EP0350082A2 - Fail-safe and back-up method and apparatus for an engine with self ignition - Google Patents

Abstract

In a safety and emergency driving procedure with a device for carrying it out, it is proposed to form an emergency driving branch acted upon by its own speed supply device, which specifies a speed-dependent characteristic curve of the minimum control path quantity and to which, in the event of safety, a switch is made when a modified idle signal and the condition occur at the same time results in the actual control path value being greater than a minimum control path specified for this case. Further peripheral switching means are provided which relate to the formation of a start hysteresis, an overturn protection, the monitoring of the actual control value transmitter and the possibility that a separate monitoring device assigned to the main computer also switches over to the emergency driving branch independently of external signals.

Description

State of the art

The invention is based on a method and a device according to the category of the independent claims. It is known to use electrical signal boxes controlled by electrical signals for the electronic control of the operation of self-igniting internal combustion engines (diesel engines), a central control unit generating the necessary control signals instead of mechanical fuel metering and control systems. Mechanical fuel metering systems in diesel engines are reliable in terms of their reliability, but they may be less and less able to take into account the multitude of different operating conditions and environmental influences today.

The use of electronic components in connection with an electronic diesel control (EDC) makes extensive safety, monitoring and emergency driving measures desirable even when the individual components already has possibilities for error detection and, if necessary, healing.

In a safety device for an internal combustion engine with auto-ignition, it is known (DE-OS 33 01 742), continuously certain signals relating to the operation of the internal combustion engine, such as accelerator pedal position, calculated setpoint of the control path, speed, brake pedal position and the like. and to create a corrected control path setpoint by selecting the minimum value and feeding it to the controller of the EDC system. This corrected control path setpoint also serves to determine a control path deviation, including a feedback of the control path actual value signal. If the predetermined limits are exceeded, the known safety device either reacts by switching off the injection pump, de-energizing the output stage of the controller or introducing emergency operation. Problems may arise with this known safety device, however, because not all conceivable boundary conditions are included in the detection of the safety conditions. Thus, an idle signal can be obtained by a corresponding idle contact on the accelerator pedal - but this is not valid if, for example, the internal combustion engine is equipped with a cruise control.

It is therefore the object of the present invention in a electronic diesel control (EDC) to create a comprehensive safety and emergency driving device, which on the one hand prevents the engine from running under all circumstances, on the other hand largely enables emergency operation of the vehicle and also properly takes into account the occurrence of peripheral conditions that are not to be expected.

Advantages of the invention

The invention solves this problem with the characterizing features of the independent claims and has the advantage that a safety case is reliably recognized in connection with a vehicle speed control and, when a safety case occurs, a control path (the injection pump) that is harmless both for the internal combustion engine and for driving operation. is switched over, sharp torque jumps are avoided in the event of incorrect quantity signals specified by the main computer. It is also advantageous that, even if you have to switch to a minimum characteristic curve of the control path, the automatic start quantity control is enabled, for example, during a cold start and is only reset to the normal minimum control path characteristic curve after the so-called normal start shedding speed has been exceeded for the first time (RWmin characteristic curve).

Another advantage of the present invention is that when a faulty setting of the control path is detected, either the control is switched to a second branch in the input of the control, or a second, redundant control is applied at the same time, thereby also protecting defects in the control that is normally present . There is also a possibility here Possibility to switch back to the first controller when normal operation is resumed, for which purpose corresponding switch-back criteria have been developed.

The switchover to emergency operation can take place either on the basis of separate monitoring of the main computer function by a dedicated monitoring system (watchdog) or by detection of a special redundant idle signal which, in conjunction with a feedback of the actual position of the control rod position (RWist), causes the switchover to the redundant control controller, to which additional, minimum setpoint generating blocks are assigned, which can also be acted upon by their own speed sensor.

Advantageous further developments and improvements of the invention are possible through the measures listed in the subclaims.

drawing

• Fig. 1 in vereinfachter sche­matischer Darstellung eine Brennkraftmaschine mit Selbst­zündung und ihren wesentlichen zugeordneten Komponenten einschließlich Istwertgebern,
• Fig. 2 ein Blockschaltbild einer umfassenden Sicherheits- und Notfahreinrichtung,
• Fig. 3 in Form eines Diagramms den für den Notfahrzustand vorgegebenen Regelweg über der Drehzahl unter Einschluß einer sogenannten Starthysterese,
• Fig. 4 in Form diskreter Gatterschaltungen eine Verarbeitungsmöglichkeit externer Betriebsgrößen zur Erfassung des Sicherheitsfalls, bei dem umzuschalten oder entsprechend vorgegebenen Kennlinien ab­zuregeln ist,
• Fig. 5 in Form eines Diagramms den Verlauf der zugeführten Einspritzmenge über der Zeit bei Auftreten eines Sicherheitsfalls und
• Fig. 6 in Form eines Blockschalt­bilds Umschaltmöglichkeiten auf einen Ersatzregler bei gleichzeitiger, durchlaufend erfolgender Beobachtung des ersten Reglers oder Normalreglers auf Wiederverwendbarkeit.

