METHOD AND ARRANGEMENT FOR CONTROLLING AN INTERNAL ENGINE WITH AT LEAST TWO CONTROL UNITS

Description

[0001] The invention relates to a method for controlling an internal combustion engine according to the preamble of claim 1, an arrangement for controlling an internal combustion engine according to the preamble of claim 6, and an internal combustion engine according to the preamble of claim 9.

[0002] Methods and arrangements of the type discussed here are known (WO 2010 / 066477 A1). An engine control unit is provided that generates at least one control signal to control at least one function of the internal combustion engine, typically a plurality or even all of the internal combustion engine's functions. If a malfunction occurs in the engine control unit, a sensor system operatively connected to the engine control unit, or a wiring system that jeopardizes proper operation of the internal combustion engine, this cannot be intercepted, or at least not seamlessly or with the desired level of reliability.Particularly in internal combustion engines designed as common-rail engines, especially common-rail diesel engines, the design-related problem arises that actuators for necessary control circuits, such as speed or velocity control and / or high-pressure control for the high-pressure accumulator, in particular the rail of an injection system, are only available once and therefore cannot be installed redundantly. Therefore, if redundant controllers or engine control units are to be provided to compensate for a malfunction or failure of a controller, they must be connected to a single set of actuators, namely a so-called actuator system, without influencing each other.Furthermore, when control responsibility is transferred from a first controller to a second controller, an interruption in the control of the actuators must be limited to a maximum of a short period of time, for example, approximately 100 ms. This period is at most long enough for the internal combustion engine to continue operating at full load without a significant drop in engine speed and simultaneously without an excessive high pressure, which would trigger a pressure relief valve. At the same time, the complete control system with the redundant engine control units should be mountable on the internal combustion engine itself, i.e., engine-mountable.

[0003] European patent EP 0 979 189 B1 discloses a circuit arrangement for a motor vehicle control system, in particular a brake control system, comprising two redundant microprocessor systems, with all input data being supplied to each microprocessor system directly or via communication units connecting the individual microprocessor systems. If one microprocessor system fails, an emergency operation function is implemented by connecting an actuator to the independent microprocessor system. In the event of a fault, the defective microprocessor system transmits an error signal. This is disadvantageous because a complete failure of the microprocessor system can result in the error signal no longer being transmitted. In this case, the malfunction remains unnoticed and cannot be intercepted.

[0004] European patent EP 2 418 580 B1 discloses a method for operating a network and a network comprising two redundant control units. One of the control units functions as the main control unit, while the other control unit assumes a backup function. The main control unit sends synchronization signals to the backup control unit at regular intervals. It also sends activity signals to a controlled peripheral device at regular intervals. If a malfunction occurs, the main control unit no longer sends synchronization signals, causing the backup control unit, which no longer receives synchronization signals, to check whether the peripheral device has received an activity signal from the control unit within a further predefined period of time.If this isn't the case, it is assumed that the main control unit has failed, and the backup control unit takes over. The disadvantage of this approach is that the backup control unit performs a two-stage check: In a first step, it must determine that no synchronization signal is being received. In a second step, it then queries the peripheral device to determine whether it is still receiving the activity signal from the main control unit. This procedure is comparatively complicated and too slow.

[0005] The invention is based on the object of creating a method and a system for controlling an internal combustion engine, wherein, in particular, reliability is increased and a seamless switchover to a redundant control system is possible in the event of a malfunction without the need for complicated testing. The invention is also based on the object of creating an internal combustion engine wherein, in particular, the aforementioned problems are solved or the aforementioned advantages are realized.

