration of one to two periods and extends in the signal curves of FIG. 6 to the point in time t _s , at which point the control then begins, from which point in time the pulse duration T _{NOT changes} into the calculated one Functional duration T = f (v, n, ...).

After each THV pulse output, for example at time t, the computer checks after a specified period of time t ₈ ―t ₇ ∞100 us that the Ü2 or. Ü2 and Ü1 signal level with the THV signal level. In the event of a deviation, for example a disturbance at time t _B - the transistor T2 no longer blocks, the Ü2 signal is not switched up during the period t ₁₀ ... "The computer via its I / O line (signal goes low) and the comparator K2 ultimately turns off the transistor T5 and de-energizes the actuator.

A power amplifier monitoring routine in the microcomputer 10 'then checks after a predetermined time, for example every 2 seconds, by switching on the EA line and corresponding interrogation of the Ü2 return line after a predetermined time, for example after 100 ps (this corresponds to approximately five times the duration of the transistor switching times including filtering) whether the malfunction is still relevant. Any resulting influencing of the actuator current by this brief query does not essentially lead to a change in the emergency running cross section set by the spring on the two-winding rotary actuator.

If, on the other hand, there are permanent computer faults, then, as already mentioned, the failsafe circuit 28 'takes over as a rectangular oscillator. She works' to be able to send possible reset and re anwer ^f s, where the reset phases also result in only a slight influence on the Notlaufquerschnittes the controller with its reset signal to the microcomputer 10th

After switching off the power stage via the EA signal from the computer at time t ₁₁ ―, the Ü2 signal (and also the Ü1 signal) must return to a high level; if this is not the case, for example in the event of an external short to ground, then the output stage remains switched off due to the computer programming being made.

2, the monitoring of the output stage output signals of both switching transistors has already been shown, as a result of which winding short-circuits or permanent short-circuits are covered and, in the event of a fault (Ü1 or Ü2 signal incorrect), the procedure is analogous, as just described .

• 1. Betriebs-Reset
• 2. Programmüberwachung
• 3. Überwachung des Tastverhältnis-Ansteuersignals für die Endstufe
• 4. Erkennung interner und externer Störungen
• 5. Erkennung von Dauerstörungen
• 6. Erkennung von Batteriespannungseinbrüchen
• 7. Steuerung eines gegebenenfalls vorhandenen Notlaufgenerators
• 8. Abschaltung der Endstufe
• 9. Abschaltung des Rechnerports

Accordingly, the following safety functions result in the present invention: Active by switching means, the performance of the failsafe circuit (watchdog) being considered first:

• 1. Operational reset
• 2. Program monitoring
• 3. Monitoring the duty cycle control signal for the output stage
• 4. Detection of internal and external faults
• 5. Detection of permanent disturbances
• 6. Detection of battery voltage drops
• 7. Control of an optionally available emergency running generator
• 8. Switching off the power stage
• 9. Shutdown of the computer port

• 1. wird im Reset-Fall aktiv geschaltet
• 2. Ausgabe eines Notlauf-Tastverhältnis-Ansteuersignals

With existing emergency running generator:

• 1. is activated in the event of a reset
• 2. Output of an emergency running duty control signal

• 1. Notlauf-Tastverhältnis-Ansteuerimpulsfolge, ausgegeben vom Rechner selbst bis zur ersten Drehzahlerkennung
• 2. Ausgabe eines Wertes t_mln (v) bei Ausfall des Temperaturgebers
• 3. Erkennung einer NTC-Unterbrechung
• 4. Selbsttestprogramm zur Abschaltung der Endstufe bei Programmfehlern oder Störungen (Reset)
• 5. Testroutine zur Überprüfung der Endstufe, Überwachung und Abschaltung
• 6. Abschaltung der Endstufe im Störfall.

Finally, the present invention also includes the following security features by appropriate training and input of information to the microcomputer (10, 10 '):

• 1. Emergency running duty cycle control pulse sequence, issued by the computer itself until the first speed detection
• 2. Output of a value t _mln (v) if the temperature sensor fails
• 3. Detection of an NTC interrupt
• 4. Self-test program for switching off the power stage in the event of program errors or faults (reset)
• 5. Test routine for checking the power stage, monitoring and switching off
• 6. Switching off the output stage in the event of a fault.

Claims (15)

1. Emergency-running safety device for idling operation of motor vehicles comprising an idling fuel inlet control, consisting of an air bypass in parallel with the throttle valve the flow cross section of which is controllable by an actuator (14a) of an actuating device (14) driven by an output stage circuit (13), in which arrangement the required actuator position results from the duty ratio of a digital drive signal (THV) generated by a microcomputer (10, 10'), furthermore comprising a safety circuit (28) which detects a defect in the microcomputer and generates a signal, which is independent of the microcomputer, for driving the actuating device, characterized in that the actuating device is a rotary two-winding actuator (14) the position of which results from the manner in which pulsed signals are supplied to the two part windings of the rotary two-winding actuator via the output stage, that furthermore the signal generated and pulsed by the microcomputer is monitored at at least one output (M1, M2) of the output stage and in the event of deviations from its drive signal the output stage (13) is switched off by the microcomputer (10) in such a manner that an actuator emergency-running position results from a mechanical pretensioning element (spring 16) at the actuator.

2. Emergency-running device according to Claim 1, characterized in that the reset output signal of the fail-safe circuit (28) and the switch-off signal (EA) from the computer (10, 10') are supplied via an OR gate (25) to the switch-off stage (26, 26') for the output stage (13, 13').