Embodiments of the invention are shown in the drawing and are explained in more detail in the following description. They show (also to clarify the environment of the invention)

• Fig. 1 in a simplified schematic representation of an internal combustion engine with auto-ignition and its essential associated components including actual value generators,
• 2 is a block diagram of a comprehensive safety and emergency driving device,
• 3 shows, in the form of a diagram, the control path for the emergency driving state over the rotational speed, including a so-called start hysteresis,
• 4 in the form of discrete gate circuits, a processing option for external operating variables for detecting the safety event in which the switchover is to be carried out or to be regulated in accordance with predetermined characteristic curves,
• 5 shows in the form of a diagram the course of the supplied injection quantity over time when a safety event occurs and
• Fig. 6 in the form of a block diagram switching options to a replacement controller with simultaneous, continuous observation of the first controller or normal controller for reusability.

Description of the embodiments

In Fig. 1, the internal combustion engine with auto-ignition (diesel engine) is designated 10; it has an intake pipe 11 and an exhaust pipe 12. A fuel injection pump 13 is connected via a pressure line 15 to an injection valve 14, which is shown here schematically as representative of the required quantity of injection valves. The injection valve 14 can comprise an injection initiator 16, which feeds a redundant speed signal to a speed signal detection and processing block 17 via a connecting line 16a indicated by dashed lines, or which conveys this speed signal to further processing blocks.

To obtain speed, a speed sensor 18 is provided, which detects the speed of the internal combustion engine, for example, via a ring gear 19 driven by its crankshaft, and its output with the speed signal Detection block 17 is connected. It goes without saying that the manner in which the signals used for the security system according to the invention are obtained is only shown by way of example in FIG. 1 and the subsequent figures; the signals used in each case can also be derived in a different way from the operating states of the internal combustion engine. Furthermore, it is expressly pointed out that the block diagrams shown in the drawings, which indicate the inventions on the basis of discrete switching stages, do not limit the invention, but rather serve in particular to illustrate the basic functional effects of the invention and to indicate special functional sequences in a possible form of implementation. It goes without saying that individual modules and blocks can be constructed using analog, digital or hybrid technology, or else, in whole or in part, corresponding areas of program-controlled digital systems, for example microprocessors, microcomputers, digital or analog logic circuits and the like. can include. The description of the invention given below is therefore only to be evaluated as a preferred exemplary embodiment with regard to the overall functional and time sequence, the modes of action achieved by the blocks discussed in each case and with regard to the respective interaction of the sub-functions represented by the individual components, the references to the individual Circuit blocks are made for better understanding.

Roughly schematized, the block diagram representation of FIG. 1 also shows, in addition to the speed signal N present at the output of the speed detection block 17, further means for signal acquisition. The actual value of the control path RW is, which from the position of the control rod 13a Fuel pump 13 is generated for example via an actual value transmitter or converter for the control path, an accelerator pedal position signal FFG (foot pedal), for example detected by the position of a tap of a potentiometer 22 which is mechanically connected to the foot pedal 21, from which signal also an accelerator pedal idle signal FFG-LL can be derived, but this can also be generated in the same way by an idle contact switch on the foot pedal.

Furthermore, the acquisition of a brake signal BS via a suitable contactor 24 assigned to the brake pedal 23 is also of importance, which can also operate the brake lights 25 or generates the brake signal separately. Such a brake contactor can also be part of a pressure switch arranged in the brake cylinder.

A central control unit 26, which contains a main computer and further peripheral circuits, is provided for electronic control and guidance of the injection pump 13. As indicated at 27, the control device 26 is supplied with a large number of external operating signals, circulation signals and setpoints and the main computer contained in the control device 26 then uses these input values to generate at least one signal for the setpoint of the control path RWsoll, which is fed to a downstream control controller 27 which has a predetermined control behavior and is usually a so-called PID controller, which controls the actuator 28 via a current controller output stage (not shown in FIG. 1), which moves the control rod 13a into the respectively desired position.