[0006] The problem is solved by creating a method having the features of claim 1. The method includes a switching device. This device forwards the at least one control signal from the first engine control unit to control the at least one function of the internal combustion engine. The first engine control unit therefore does not transmit its control signal directly to the internal combustion engine, but rather via the switching device. The first engine control unit sends a live signal to the switching device, indicating the functionality of the first engine control unit. The live signal is sent from the first engine control unit to the switching device continuously or periodically, i.e., permanently or at regular time intervals.If an error or malfunction occurs which jeopardises the proper control of at least one function of the internal combustion engine by the first engine control unit, the first engine control unit does not transmit the live signal, or does not transmit it correctly, to the switching device, so that it is no longer received or is no longer received correctly by the latter. Preferably, the first engine control unit stops transmitting the live signal. In this case, the switching device stops forwarding the control signals from the first engine control unit to the internal combustion engine. It begins to forward control signals generated by the second engine control unit for controlling at least one function of the internal combustion engine to the internal combustion engine. In the event of an error, the switching device therefore switches control of the internal combustion engine from the first engine control unit to the second engine control unit, and this can happen seamlessly.Because the first engine control unit does not send out an error signal in the event of a fault, but rather does not transmit the live signal or no longer transmits it correctly, and preferably stops transmitting the live signal, a complete failure of the first engine control unit is also detected by the switchover device, enabling seamless switching to the second engine control unit. This eliminates the need for a two-stage test because the second engine control unit does not become active to test for a failure of the first engine control unit if no information is transmitted. Instead, the switchover device reacts immediately to the absence or incorrect reception of the live signal from the first engine control unit by switching to the second engine control unit, without any further measures being taken. The method is therefore very simple and reliable.

[0007] In one embodiment of the method, it is possible for the live signal to be identical to the at least one control signal. In another embodiment of the method, the live signal is preferably a signal generated independently of the control signal and transmitted to the switching device. In yet another embodiment of the method, the live signal is superimposed on the control signal, or the live signal is a property of the control signal, for example, the correct timing of a pulse-width-modulated control signal. The live signal is detected by the switching device as not being received or no longer being received correctly if the control signal either fails or if the property of the control signal representing the live signal is no longer present, for example, if the timing of the pulse-width-modulated signal, in particular a temporal arrangement of its edges, is no longer detected correctly.

[0008] Preferably, within the scope of the method, a pulse-width-modulated signal is generated by the first engine control unit as a control signal and / or as a separate live signal by software. This differs from the usual way of generating a pulse-width-modulated signal in that an electronic element, for example a comparator or a microcontroller, is typically used, which is only controlled accordingly by software. In the present case, however, it is preferred that the pulse-width modulation is generated by the software itself, i.e. that an algorithm is provided in a program intended to generate the signal, by means of which algorithm the temporal sequence of pulse widths representing the signal is calculated and generated. Such a solution is usually considered disadvantageous because it is hardly possible or only difficult to generate a defined pulse-width-modulated signal on a program-based basis.In the method discussed here, however, this weakness is deliberately exploited by capturing the pulse-width-modulated signal in the switching device using suitable hardware and examining it for deviations in its timing. If the software of the first engine control unit malfunctions, it is no longer able to properly clock the pulse-width-modulated signal. This is detected in the switching device as no longer correctly receiving the live signal, so the switching device then switches to the second engine control unit. Using the software-generated pulse-width-modulated signal, it is therefore possible to include malfunctions in the software of the first engine control unit in the monitoring process.

[0009] Errors that jeopardize the proper control of at least one function of the internal combustion engine by the first engine control unit can occur in a variety of ways. For example, it is possible that an error occurs in a sensor system operatively connected to the first engine control unit, so that the first engine control unit no longer has correct measured values ​​available for controlling the internal combustion engine. It is also possible that an operative connection between the first engine control unit and the corresponding sensor system is interrupted. It is also possible that the operative connection between the first engine control unit and the switching device, in particular the wiring between them, is interrupted. In this case, the live signal from the first engine control unit is no longer received by the switching device.Finally, it is possible that a hardware or software-related malfunction occurs in the engine control unit itself, jeopardizing proper control of the internal combustion engine. In particular, it is possible that the first engine control unit fails completely. In this case, too, the "live" signal is no longer transmitted to the switching device.

[0010] A distinction must therefore be made between errors or malfunctions in which the transmission of the live signal to the switching device necessarily fails due to the error or malfunction itself, for example because an active connection is interrupted, and errors or malfunctions that are actively detected by the first engine control unit, whereupon the first engine control unit either completely stops transmitting or at least correctly transmits the live signal. In cases in which the transmission of the live signal necessarily fails, a quasi-automatic switchover to the second engine control unit takes place. In other cases, the first engine control unit transfers the control itself to the second engine control unit via the switching device by stopping the transmission or correctly transmitting the live signal.

