EP0326693A1 - Safety system for an internal-combustion engine - Google Patents

Abstract

In order to monitor a (redundant) safety shut-off in the form of a solenoid shut-off valve (16) on internal combustion engines, that is diesel engines, it is proposed in overrun conditions to increase the quantity of fuel delivered to the internal combustion engine until feedback is received on the injections actually occurring and then to trigger the safety shut-off valve (16) by a currentless circuit. The injections detected by the feedback are absent only when the safety shut-off valve is intact. A fault signal may be utilised for giving a suitable alarm. <IMAGE>

Description

State of the art

The invention relates to a method for monitoring a safety shutdown device in the form of an electromagnetic shutoff valve (ELAB) in internal combustion engines according to the preamble of claim 1 and an apparatus for carrying out the method according to the preamble of claim 4.

In a known fuel injection pump for diesel engines (DE-OS 29 45 484), a pump piston arranged in the housing of the fuel injection pump is set in a reciprocating and simultaneously rotating movement, fuel flowing from the housing interior of the injection pump forming the suction space to the pump piston. From there, depending on the quantity set, the fuel reaches the pressure lines leading to the cylinders of the diesel engine. A safety valve is arranged in the connecting line between the suction chamber and the pump piston inflow, which prevents the further fuel supply from the suction chamber to the pump piston interrupts when certain safety conditions are exceeded. Such a safety condition is exceeded, for example, when the pump delivery pressure in the housing of the fuel injection pump corresponds to a higher speed that is above idle, but on the other hand an adjusting lever actuated, for example, by the accelerator pedal is in the idle position.

Another known emergency control device for the fuel metering system, in particular a diesel engine, (DE-OS 32 38 191) has, in addition to a signal processing device with a control device for the fuel supply, a manually or also automatically switchable emergency control branch, which contains at least one boost pressure regulator and whose output signal in the event of a fault a fault detection circuit is connected to the interlocking which supplies the amount of fuel required for its operation to the internal combustion engine. A minimum value selection circuit can be provided in the emergency control branch to include further operating conditions.

From DE-OS 19 62 570 a reset device for a quantity-determining member in a fuel injection system for diesel engines is known, which is activated when an error occurs, for example the control circuit itself or a supply line is interrupted by one of the existing sensors with which Consequence that the setting of the quantity-determining member then corresponds to that for small injection quantities. The problem here is that with such a protective adjustment in the direction of a smaller quantity of fuel to be supplied, the power output of the internal combustion engine can be reduced to such an extent that, for example, operation in difficult terrain can no longer be maintained.

It is generally known to use electrical signal boxes (DE-OS 35 31 198) for electronic control of the operation of self-igniting internal combustion engines, that is to say diesel engines, with electrical signals, wherein instead of mechanical fuel metering and control systems, a central control unit (SG) is required Control signals generated. Mechanical fuel metering systems in diesel engines are reliable in terms of their reliability, but they may be increasingly less able to take into account the multitude of different operating conditions and environmental influences.

The use of electronic components in connection with an electronic diesel control (EDC) makes extensive safety, monitoring and emergency driving measures desirable even if the individual modules already have options for error detection and, if necessary, error deactivation.

Therefore, it is also known in a safety device for an internal combustion engine with self-ignition (DE-OS 33 01 742), continuously certain signals relating to the operation of the internal combustion engine, such as accelerator pedal position, calculated setpoint of the control path, speed, brake pedal position and the like. and to create a corrected control path setpoint by selecting the minimum value and supplying it to the controller of the EDC system. This corrected control path setpoint also serves to determine a control deviation, including a feedback of the actual control path signal. If the predetermined limits are exceeded, the known safety device either reacts by switching off the injection pump, de-energizing the output stage of the control regulator or introducing emergency operation. With this known safety device However, problems can arise under certain circumstances because not all possible boundary conditions are included in the recording of the safety conditions. Thus, an idle signal can indeed be obtained by a corresponding idle contact on the accelerator pedal; however, this is not valid if, for example, the internal combustion engine is equipped with a vehicle speed controller. In addition, it is conceivable that, for example during sporty driving, warning rear drivers at high speed or the like, a driver briefly depresses the brake pedal or even just taps, but on the other hand the foot pedal remains deflected, i.e. is not in the neutral position.