All or part of the signals mentioned here go, except there of that they also act on the central control unit 26 at 27, lead to a safety and emergency drive device which, as is understood, can also be part of the central control unit 26, for example can be contained as an additional program block in the main computer or on others , any way is realized.

A block diagram of the safety and emergency driving device 29 is shown in detail in FIG. 2 and its structure is first explained below. Components of the central control device 26 and the safety and emergency driving device 29 are shown in an interlocking manner in FIG. 2 - the main computer is designated 30, a monitoring function (watchdog) controlling only essential functions of the main computer is designated 30a. A first speed signal N comes from a normal speed sensor 31, for example formed by a disk 32 with signal markings that rotates synchronously with the internal combustion engine, a sensor 33 that responds to this, a downstream pulse shaper stage 34 to the main computer 30, which receives the speed signal and the input 35 Accelerator pedal signal FFG, usually evaluated with further variables that are not of interest in this context and generates a control path setpoint RWsoll and supplies it to a first control controller 36 via the output line 30b. A current controller 37 connected to the output of the controller 36 (PID controller) directly controls the actuator 38 for the control rod position with its output stage. A feedback actual value of the control path RWist reaches line 39 to the input of the controller 36, whereby the loop is closed for the execution of the normal functions.

At least one auxiliary speed sensor or replacement speed sensor 31 'is provided, which can also be a spray start sensor (SB sensor), the output signal of which can be used as a replacement speed signal if the normal speed sensor 31 fails. The following conditions apply to the starting process, checking for the presence of this replacement speed sensor and use of the same:

When the voltage is switched on, the starting quantity is output as the setpoint for the interlocking control, but the output is only carried out if a fault in the measurement of the internal resistance of the replacement speed sensor has not been detected by a replacement speed sensor monitoring. A fault detection of the sensor internal resistance only leads to the release of the starting quantity when a predetermined speed threshold is reached, determined from pulses from the normal speed sensor.

• 1. Als Startmengen-Abwurfdrehzahl (also als Drehzahl, bei welcher die zuzuführende Kraftstoffmenge nicht mehr aufgrund von Startbedingungen bestimmt wird, sondern aus normalen äußeren Betriebsbedingungen) wird eine feste Abwurfdrehzahl vorgegeben;
• 2. es wird auf ein geändertes Fahrverhalten-Kennfeld umge­schaltet, wobei bei der Auslegung dieses Kennfelds folgendes gilt:
  • a) für die Fahrpedalstellung O ist eine Restmenge für die Einspritzmenge vorzugeben, die bei jeder Dreh­zahl im Nutzbereich eine sichere SB-Auswertung zu­läßt (auch über die Abregelung hinaus sowie bei Drehzahl 0). Diese Restmenge liegt unterhalb des Null-Lastbedarfs des Motors -
  • b) die Vollastmenge wird über die oberste Kennlinie des Fahrverhalten-Kennfelds definiert, sie muß deut­lich unter der Saugmotorvollast liegen. Auch die Ab­regeldrehzahl wird (als Bestandteil des Fahrverhalten-­Kennfelds) deutlich herabgesetzt -
  • c) die Leerlaufdrehzahlregelung wird über das Fahrver­halten-Kennfeld bei Leerlauf (Fußfahrgeber = 0 - FFG = 0) realisiert. Es wird eine gegenüber Normalbetrieb er­höhte Leerlaufdrehzahl vorgegeben.
• 3. Falls normalerweise SB-Regelung durchführt wird, wird Umschaltung auf SB-Steuerung vorgenommen.

If the SB encoder is used as a replacement speed encoder, the following functions change for the quantity and spray start control in the event of failure of the normal speed encoder:

• 1. A fixed discharge speed is specified as the starting quantity discharge speed (that is, the speed at which the fuel quantity to be supplied is no longer determined on the basis of starting conditions, but rather from normal external operating conditions);
• 2. It is switched to a changed driving behavior map, the following applies when designing this map:
  • a) For the accelerator pedal position O, a remaining quantity for the injection quantity is to be specified, which allows reliable self-evaluation at any speed in the useful range (also beyond the limitation and at speed 0). This remaining amount is below the zero load requirement of the engine -
  • b) The full load quantity is defined via the top characteristic of the driving behavior map, it must be clearly below the naturally aspirated full load. The regulation speed is also significantly reduced (as part of the driving behavior map) -
  • c) the idle speed control is implemented via the driving behavior map at idle (foot throttle = 0 - FFG = 0). An idle speed that is higher than normal operation is specified.
• 3. If SB control is normally carried out, switchover to SB control is carried out.