[0011] Preferably, the first engine control unit stops transmitting or correctly transmitting the live signal not for every error or malfunction, but only for those that actually jeopardize proper control of at least one function of the internal combustion engine, so that, for example, regulation to specific operating points, compliance with specific emission limits, or even safe operation is no longer possible. The first engine control unit therefore preferably analyzes the detected errors or malfunctions with regard to their potential to jeopardize proper control of the internal combustion engine. A decision criterion is preferably used, based on which the first engine control unit decides whether to stop transmitting or correctly transmitting the live signal.In particular, this decision can be based on whether the first engine control unit receives a live signal from the second engine control unit. For this purpose, one embodiment of the method preferably provides for the second engine control unit to also transmit a live signal, which it also transmits to at least the first engine control unit. It is then possible for the first engine control unit to stop transmitting, or correctly transmitting, the live signal only when it correctly receives the live signal from the second engine control unit.

[0012] Control of at least one function preferably addresses a control and / or regulation of at least one variable. The engine control units are therefore preferably designed as controllers.

[0013] A preferred method is characterized in that the first engine control unit transmits the information necessary for controlling at least one function of the internal combustion engine to the second engine control unit once, preferably immediately after or upon starting the internal combustion engine. In this case, the information available at the start of the internal combustion engine's operation is also available to the second engine control unit, so that it can take over control in the event of a fault.

[0014] Alternatively, it is preferred that the first engine control unit periodically transmits the information necessary for controlling the at least one function of the internal combustion engine to the second engine control unit. Transmission thus occurs preferably at predetermined time intervals, with a first transmission preferably occurring immediately after or upon starting the internal combustion engine. In this embodiment of the method, the second engine control unit is updated at regular intervals so that changes in the information are also transmitted to the second engine control unit and are then available for controlling or regulating the internal combustion engine in the event of a fault.

[0015] As a further alternative, it is preferred that the information required to control the at least one function of the internal combustion engine be transmitted to the second engine control unit as needed. In particular, this information is transmitted to the second engine control unit after a change in the information. In this embodiment, too, it is preferred that the information be transmitted to the second engine control unit for the first time immediately after or upon starting the internal combustion engine or be stored therein. Further transmission then preferably takes place as needed, each time after a change in the information.This ensures that the information available in the second engine control unit is always up-to-date, so that in the event of a fault, the second engine control unit can continue to control or regulate at least one function of the internal combustion engine seamlessly on the basis of the information currently required for the control, regulation or regulation.

[0016] Alternatively, it is preferred that the information required to control the at least one function of the internal combustion engine be stored in the second engine control unit from the outset, wherein it is, in particular, permanently maintained at predetermined values. The information is retrieved when the control of the at least one function of the internal combustion engine is switched to the second engine control unit. This has the advantage that no communication is required between the first and second engine control units.

[0017] According to a first alternative, the term "retrieving" encompasses the fact that the parameters corresponding to the information are initialized with the stored values ​​upon taking over control, whereby the parameters may have previously undefined and / or variable values. According to a second alternative, the term "retrieving" encompasses a procedure in which the parameters are retained at the stored values ​​until the second engine control unit takes over control. From this point on, the parameters are released so that they can be changed during operation and, in particular, adapted to changing operating conditions.

[0018] In particular, in an embodiment of the method in which the first and the second engine control unit do not communicate with each other, it is advantageous if the second engine control unit detects when the control of the at least one function is switched to it.

[0019] The information required to control the at least one function preferably comprises in particular load points, characteristic map points and / or complete characteristic maps which are required to control the internal combustion engine, in particular to control the at least one function thereof.

[0020] The first and second engine control units are preferably designed as controllers which take integral elements or integral components into account during control. The information required to control the at least one function then preferably also includes such integral components. Since the second engine control unit sees an open control loop as long as the switching device has not switched the control of the internal combustion engine to it, the integral components in the second engine control unit increasingly deviate from the integral components in the first engine control unit over time. This can lead to problems when switching to the second engine control unit, in particular because the integral components do not change in the short term, but only over a certain period of time, so that rapid regulation after switching is not possible.To avoid such problems, a preferred embodiment of the method provides that the second engine control unit detects when the switching device switches control of the internal combustion engine to it, in which case it initializes the integral components to predetermined values, particularly those determined by test bench tests and / or experience, which are stored in the second engine control unit. An alternative embodiment of the method provides that the integral components in the second engine control unit are permanently retained at the predetermined values ​​as long as control responsibility is not switched to the second engine control unit.In a further embodiment of the method, the integral components are transmitted from the first engine control unit to the second engine control unit, wherein one of the previously described alternatives for transmitting the information necessary to control the at least one function of the internal combustion engine is selected. Reference is made to this in this regard. In particular, in a preferred embodiment of the method, it is possible for the integral components to be transmitted periodically from the first engine control unit to the second engine control unit, wherein, in the event of a transmission failure, the second engine control unit preferably reverts to the predetermined, stored values.