In view of the importance of the electromagnetic shut-off valve (ELAB) as a redundant safety shutdown in internal combustion engines, in order to ultimately switch off the engine in the event of a malfunction by interrupting the fuel supply and thereby preventing it from running away, the present invention is based on the problem of correct Monitor the function of the electromagnetic shut-off valve itself continuously.

In normal operation, the EDC control unit is able to detect a defect in the quantity signal box, for example, essentially due to a permanent control deviation in the control loop. The EDC control unit then switches off the fuel supply by means of a suitable safety logic using the electromagnetic shut-off valve. The electromagnetic shut-off valve (ELAB), as a safety device, is therefore able to switch off the engine even when the quantity control box is jammed, for example, or when the power stage is well-alloyed (in the EDC control unit). The continuous monitoring of the ELAB function is therefore absolutely necessary because of the importance of the ELAB, whereby However, difficulties arise here that the ELAB itself is part of the fuel metering device, like all other components and systems, and therefore its function cannot be checked separately. This function consists in switching off the engine; The requirement or the option to check the functionality of the ELAB for its functionality, for example in a time-controlled manner, i.e. at predetermined intervals during normal operation of the motor vehicle, is therefore forbidden for reasons of driving safety, since this check just stops the engine would lead.

A defect of the ELAB can also not be recognized by the driver, because when the voltage supply is switched off, not only is the possibly defective ELAB switched off, but of course the voltage supply for the quantity signal box and the other components is also switched off, i.e. they become currentless. In addition, it is not to be expected that the driver or user of a motor vehicle equipped with such a system will continuously pay attention to, or even want to concern himself with, checking a certain safety component in the fuel quantity control of his vehicle.

Advantages of the invention

The method and the device according to the invention achieve this object with the characterizing features of the main claim and of claim 4 and have the advantage that, on the one hand, the fuel cut-off safety shut-off valve (ELAB) can be checked during operation of the internal combustion engine and therefore also under operating conditions is the Drivers or other persons in the motor vehicle do not notice anything or practically nothing of this check.

Since it is easily possible to use suitable hardware or software in the area of EDC control to ensure that the automatic check in engine operation is repeated at specified times, the safety shutdown valve can be recognized to function properly in all circumstances, or it is possible to Defect of the ELAB function can be recognized immediately after each start, and always when the vehicle goes into overrun for a period sufficient for the duration of the ELAB function check. This check has no undefined influences on the driving operation; An additional hardware effort is not necessary because it is possible to lay down the entire check routine in the area of the EDC regulation, for example in its program. As a result, the overall security of the EDC system is significantly increased and the possibility of unwanted engine startup or engine runaway is practically reduced to zero.

Advantageous further developments and improvements of the invention are possible through the measures listed in the subclaims. It is particularly advantageous that the sensors already present can be used to implement the invention, so that no additional hardware components and lines are required in this area either.

drawing

An embodiment of the invention is shown in the drawing and is described in the following description explained in more detail. The drawing shows a highly schematic of the EDC control unit for the electronic diesel control and the quantity control box with the safety shut-off valve assigned to it.

Description of the embodiments

The basic idea of the present invention is, in the overrun mode of the internal combustion engine, for example when the foot throttle is in the empty gas position, the vehicle speed controller is in the off position and the speed is greater than the idle speed, by a separate or otherwise initiated activation of the Quantity output stage to increase the (fuel) quantity supplied to the internal combustion engine, for example in a ramp-like manner, until a needle movement sensor NBF, which is already present in EDC operation of diesel engines to regulate the start of spraying, delivers pulses, ie until it is determined that injections are actually taking place. Depending on the version, a combustion start sensor or an injection pressure sensor can also be used in the pump element, in the fuel line or in the injection valve instead of the NBF needle movement sensor. These very low injection processes during overrun have practically no influence on the driving behavior of the vehicle equipped with such a diesel engine, firstly because they only occur during a narrowly limited period during which the check takes place and secondly because of the normal driving conditions, For example, when driving downhill in overrun mode with somewhat steeper routes, the speed and, accordingly, the speed of the internal combustion engine increase somewhat when the engine is towed.