If, instead of the start of injection sensor SBS, any other speed sensor 31 ', as already mentioned above, is used, then this can be used, for example, as a speed sensor on the starter ring gear. In order to arrive at the usual speed signals in self-igniting internal combustion engines (the injection start sensor generates a signal, for example, only every two crankshaft revolutions) and in order not to overload the main computer 30 due to the high frequency of the speed pulses caused by the pulse detection via the starter ring gear, the pulse shaping circuit 34 'is one Divider circuit 42 connected downstream, which is provided for the safety and emergency driving case and in this respect reduces redundant speed signals to approximately the same frequency as the SB signal. In Fig. 2 it is shown that the main computer 30 receives normal and substitute speed signal, but the safety and emergency driving devices are supplied with speed information by the normal speed sensor via the speed processing block 41. It is equally possible to supply the S + N device or part of it with speed information from the replacement speed sensor.

The further safety and emergency driving arrangements of FIG. 2 are explained below in connection with the safety cases that occur in each case and the functions resulting therefrom.

In order to check whether the control actual travel RWist is below a predefined size RWmin when the accelerator pedal is in an idle position position (FFG-LL signal), it is in any case not possible to simply link these sizes if the internal combustion engine is operated with a travel speed control FGR, which is based on the main computer 30 in its control function.

The actual value of the control path RWist therefore reaches a comparator 43 via a branch line 39 ', the other input of which supplies an RWmin specification relating to the respective speed from an RWmin characteristic block 44. The output signal of this comparator then represents a first and necessary signal, which is included in this check. In the case of a vehicle speed control, which is implemented in conjunction with an electronic diesel control (EDC), the accelerator pedal is in the LL position and nevertheless the internal combustion engine is supplied with a high injection quantity as required, which corresponds to a large control path RWist.

For this reason, FFG-LL detection, that is to say the detection and evaluation of the idle position of the pedestrian, must be prevented in the FGR vehicle speed control.

It is a feature of the present invention, via the brake signal BS supplied at the input 45 and a driving speed ditäts-control signal (FGR signal) to create a so-called redundant, so additional idle signal LL *, namely by the link shown in the top center of Fig. 2, which works so that a possible vehicle speed control function FGR does not result in faulty idling -Position detection leads.

In the exemplary embodiment shown, the linkage takes place by means of a linkage circuit 46, which consists of two AND gates 46a, 46b and a downstream OR gate 47. At the output of this OR gate, the redundant idle signal LL * results only if there is either no vehicle speed control function (is recognized by the negation at the corresponding input of the AND gate 46b) and at the same time an idle signal FFG-LL is present by the pedestrian the vehicle speed control function is available, but the brake is applied. Such a combination must not occur in normal operation because the FGR function must be eliminated when the brake is actuated. Both signals arrive at the same input via the OR gate 47 as an LL * signal on the one input of a further gate circuit connected downstream, namely an AND gate 48, which then serves together with the redundant idle signal LL * and the check for that If necessary, the comparator 43 supplied RWmin signal to switch over to a control path that is safe for the engine and driver.

Since a computer delay or signal delay or actuator delay may have to be expected here, the AND gate 48 is followed by a delay block 49, which only controls a downstream reaction element for immediate actuation when a predetermined time period T has expired. The reaction element is shown to illustrate the function as a bistable flip-flop 50 with the inputs S / R, but can also be implemented differently in a computer be (e.g. setting a flag). The flip-flop 50 is set at its input S when the security event occurs with consequences to be explained below and is reset at its input R, as can be seen, via an OR gate 51 immediately when the redundant idle signal LL * and moreover when a signal is supplied from a start hysteresis block 52 which indicates a start process, as will be explained below.

If a minimum control range RWmin is specified in this context with a fixed lower limit speed threshold, problems also arise for emergency operation, since sharp torque jumps can then occur at this limit speed if the quantity signal specified by the computer is incorrect. According to a feature of the present invention, the limit speed threshold concept is therefore replaced by a speed-dependent control path characteristic for minimum control path RWmin, as indicated in the characteristic block 44 in FIG. 2 and shown in detail in the diagram in FIG. 3. The RWmin curve over the speed is shown in Fig. 3 in solid lines, it should be added that all the functions described in the form of characteristic curves can also be equipped with more or less complex and each and also here a minimum level that is found to be useful is described.