[0021] A method is also preferred which is characterized in that the second engine control unit transmits a live signal indicating its functionality to the switching device, either continuously or periodically. This makes it possible to detect an error or malfunction in the second engine control unit, or possibly even its complete failure.

[0022] Alternatively or additionally, the second engine control unit preferably transmits a live signal to the first engine control unit. In this case, it is possible—as already described—for the first engine control unit to use the correct reception of the live signal from the second engine control unit as a criterion for actively terminating the transmission or correctly transmitting its live signal.

[0023] It is possible that the assignment of the live signals to the first or second engine control unit is encoded in the signals themselves. Alternatively, it is possible that the live signals are identical but are received by different inputs of the switching device, with the inputs being assigned to the first or second engine control unit. In any case, it is ensured that the live signals can be correctly assigned to the engine control unit from which they are transmitted.

[0024] In this context, a method is preferred that is characterized in that the switching device only begins forwarding the control signals from the second engine control unit to the internal combustion engine when, on the one hand, the live signal from the first engine control unit is no longer received or is no longer received correctly, while, on the other hand, the live signal from the second engine control unit is simultaneously received correctly. The switching of the control of the internal combustion engine to the second engine control unit is thus only carried out when, on the one hand, a malfunction actually occurs in the area of ​​the first engine control unit and, on the other hand, when it is ensured that the second engine control unit is functional.If, however, it is determined that both engine control units are not functioning properly or have failed, other measures will preferably be taken to ensure safe operation of the internal combustion engine or, if necessary, the internal combustion engine will be shut down.

[0025] A method is also preferred which is characterized in that the switching device switches back to control of the at least one function of the internal combustion engine by the first engine control unit when the live signal from the second engine control unit is no longer received, wherein at the same time the live signal from the first engine control unit is received again. This embodiment is based on the consideration that the malfunction in the first engine control unit may be temporary in nature, i.e., will no longer occur after a certain time. In this case, the first engine control unit preferably begins to transmit its live signal again, which is received by the switching device. If a malfunction now occurs in the area of ​​the second engine control unit controlling the internal combustion engine, this preferably stops transmitting or correctly transmitting the live signal, and this is determined by the switching device.If the first engine control unit is functional again and its live signal is correctly received by the switching device, the switching device switches back to the first engine control unit, so that the latter in turn takes over the control of at least one function of the internal combustion engine, preferably the control or regulation of the entire internal combustion engine. It is obvious that the method preferably continues in this manner, so that multiple switching between the two engine control units can occur, especially when temporary malfunctions occur.

[0026] A method is also preferred which is characterized in that the second engine control unit continuously generates at least one control signal during operation of the internal combustion engine, wherein it does so even at a time when this control signal is not forwarded to the internal combustion engine by the switching device. This means that the second engine control unit does not begin generating control signals only when it takes over the control of at least one function of the internal combustion engine. Rather, the second engine control unit begins generating control signals independently of the first engine control unit when the internal combustion engine is started, so that control signals are always generated redundantly by both engine control units - except in the event of a fault - wherein the switching device, however, only forwards the control signals of one of the engine control units to the internal combustion engine.In this way, a particularly rapid, seamless switching of the control via the switching device to the second engine control unit is possible because the latter does not have to start generating the control signals first.

[0027] This procedure is preferably also used to enable the second engine control unit to detect whether it is responsible for controlling the internal combustion engine, i.e., whether the switching device has switched the forwarding of the control signals from the first engine control unit to it. According to the invention, the second engine control unit continuously generates a voltage as a control signal, even if this is not forwarded to the internal combustion engine by the switching device, whereby a current flows due to the voltage when the second engine control unit controls the at least one function of the internal combustion engine. If, however, the control signal from the second engine control unit is not forwarded to the internal combustion engine by the switching device, no current flows.The second engine control unit monitors the current flow to determine whether it is controlling the at least one function of the internal combustion engine and determines this when the current exceeds a predetermined threshold, for example, 0 A or 1 A. If this is not the case, i.e., if the measured current is below the threshold, the at least one control signal from the second engine control unit is not currently transmitted to the internal combustion engine by the switching device. If, however, the measured current is above the predetermined threshold, the second engine control unit detects that the control of the at least one function of the internal combustion engine has been transferred to it by the switching device.This is particularly important in connection with a correct initialization of integral components of a second engine control unit designed as a controller, so that the integral components can be correctly initialized at the right time, or so that the second engine control unit can stop holding the integral components at predetermined values ​​in good time when it takes over the control of the internal combustion engine.