After injection processes can be determined based on the feedback from the needle movement sensor NBF, the safety shutoff valve ELAB is activated switched off, in other words, in the special embodiment of the safety shut-off valve ELAB, the latter is de-energized, so that the valve now, depending on the design, also mechanically interrupts a fuel flow channel in the housing of the injection pump by means of a bias spring, through which the fuel from the under a predetermined Delivery pressure standing inside the pump reaches the area of the pump piston.

If the ELAB function is intact, these pulses caused by the control of the output stage are switched off; If the needle movement sensor indicates that no more pulses are occurring, then the ELAB is functioning properly.

In the drawing, the electronic control unit of the EDC diesel control is denoted by 10, and the quantity setting mechanism acted upon by the control unit 10 is denoted by 11. The control unit 10 receives information about the speed n from a speed sensor 12, information about the accelerator pedal position from an accelerator position sensor 13 and, if desired, brake actuation information (brake light) and start information, together with signals from further sensors that are not necessarily explained here, for example via Cooling water, battery voltage and the like. and acts on the magnetic interlocking 14 in the fuel injection pump of the quantity interlocking 11 via a schematically indicated output stage 10a, wherein a position indicator 15 is also indicated. The electromagnetic safety shut-off valve ELAB assigned to the quantity control unit or the fuel injection pump is designated 16 and is also acted upon by the control unit 10 via a control line 16a, for example as shown in the drawing via an OR gate 17, which corresponds to the indicated arrow 18 from a conventional one Safety logic circuit within the control unit 10 leading to a switch-off of the ELAB (correspondingly blocking the further fuel supply), which can result from a large number of states detected by the safety logic circuit.

An additional checking circuit 19 then receives from the existing sensors in parallel corresponding information and signals that enable overrun operation detection; In this case, the output stage 10a in the EDC control unit is first activated to ramp up the quantity until injections are detected by the existing feedback, for example via the needle movement sensor. Thereupon, the safety switching valve 16 is actuated by the checking circuit 19 via the OR gate 17 and, if the ELAB function is correct, the injection pulses which are arbitrarily initiated in overrun mode are switched off. At the same time, this means the detection of the perfect ELAB function; if, on the other hand, the injection pulses are not turned off, a warning can be given. Such an additional monitoring circuit 19 can be implemented in any manner with only very little additional hardware expenditure, with corresponding comparators, gate circuits, amplifiers and the like. are known per se and can be used depending on the desired application, so that it does not need to be discussed in more detail.

However, the present invention is preferably implemented completely without additional hardware using appropriate additional programming in the functional sequence area of the electronic diesel control (EDC control unit); a corresponding (simplified) block flow diagram for the ELAB function check is given below (p.13), it should be pointed out that the functional sequences or functional blocks shown in the drawings or to be explained below do not limit the invention, but in particular serve to illustrate the basic functional effects thereof and to indicate special functional sequences in a possible form of implementation. It goes without saying that individual blocks and their functions can be implemented in analog, digital or hybrid technology; they can also, in whole or in part, corresponding areas of program-controlled digital systems, for example microprocessors, microcomputers, digital or analog logic circuits and the like. occupy or be stored directly in the microprocessor by designing the program sequence accordingly.

The ELAB function check made possible by the invention is also effective if the safety shut-off valve ELAB does not close completely, that is to say a residual quantity is possibly conveyed; Such a malfunction is also detected in the case of the additional injection processes, which are only minor in any case. Another prerequisite for the functional check of the ELAB in the present invention is that it must be reversible, i.e. at the end of the test, the ELAB must open again safely, even at high pump interior pressures, when it is switched on. Most safety shut-off valves are capable of this or can be designed accordingly.

On the basis of the normal quantity control according to the block flow diagram, an ELAB function check only needs to be carried out once after each starting process, ie it is not necessary that a switch to ELAB function check is always made when the overrun condition is recognized. If overrun mode is recognized, then the Activation of the final output stage can be carried out, preferably two further decision blocks can be provided. The first decision block concerns the fact that the test should only be carried out at sufficiently high engine speeds (n> n1), so that the engine speed does not drop to idle speed during the test and then either the faultless ELAB function can no longer be identified, because the idle controller takes over or the engine may stall if the ELAB does not open quickly enough. A further decision block includes the possibility of expediently starting the test only when the vehicle is engaged, since in this case there is a larger flywheel mass for the engine. A transmission feedback or a vehicle speed signal can serve as a signal for this engaged state.