3. Emergency-running device according to Claim 1 or 2, characterized in that the microcomputer (10, 10') exhibits inputs for signals corresponding to operating parameters (rotational speed n, engine temperature v, environmental temperature, pressure, quantity of air sucked in Q) and a data memory (21) for compensating nonlinearities of the data supplied to the computer for determining the actuator position.

4. Emergency-running device according to one of Claims 1 to 3, characterized in that the output stage exhibits two series-connected switching transistors (T1, T2) which in each case load one actuator part winding (15a, 15b) and which are driven via a preceding driver transistor (TO) and possibly a further preceding comparator (K1) by the duty ratio drive signal (THV) of the microcomputer (10, 10') in such a manner that the switching transistors (T1, T2) of the output stage (13, 13') in each case alternately supply the nominal current to their associated part windings.

5. Emergency-running device according to Claim 4, characterized in that an output stage switch-off stage (26, 26') is provided, comprising at least one series transistor (T5) in series with the combined switching paths (emitters) of the switching transistors (T1, T2), the switch-off signal (EA) from the microcomputer (10, 10') being supplied to the series transistor via another preamplifier transistor (T4) and the reset signal of the fail-safe circus (28, 28') being directly supplied to its base voltage divider (R14, R13, R15) via a diode (D3).

6. Emergency-running device according to Claim 4 or 5, characterized in that feedback signals (U1, U2) corresponding to the drive duty ratio are derived from at least one of the part windings (15a, 15b) connected to the associated collectors of the respective switching transistor (T1, T2) of the output stage (13, 13') via pulse shaper stages (37a, 37b) and are supplied to corresponding test connections of the microcomputer (10, 10') which, in the event of deviations from the calculated duty ratio (m), outputs the switch-off signal (EA) and supplies it to the switch-off stage (26, 26') of the output stage (13, 13').

7. Emergency-running device according to one or more of Claims 1 to 6, characterized in that, at least for supplying battery voltage and engine temperature signals to the microcomputer (10, 10'), converters (18, 19) are provided which convert corresponding voltage signals into logic- compatible time-duration signals which can be evaluated by the microcomputer (10, 10').

8. Emergency-running device according to Claim 7, characterized in that the converters (18, 19) comprise a comparator (K10) to one input of which a reference signal is supplied and to the other input of which the output signal of an energy accumulator (capacitor C3), which is charged by the voltage (Us), to be converted, is supplied via a switch (series transistor T6), that the microcomputer (10,10') itself, forthe purpose of interrogation, generates an interrogation signal at a predetermined time and by means of this signal cuts off the series transistor (T6) and that the period of the discharging of the storage capacitor (C3) until the voltage drops below the threshold voltage, at which time the comparator (K10) outputs a switch-over signal to the microcomputer (10, 10'), is evaluated as a measure of the converted voltage.

9. Emergency-running device according to one of Claims 1 to 8, characterized in that the computer interrogates for a short time before and for a short time after each new duty ratio output the duty ratio of the fed-back output stage monitoring signals (U2, U1) and, if deviations are found, switches the rotary two-winding actuator to be de-energized by the output stage switch-off signal (EA) going to low in the case of a fault.

10. Emergency-running device according to one or more of Claims 1 to 9, characterized in that interference protection Zener diodes (D9, D10) are connected to earth from the interrogation circuit points (M1, M2) for at least one output stage monitoring signal (U1, U2).

11. Emergency-running device according to one of Claims 1 to 10, characterized in that comparators (40) or transistors are connected between the pulse shaper stages (37a, 37b) and the corresponding inputs at the microcomputer (10, 10') for generating the output stage monitoring signals (U1, U2) in a high-impedance and therefore current-reducing manner.

12. Emergency-running device according to one of Claims 1 to 11, characterized in that, for the purpose of current limiting, for example in the case of an actuator short circuit, an additional current limiting resistor (Rx) is connected in series with the switch-off transistor (T5) of the output stage switch-off block (26, 26'), preferably in conjunction with the parallel connection of a Zener diode (D11) in series with another diode (D12) in parallel with the base pull-down resistor.

13. Emergency-running device according to one of Claims 1 to 12, characterized in that current- limiting resistors (R21, R22) are connected in the emitter lines of the switching transistors (T1, T2) of the output stage (13, 13'), preferably in conjunction with a series diode circuit (D12, D14; D13, D15) connected in parallel with the base pull-down resistor of each switching transistor.

14. Emergency-running device according to one of Claims 1 to 13, characterized in that, in the event of permanent computer disturbances, the fail-safe circuit (28, 28') operates as square wave oscillator with a greatly restricted duty ratio, in such a manner that any influence on the spring- pretensioned emergency-running cross section of the actuator (rotary two-winding actuator) remains slight.

15. Emergency-running safety device according to Claim 1, characterized in that the output stage exhibits two series-connected switching transistors (T1, T2) which in each case load one actuator part winding (15, 15a) and which are driven via a preceding driver transistor (TO) and possibly a further preceding comparator (K1) by the duty ratio drive signal (THV) of the microcomputer (10, 10'), in such a manner that the switching transistors (T1, T2) of the output stage (13, 13') in each case alternately supply the output current to their associated part windings and that, in addition, the signal generated and pulsed by the microcomputer is monitored at at least one output (M1, M2) of the output stage.

Images