[0028] Alternatively, it is possible for the second engine control unit to not generate any control signals until it is activated by the switching device. In this case, the switching device transmits a signal to the second engine control unit when switching to the second engine control unit, causing it to generate control signals, which are then forwarded by the switching device to the internal combustion engine.

[0029] A method is preferred which is characterized in that an actuator system of the internal combustion engine is controlled and / or regulated by the first or the second engine control unit. In particular, the actuator system comprises at least one injector and / or at least one intake throttle of the internal combustion engine. In particular, the engine control unit currently used to control or regulate the internal combustion engine controls and / or regulates all injectors and / or intake throttles of the internal combustion engine. In a particularly preferred embodiment of the method, it is provided that the engine control unit controls and / or regulates all functions of the internal combustion engine, in particular controls and / or regulates the internal combustion engine as a whole. In this respect, the engine control units can also be referred to as engine controllers.

[0030] In particular, a method is preferred in which the first or second engine control unit regulates a rotational speed or a speed of the internal combustion engine by controlling at least one injector of the internal combustion engine as an actuator. Alternatively or additionally, it is preferred that the first or second engine control unit regulates a pressure in a high-pressure accumulator of a fuel injection device, in particular a rail pressure in a rail of a common-rail diesel engine, by controlling an intake throttle of a high-pressure pump as an actuator. It is shown that a current flow through the intake throttle is preferably required to control the intake throttle.

[0031] A method is preferred in which the second engine control unit monitors a continuously generated control signal to detect whether it is controlling the at least one function of the internal combustion engine. According to the invention, the second engine control unit initializes parameters, in particular integral components, for controlling the at least one function of the internal combustion engine with stored values ​​when it detects that it is controlling the at least one function of the internal combustion engine. Alternatively or additionally, it releases predetermined, fixed values ​​of the parameters for variation when it detects that it is controlling the at least one function of the internal combustion engine.

[0032] The second engine control unit generates a voltage that causes a current to flow when it controls the at least one function of the internal combustion engine. No current flows if the control signal is not forwarded to the internal combustion engine by the switching device. The second engine control unit monitors whether a current flows. In doing so, it monitors whether the current exceeds a predetermined threshold.

[0033] In particular, the control of the intake throttle according to the procedure already described is used in a preferred embodiment of the method to enable the second engine control unit to detect whether it has been assigned control responsibility. To this end, the second engine control unit preferably continuously controls the intake throttle, in particular generating a voltage, whereby no current flows from the second engine control unit through the intake throttle if the second engine control unit is not operatively connected to the internal combustion engine via the switching device. If, however, the switching device switches to the second engine control unit, a current flows from the latter through the intake throttle, which current is measured by the second engine control unit and detected in particular as being above a predetermined threshold value.In this case, the second engine control unit preferably detects that the switching device has switched the control of the internal combustion engine to it.

[0034] A switching device not belonging to the invention is also described for use in controlling an internal combustion engine, in particular for carrying out a method according to one of the previously described embodiments. The switching device can be operatively connected to a first engine control unit and to a second engine control unit, as well as to an internal combustion engine. The switching device is designed such that at least one control signal from the first engine control unit or the second engine control unit can be forwarded to the internal combustion engine. The forwarding can be switched by the switching device from the first engine control unit to the second engine control unit.The switching device is therefore designed such that it always forwards either the at least one control signal from the first engine control unit or the at least one control signal from the second engine control unit to the internal combustion engine, wherein it can switch the forwarding from the first engine control unit to the second engine control unit. The switching device is further designed such that it can receive a live signal from the first and / or the second engine control unit. The switching device is preferably designed such that it ends the forwarding of the at least one control signal from the first engine control unit to the internal combustion engine and begins the forwarding of the at least one control signal from the second engine control unit to the internal combustion engine if the live signal from the first engine control unit is not received or is received incorrectly by the switching device.