The RWmin characteristic curve over the speed consists of three branches a), b) and c), the branch a) being above a threshold _speed n _limit already mentioned and _{specifying control paths} that are below the zero load quantity requirement of the engine, but above that Control path which is output by the main computer for the idle position of the foot pedal in undisturbed operation; the below the limit rotation Number increasing branch b) allows idling control in emergency driving mode, but is above the idling control characteristic for normal operation, while the third branch c) allows control paths that enable a cold start.

On the other hand, such an RWmin characteristic curve can jeopardize an automatic start quantity control by the electronic diesel control EDC, which wants to release more start quantity (correspondingly larger control path RW) than the RWmin characteristic curve in FIG. 3 allows during a cold start. For this reason, in one embodiment of the present invention, this RWmin characteristic curve is provided with a hysteresis for the start case, which is recognized by block 52 in FIG. 2, which can also be responsible for the change in the RWmin curve to be explained below is shown in dashed lines in Fig. 2 as RWmin 'and causes a shift towards higher speeds when switched on for the first time. In this case, the diagram in FIG. 3 also has a dash-dot line and I denotes the normal starting quantity curve over the rotational speed.

After exceeding the normal take-off speed for the first time (plus a safety margin), RWmin ′, i.e. from the expanded hysteresis configuration, then resets to the normal RWmin characteristic.

The comparator 43 compares the RWmin value taken from the RWmin characteristic with the actual RWist value If an incorrect setting of the control path RW is determined, that is, if RWist is greater than RWmin and the idle condition LL * occurs at the same time, then after the delay time specified by the delay block 49, the flip-flop 50 is set, which via its output FFA and a downstream OR- Link 53 switches the control of the control path to a second branch, which then, when this security event occurs, regulates to the RWmin characteristic curve just described in detail, and at the same time, via return line 54, notifies the main computer 30 of this security event that has occurred.

In order to be able to regulate the RWmin characteristic curve for emergency driving operation in the event of a safety event, the input of the control regulator 36 can then be switched to the output of the RWmin characteristic curve generation block 44, which is not shown in the drawing in FIG. 2, i.e. you continue to work with the same controller 36 or you can (alternatively) switch to a second redundant controller 36 ', namely by actuating a switch 55 from the output of the flip-flop 50, since in this way defects of the normal controller 36 are secured.

Such a switchover via the OR gate 53 is also carried out when it is ascertained, namely via the watchdog 30a monitoring circuit of the main computer 30, that the main computer 30 itself is not operational, that is to say is defective, has a too low voltage or the like. Then watchdog 30a also switches switch 55 via line 56.

The safety flip-flop 50 is reset in any case if, as already mentioned, the empty running condition LL * is lifted again, or in order to bring the flip-flop 50 into the defined starting position via the start hysteresis block 52 under starting conditions.

The feedback of the switch over the line 54 to the main computer 30 is necessary because the latter itself (if necessary) carries out monitoring for system deviation or to manipulate the main computer 30 in the desired sense, since otherwise this additional redundant switch-off via an additional Actuator (e.g. shut-off valve for the fuel), even the system could shut down altogether.

An additional measure for pure operation via the RWmin characteristic curve is to additionally supply the RWmin characteristic curve generation block via the partial line 57a to the line 57 from the foot transmitter of a pedestrian signal FFG, which, added to the generated RWmin signal, allows any RW position to be regulated , so that an extended emergency drive is possible in a simple manner in the event of a main computer failure or failure of the components affected by the respective security case.

Another embodiment of the present invention is that a detection switch block 58 is provided for failure of the control transmitter; This detection circuit 58 is therefore additionally supplied with the actual value signal of the control path RWist generated and reported by the control path transmitter.

Any input signals linked to the actual position of the control path are supplied to the detection circuit 58, the control path failure detection then being carried out by a known measure of the so-called signal Range check is carried out. If the control path encoder is found to be defective, then according to a feature of the present invention, the real control path signal RWist (which is, however, no longer applicable) is no longer reported back to the position control (the control controller 36, 36 ') or to the main computer 30, but rather a simulated signal which is generated by switching a switch 59 to an RWist * generation block 60 caused by the detection circuit 58. This simulated signal is derived either from the controller output, as shown in FIG. 2, or from other available variables, for example also the output of the current controller 37 connected downstream of the controller. In this respect, however, the RWist generation block is an observer for the general case Position 38.