After these preconditions have been checked, the control of the final quantity stage and in the subsequent decision block, the check is made as to whether a needle movement is taking place.

If there is a needle movement, the ELAB is switched off and at the same time a time measurement t = 0) should be started because the ELAB test should be completed within a specified test time (t _x ). If the feedback from the needle movement sensor shows that there are no more injection processes, the safety shut-off valve ELAB is OK and after switching on the ELAB you can go back to normal quantity control. If the test time is exceeded and the needle movement is still not finished, then a defective ELAB is recognized, whereby a few more options can then be considered. So it cannot be ruled out that another safety-relevant diagnosis bit DIABYTE was set, so that in this case redundant quantity shutdown with the ELAB is no longer possible. Corresponding safety-relevant diagnostic bits can be selected from all diagnostic bits of the EDC control using a mask. If no safety-related errors are reported, the ELAB can be switched on again; However, the defect message can also be saved, which is not shown in the block flow diagram, in order to check whether the same defect is recognized again during the next ElAB function checks or whether the ELAB has just got stuck in the meantime. If the ELAB continuously reports defects, then at least one error message is required so that the driver can initiate a check; if there are other safety-relevant errors, the warning signal must be set in any case. In this case, the ELAB can then either be switched on again and normal volume control switched on, so that there is no interference with the operation of the motor vehicle; however, it is possible to either prevent the next starting process, or in any case to design the warning signal so that it can only be reset by a workshop. It is also possible to influence driving behavior when the ELAB is defective, such as reducing the injection quantity or reducing the maximum speed.

All features shown in the description, the following claims and the drawing can be essential to the invention both individually and in any combination with one another.

Claims (6)

1.Procedure for monitoring a (redundant) safety shutdown in the form of an electromagnetic shut-off valve (ELAB) in internal combustion engines, in particular diesel engines, the quantity control unit of which is acted upon by an electronic diesel control (EDC) and whereby the further fuel supply to the engine is interrupted by the safety shutdown if a defect occurs characterized, that fuel is increasingly supplied to the internal combustion engine when the overrun condition is determined until a feedback message indicates that the injection processes have been triggered, that the safety shutdown valve (ELAB) is then switched off by appropriate control and that the failure of the injection process feedback signals that the shutdown safety valve (ELAB) is functioning properly is recognized . 2. The method according to claim 1, characterized in that the presence of the overrun mode by the empty gas position of the foot control and switched off cruise control or turned on cruise control and target speed greater than the actual speed and in each case a speed above the idle speed is detected and then the ELAB function check by increasing the amount is then initiated when the actual speed is sufficiently high above the idling speed (n> n 1) and the vehicle is in the engaged state. 3. The method according to claim 1 or 2, characterized in that when the defect of the ELAB is detected, warning signals are no longer erasable. 4. The method according to claim 1 or 2, characterized in that in the event of a defect detection of the ELAB and the simultaneous presence of at least one further safety-relevant error, at least one warning signal which can no longer be erased is initiated. 5.Device for monitoring a (redundant) safety shutdown device in the form of an electromagnetic shutoff valve (ELAB) in internal combustion engines, in particular diesel engines, the quantity control device of which is acted upon by an electronic diesel control (EDC) and the safety shutdown device interrupts the further fuel supply to the engine if a defect occurs, for carrying out the method according to one or more of claims 1 to 4, characterized in that a checking circuit (19) is provided, which controls the final stage of the EDC diesel control in the control unit (10) for gradually increasing the fuel quantity when overrun is determined, that a Needle motion sensor (NBF) or an (optical) combustion start sensor or a fuel pressure sensor is provided, which delivers pulses when the injections actually take place, that the pulses detected by this sensor after actuation of the quantity output stage are evaluated and the switch-off Safety valve (16) is controlled to interrupt the fuel supply. 6. The device according to claim 5, characterized in that the checking circuit sensors for accelerator pedal position, speed, starting process and a comparison circuit which, when the safety shutoff valve (ELAB) is switched off and interrupted, by the needle movement sensor (NBF) or the (optical) combustion starter or the fuel pressure sensor, detects the correct functioning of the safety shutoff valve (16).

Images