[0035] The switching device can have a detection means configured to determine whether the live signal is being received. Preferably, the switching device also has an assessment means configured to assess whether the live signal has been received correctly. In this case, it is particularly possible for the assessment means to be configured to check the timing of a pulse-width-modulated signal to determine whether it is correct, in particular whether it meets predetermined criteria.

[0036] A switching device is also described which has at least one switch. This is preferably designed as an electromechanical switch, in particular as a relay. However, the switch is particularly preferably designed as a semiconductor switch. The use of semiconductor switches in the switching device is advantageous because it can easily ensure that a maximum interruption in the transmission of control signals to the internal combustion engine is short enough to allow the internal combustion engine to continue operating under full load without a significant drop in speed and without excessive high pressure, wherein the interruption is preferably in a range of less than 100 ms. Semiconductor switches can be switched very quickly, and the switching device requires little installation space, so that it can be easily mounted directly on the internal combustion engine.

[0037] Finally, a switching device is described which has an interruption prevention means by which a transmission of at least one control signal from the switching device to the internal combustion engine can be maintained during a switchover between the engine control units. Such a switching device is preferably provided for a control signal which represents a current flow through an actuator. This should not be interrupted during switchover in order to avoid impairing the function of the internal combustion engine. The interruption prevention means is preferably designed as a freewheel, via which a current flow is maintained in a manner known per se when the switchover occurs from the first engine control unit to the second engine control unit. For this purpose, the freewheel preferably comprises at least one diode.Particularly preferably, the interruption prevention means, in particular the freewheel, is designed such that it does not influence a current flow through the actuator during normal operation in order not to falsify a current measurement in the first or the second engine control unit.

[0038] The object is also achieved by providing an arrangement for controlling an internal combustion engine with the features of claim 6. The arrangement is particularly designed to carry out a method according to one of the previously described embodiments. It comprises a first engine control unit, a second engine control unit, and a switching device, in particular a switching device according to one of the previously described embodiments. The arrangement is characterized in that the first and second engine control units are designed such that they can generate control signals with which at least one function of the internal combustion engine can be controlled, preferably the entire internal combustion engine can be controlled and / or regulated. The first and second engine control units can be brought into operative connection with an internal combustion engine via the switching device in order to forward the control signals to the engine.In particular, the first and second engine control units are preferably operatively connected to the switching device such that the control signals of the first or second engine control unit can be forwarded to the internal combustion engine via the switching device. The switching device is designed such that it can switch the forwarding of the control signals so that, optionally, only the control signals of the first engine control unit or the second engine control unit are forwarded to the internal combustion engine.The first engine control unit is designed such that it can generate and transmit a live signal indicating its functionality, while at the same time being designed such that the generation and / or transmission or the correct generation and / or transmission of the live signal can end. The first engine control unit can actively terminate the generation or correct generation and / or transmission or correct transmission of the live signal, in particular, if an error or malfunction occurs which jeopardizes the proper control of at least one function of the internal combustion engine by the first engine control unit. In particular, the first engine control unit is preferably designed such that the generation and / or transmission of the live signal is terminated if the first engine control unit fails completely. The first engine control unit is operatively connected to the switching device such that its live signal can be received by the switching device.The switching device is designed or configured such that it ends the forwarding of the at least one control signal from the first engine control unit to the internal combustion engine and begins the forwarding of the at least one control signal from the second engine control unit to the internal combustion engine if the live signal from the first engine control unit is not received or is not received correctly. In the event of a fault, the switching device can therefore switch the control of the at least one function of the internal combustion engine from the first engine control unit to the second engine control unit. This can occur seamlessly, without disrupting the operation of the internal combustion engine. In particular, the switchover occurs in a timely manner so that the operation of the internal combustion engine is not immediately terminated due to the malfunction, thus preventing the internal combustion engine from stalling.

[0039] The first engine control unit is preferably operatively connected to the second engine control unit in such a way that all information necessary for controlling the at least one function of the internal combustion engine, in particular load points, characteristic map points, entire characteristic maps and / or integral components, can be transmitted from the first engine control unit to the second engine control unit.

[0040] The switching device is preferably designed as an electronic box which has inputs for connection to the first and second engine control units and at least one output for connection to the internal combustion engine.

[0041] A preferred arrangement is characterized by the fact that the first engine control unit and the second engine control unit are operatively connected to each other via a fieldbus. The fieldbus is preferably designed as a CAN bus (Controller Area Network bus). This provides a particularly simple and elegant way of operatively connecting the two engine control units for information transmission.