It is understood that, as is known per se, in addition to the measures taken so far, an overspeed protection circuit 61 is provided which acts directly on the output stage of the current regulator 37 past all blocks and prevents overspeeds.

Essential features of the present invention therefore consist in the fact that in addition to the redundant speed sensor 31 'or injection start sensor, a redundant idle signal LL * is generated, as is an RWmin characteristic curve, which can additionally experience a shift for extended emergency operation by signals from the driving foot sensor.

The RWmin characteristic curve is supplemented by a start hysteresis function, so that in addition to the extended emergency driving mode, starting processes are still possible. Switching to emergency operation is optional by acting on a reaction element, namely the flip-flop 50 or also via the watchdog directly assigned to the computer when the flip-flop switchover is reported. A redundant control controller is preferably provided, which is controlled by the RWmin characteristic curve generation for the safety case and switchover to emergency operation. Furthermore, by generating a simulated control path signal, an actual value that can be evaluated for emergency operation can be obtained. The actuator behavior can also be checked by including the actuator observer in accordance with the RWist * generation block 60 in the monitoring program.

Another problem for general safety and emergency operation in self-igniting internal combustion engines is that the foot pedal can jam or can no longer return to idle position or if the signal evaluation of the accelerator pedal sensor in the control unit is defective or the signal is interpreted incorrectly by the computer; in this case there is a risk that, even though the driver has taken his foot off the accelerator pedal, that is to say that there is an FFG-LL signal, the accelerator pedal is undesirable. Such unwanted accelerating can be prevented by additionally including a brake signal BS, which is then caused by the normal reaction of the driver, as a redundant safety signal, as also happened in FIG. 2, but then comes up against problems, if certain, at the beginning already mentioned cases of driving, for example, when the driver is driving fast, the accelerator pedal is not in the idle position or when, for example, to approach a type of anti-slip control or in sporty driving, the accelerator and brake are occasionally actuated at the same time.

If the injection quantity is then abruptly removed and either regulated to a control path that delivers a quantity of injection 0 with certainty, or even the output stage is blocked for the pump signal box, dangerous driving conditions can result because, in the latter case, the signal box control unit stops when it is switched on again Eliminating the safety case then undesirably long settling processes with in some cases considerable injection volume overshoots can occur and the abrupt switching off or taking away of the injection quantity during driving operation in any case causes considerable deceleration of the vehicle.

• 1. die Fahrpedalstellung nicht Leerlauf ist (FFG-LL) und
• 2a) entweder zuerst das Fahrpedal nicht in Leerlaufstellung ist und zeitlich nachfolgend das Bremsbetätigungssignal BS auftritt oder
• 2b) zuerst die Bremse betätigt wird (Signal BS) und zeit­lich nachfolgend das Fahrpedal nicht in Leerlaufstel­lung ist und für diesen Fall ferner die Fahrgeschwin­digkeit größer als eine vorgegebene Mindestsicherheits geschwindigkeit ist, also V< Vsmin.

In the case of the brake actuation, the procedure is such that an abrupt removal of the injection quantity is avoided for the cases described, with the triggering of a safety case for the computer only taking place as shown in FIG. 4 if

• 1. the accelerator pedal position is not idle ( FFG-LL ) and
• 2a) either first the accelerator pedal is not in the neutral position and the brake actuation signal BS subsequently occurs or
• 2b) the brake is actuated first (signal BS) and the accelerator pedal is subsequently not in the idle position and, in this case, the driving speed is also greater than a predetermined minimum safety speed, ie V <Vsmin.

It goes without saying that these conditions are not to be considered statically alone. The safety case should be canceled again if the LL position of the accelerator pedal is detected or the brake is released again, but not For example, if, after a triggered safety case and the conditions "brake applied, FFG ≠ LL", the speed condition that may still be required is no longer applicable.

The evaluation blocks 62 and 63 shown in FIG. 4 are therefore circuit means which can detect a time assignment or a successive occurrence of events and only emit a signal if the conditions indicated in the blocks are met. The safety case corresponding to the assuming high-going signal at an output gate (AND circuit 64) therefore only arises if the signal "accelerator pedal is not in idle position" is supplied to one input, while a signal is sent from the upstream OR gate 65 to the other input either according to condition 2a) or 2b) above.