[0042] Finally, an arrangement is preferred which is characterized in that the second engine control unit is designed such that it can generate a live signal which indicates its functionality, wherein it can transmit the live signal continuously or periodically. It is operatively connected to the switching device and / or to the first engine control unit such that the live signal can be received by the latter. The switching device is preferably designed such that it only controls the at least one function of the internal combustion engine from the first to the second engine control unit if, on the one hand, the live signal from the first engine control unit is not received or is not received correctly, while, on the other hand, the live signal from the second engine control unit is received correctly.If, however, both live signals are not received or are not received correctly, other measures can be taken to ensure safe operation of the internal combustion engine or to shut it down in a controlled manner. It is also possible to switch the control of at least one function of the internal combustion engine back to the first engine control unit in the event of a malfunction of the second engine control unit and a temporary malfunction of the first engine control unit that has since ceased, as already described in connection with the method.

[0043] With regard to the arrangement, embodiments are preferred which have at least one feature which is predetermined by at least one step described within the scope of the method, preferably combinations thereof.

[0044] With regard to the method, preferred embodiments are those in which at least one method step is performed that is predetermined by at least one feature of the arrangement, preferably combinations thereof. In this respect, the description of the method and the arrangement should not be viewed in isolation from one another, but rather as complementary to one another, with method features being derived from the description of the arrangement and device features being derived from the description of the method. The same applies analogously to the method and the switching device, or to the switching device and the arrangement.

[0045] The object is finally achieved by creating an internal combustion engine with the features of claim 9. This is characterized by an arrangement according to one of the previously described embodiments. This realizes the advantages already explained in connection with the method, the switching device, and the arrangement.

[0046] An internal combustion engine is preferred which is characterized in that the internal combustion engine is designed as a common-rail engine, in particular as a diesel engine or a gas engine. In this case, the first and second engine control units are preferably provided to perform, on the one hand, high-pressure control with an intake throttle as the actuator, and, on the other hand, speed control or cruise control with at least one injector as the actuator. The internal combustion engine is preferably designed for use in a submarine or in a fire pump.

[0047] Also preferred is a fire extinguishing pump which is characterized by an internal combustion engine according to one of the previously described embodiments.

[0048] A submarine is also preferred which is characterized by an internal combustion engine according to one of the previously described embodiments.

[0049] Both fire pumps and submarines must meet particularly high safety standards, particularly with regard to the failure of an internal combustion engine, so that the advantages of the method, the switching device, the arrangement and the internal combustion engine are particularly realized here.

[0050] The use of an internal combustion engine according to one of the previously described embodiments is also preferred in the context of an application that must meet increased safety criteria with regard to the failure of the internal combustion engine, for example use in a submarine or in a fire extinguishing pump.

[0051] The invention is explained in more detail below with reference to the drawings, which show: Figure 1 shows a schematic representation of an embodiment of an arrangement for controlling an internal combustion engine; Figure 2 shows a flowchart illustrating an embodiment of the method for controlling an internal combustion engine; Figure 3 shows a schematic representation of a control diagram for a preferred embodiment of the method; and Figure 4 shows a schematic representation of an embodiment of an arrangement wherein a switching device has an interruption prevention means.

[0052] Figure 1 shows a schematic representation of an embodiment of an arrangement 1 for controlling an internal combustion engine 3. The arrangement 1 comprises a first engine control unit 5, a second engine control unit 7 and a switching device 9.

[0053] The first engine control unit 5 and the second engine control unit 7 can generate control signals that serve to control at least one function of the internal combustion engine, preferably a plurality of functions or to control and / or regulate the internal combustion engine completely. The first engine control unit 5 is connected to the switching device 9 via an operative connection 11, and the second engine control unit 7 is connected via an operative connection 13, such that the control signals can be transmitted to each of them. The switching device 9 is operatively connected to the internal combustion engine 3 via a third operative connection 15 for forwarding the control signals to the internal combustion engine. The switching device 9 only forwards the control signals from one of the two engine control units 5, 7 to the internal combustion engine 3 at any given time.

[0054] In the illustrated embodiment, each of the engine control units 5, 7 generates a live signal which indicates its functionality, wherein in the case of the first engine control unit 5 it is transmitted to the switching device 9 via a fourth active connection 17 and in the case of the second engine control unit 7 via a fifth active connection 19.