As soon as this safety case occurs, processing takes place in accordance with the diagram in FIG. 5, which represents the injection quantity supplied over time. Therefore, when the safety event occurs, a waiting time Tw is started first and after the waiting time has elapsed, the injection quantity is not reduced abruptly, but rather in a ramped manner over time with a predetermined gradient DF / DT, and is regulated to a predeterminable safety speed Ns. The usual idle control parameters can apply to the control.

Immediately after the cancellation of the security case ((cancellation means: one of the two conditions "brake applied" or "FFG ≠ LL" is omitted) in the drawing of FIG. 4 at time t2, if the security case occurred at time t0, at the time t1 the waiting time has expired and the safety speed has been reached at time t2 *, the injection quantity is ramped up again over time with a predetermined gradient DR / DT to the quantity caused by the normal one Input sizes of the control unit (FFG, FGR ...) is specified.

As a result, the otherwise occurring "brake / accelerator pedal" conflict is resolved, hard volume surges are avoided, and a further degree of design freedom is achieved by the additional introduction of the speed safety threshold Ns. It is also essential that the safety controller (s) do not run against the stop in such a safety case design.

Since only the input variables of the accelerator pedal sensor FFG and the brake switch BS are required for this special safety problem, which are already supplied to the main computer as shown in FIG. 2, there is the further advantage that this entire safety function is shifted to the main computer 30, that is to say this can be designed accordingly, so that a significantly lower circuit complexity results.

A further addition to the present invention can finally be seen in the illustration in FIG. 6. This is the possibility, already mentioned above, of arranging a second control regulator or replacement regulator, which is designated by 66 in FIG. 6. As in FIG. 2, the normal regulator bears the reference symbol 36.

Although the safety and emergency driving system in the representation of Figure 2 also has a second and therefore redundant controller 36 '; In this system, however, this can also be optionally provided, since in the event of a safety situation, only the control of the control path to the second one Branch formed from blocks 44 and 52 switches so that the RWmin characteristic continues. This second branch can also be connected to the original actuator. In contrast to this, the redundant control controller 66 which is effectively provided in accordance with FIG. 6 increases the availability of the entire system and thus also of the vehicle. The following considerations form the basis for this. In EDC systems, the injection quantity via the electromagnetic actuator 38 '(see Fig. 6) with position feedback (position of the control rod - RWist encoder) and a control controller 36 in the control unit. If one of these regulators fails, quantity metering can no longer be carried out, so that the vehicle equipped with such an internal combustion engine also stops.

The invention here provides a second substitute controller 66 or redundant controller and also provides means which recognize whether the normal actuator 36 is inoperable so that it is possible to switch to the substitute controller 66. It goes without saying that such measures can also be applied to other regulators for other sizes, for example exhaust gas recirculation rate ARF, start of injection or the like.

The actual controller (PID) itself, and in extension also assigned subsequent stages including the final stage (current controller 37) can be regarded as belonging to such a control controller. Since, as already mentioned, a control controller generally contains an I component, it can be assumed that the control controller is in good working order, if there is a control deviation, the controller output is at the maximum possible position for correcting the deviation goes, he runs to the stop, the direction of the deviation and the direction of the controller at the stop are mutually assigned. This assignment and the requirement that the controller runs to the stop allow the control controller and possibly subsequent stages to be checked, taking into account the principle that if there is a control deviation and if this control deviation is present, it is possible to determine whether the controller output is correct for a given fixed time at the appropriate stop. If this is not the case, then it must be switched to the substitute controller 66. According to FIG. 6, the invention provides a comparison device 67, to which the control deviation is fed at input 67a and the controller starting position at input 67b. The control deviation is obtained in the usual way at a summation point 68, to which the control rod setpoint RWsoll is supplied by the main computer and the feedback of the control rod actual value is supplied by the RWist encoder. If it is determined that after the predetermined fixed time τ the controller starting position does not correspond to the stop, the comparator switches over to the replacement controller 66 via the switch 69, which can then either continue to work with the previous setpoint (supplied via line 70) or a separate setpoint value derived from this can also be supplied from an emergency driving device via line 71 as RWsetpoint-Not (see block 44, FIG. 2). A failure of the normal setting controller 36 always means a complete switchover to the emergency travel branch in the latter case, which in some circumstances represents a simplification of the logic.

Since such a switchover can also be triggered by a one-time fault and it is no longer possible to switch back from the emergency driving mode using the means explained so far, although the functionalities may be different If the normal regulator 36 is not disturbed or not further disturbed, according to one embodiment of the invention, the target input of the regulator 36 (initially recognized as defective) is switched to a fixed target value, likewise from the output of the comparator 67 by actuation of a switching device 72, this fixed target value preferably in is in the middle of the normal operating range. The comparator 67 continues to monitor the output of the normal controller 36.

Since the substitute control controller 66 continues to work with the changing setpoints RWsoll or RWsoll-Not that result during driving operation, the normal controller 36 will necessarily see alternating positive and negative control deviations with respect to its fixed setpoint, since the RWist indication will continue to be supplied to it. When the control controller 36 has healed again, ie is functioning properly, one or the other stop would then have to be approached alternately.

It is then possible to determine a predetermined number of stop changes, which the comparison device 67 can detect and whereupon it can then switch back to the normal function, so that the emergency driving function can be used again, with the advantages and the further advantages that result. that the emergency drive function is available for use again.

Claims (10)

1.Safety and emergency driving procedures for an internal combustion engine with auto-ignition, whereby an actuator controls an actuator depending on the comparison between a target value and an actual value, and for higher-level system monitoring, the operating status signals of the internal combustion engine, which include the position of a pedestrian and one Specify, record and evaluate brake pedals, characterized in that to detect a modified idle condition (LL *), a brake pedal actuation signal (BS) with a vehicle speed control signal (FRG signal) and the non-occurrence of a vehicle speed control signal (FRG signal) an accelerator pedal normal idle signal (FFG-LL) is compared, then switching to a speed-dependent minimum control path characteristic (RWmin) for the control value setpoint if the actual control path (RWist) is greater than a minimum control path (RWmin), and at the same time modified e Idling condition (LL *) exists. 2. The method according to claim 1, characterized in that the speed-dependent minimum control path characteristic generated for the emergency operation includes a start hysteresis function, which releases an additional starting quantity for the cold start beyond the minimum control path characteristic, and after the first time exceeding the normal start shedding speed to the normal minimum control path characteristic switches back. 3. The method according to any one of claims 1 to 2, characterized in that a switchover from a separate monitoring device assigned to the main computer 30 (watchdog 30a) can also be carried out. 4. The method according to any one of claims 1 to 3, characterized in that the generation of the minimum control path characteristic for emergency operation, the speed signal (N) of the normal speed sensor (31) or a replacement speed sensor (31 ') is used as a starting signal from a speed signal derived from the detected peak start or reduced redundantly detected speed signals by division synchronously with the crankshaft rotation. 5. The method according to any one of claims 1 to 4, characterized in that in addition to the speed-dependent, obtained from the minimum control path characteristic for emergency travel, minimum control path, to obtain the new control path setpoint enabling an extended emergency drive, in addition a signal (FFG) of the pedestrian (21 ) will be added. 6. The method according to any one of claims 1 to 5, characterized in that the control path setpoint enabling an extended emergency travel is switched to a second, redundant control controller 36'-66). 7. The method according to any one of claims 1 to 6, characterized in that the failure of the actual value transmitter for the control path is detected and switched to a simulated signal derived from the controller output (RWist *). 8. The method according to one or more of claims 1 to 7, characterized in that the control deviation and the controller starting position are monitored when there is an I component of the controller and, if a stop value on the output side is not reached by the controller after a predetermined period of time, a replacement controller (36 ', 66) is switched if there was a certain control deviation within this period. 9. The method according to any one of claims 1 to 8, characterized in that when switching to the replacement controller (36 ', 66) the normal controller (36) is supplied with a fixed setpoint and its controller starting position is continuously monitored, with the proviso that at When a predetermined number of stop values on the output side is reached, the functionality of the normal controller (36) is recognized and the emergency controller is switched back to. 10.Safety and emergency driving device for an internal combustion engine with auto-ignition, with means which actuate an actuator depending on the comparison between a target value and an actual value, and which continuously monitor the operating state signals of the internal combustion engine, which include the position of a Specify, record and evaluate the pedals and a brake pedal, characterized in that means are provided for detecting a modified idle condition (LL *), a brake pedal actuation signal (BS) with a vehicle speed control signal (FRG signal) and the non-occurrence of a vehicle speed control signal Compare (FRG signal) with an accelerator pedal normal idle signal (FFG-LL), using means that then switch to a speed-dependent minimum control path characteristic (RWmin) for the control value setpoint if the actual control path (RWist) is greater than a minimum control path (RWmin ) is, and at the same time the modified idle condition (LL *) is present.

Images