[0055] In order for the second engine control unit 7 to have all the information necessary for controlling the at least one function of the internal combustion engine 3, in particular for controlling or regulating it, the first engine control unit 5 is preferably operatively connected to the second engine control unit 7 via a field bus 21, so that the information can be transmitted from the first engine control unit 5 to the second engine control unit 7 once, immediately after or when the internal combustion engine 3 is started, periodically or as needed, in particular after a change in the information.

[0056] In the illustrated embodiment, the first engine control unit 5 is used as the main control unit. Therefore, as long as the switching device 9 receives the live signal from the first engine control unit 5 after the internal combustion engine 3 has been started, it forwards the control signals generated by the first engine control unit 5 to the internal combustion engine 3. Preferably, the second engine control unit 7 also generates all of the control signals required for control at the same time; however, these are not forwarded to the internal combustion engine 3 by the switching device 9. In the illustrated embodiment, the second engine control unit 7 is used as a backup control unit, which operates redundantly to the first engine control unit 5 and can take over the control of at least one function of the internal combustion engine 3 or its regulation in the event of a fault.

[0057] The functionality of arrangement 1 is explained using the Figure 2shown flowchart, which schematically illustrates a preferred embodiment of the method for controlling the internal combustion engine 3. At regular intervals, i.e. preferably after predetermined time intervals, or continuously, the first engine control unit 5 checks whether an error or malfunction is present that jeopardizes proper control of the at least one function of the internal combustion engine 3. As long as no such error or malfunction is present, the first engine control unit 5 correctly generates the live signal and sends it to the switching device 9 in a step S2. The switching device 9 forwards the control signals of the first engine control unit 5 to the internal combustion engine 3, so that the latter is controlled and / or regulated by the first engine control unit 5 at least with regard to the at least one function in a step S3.

[0058] If, however, an error or malfunction occurs, or the first engine control unit 5 fails completely, it stops generating and / or transmitting the live signal or correctly generating and / or correctly transmitting the same in a step S10. The live signal from the first engine control unit 5 is then no longer received or no longer received correctly by the switching device 9, which causes the switching device 9 to stop forwarding the control signals from the first engine control unit 5 to the internal combustion engine 3 in a step S11 and instead to begin forwarding the control signals generated and transmitted by the second engine control unit 7 to the internal combustion engine 3 for the control and / or regulation thereof, at least with regard to the at least one function. The second engine control unit 7 then controls and / or regulates the internal combustion engine 3 at least with regard to the at least one function in a step S12.

[0059] The flowchart shown in Figure 2 The method illustrated is preferably carried out for the second engine control unit 7 in the same way as was previously explained in connection with the first engine control unit 5 when the at least one function of the internal combustion engine 3 is controlled by the second engine control unit 7. For this purpose, the second engine control unit 7 also preferably generates a live signal indicating its functionality and sends this to the switching device 9. If an error or malfunction then occurs in the second engine control unit 7 or if it fails completely, the switching device 9 can preferably switch back to the first engine control unit 5 if its functionality has been restored due to a only temporary error, and the live signal of the first engine control unit 5 is received again by the switching device 9.

[0060] Figure 3shows a schematic representation of a control diagram for a preferred embodiment of the method. Identical and functionally equivalent elements are provided with the same reference numerals, so that reference is made to the preceding description. The representation according to Figure 3 Describes the redundant control of a controlled variable 23 to a setpoint 25. As redundant controllers, the first engine control unit 5 and the second engine control unit 7 are arranged in parallel. Also shown is the switching device 9, which forwards a controlled variable 27 either from the first engine control unit 5 or from the second engine control unit 7 to an actuator 29. This influences a manipulated variable 31, which acts on a controlled system 33.

[0061] To measure the controlled variable 23, two independent measuring elements are provided in the illustrated embodiment of the method or in one exemplary embodiment of the arrangement, namely a first measuring element 33, which is assigned to the first controller or the first engine control unit 5, and a second measuring element 35, which is assigned to the second controller or the second engine control unit 7. A first actual value 37 of the controlled variable is offset against the setpoint value 25 in a known manner, so that a first control deviation 39 is fed to the first controller. The second measuring element 35 determines a second actual value 41, from which a second control deviation 43 is calculated using the setpoint value 25 and fed to the second controller.It is advantageous if not only the controllers but also the measuring elements are designed redundantly, because in this way errors, malfunctions or a complete failure of a sensor can be compensated by switching to a parallel control loop.

[0062] As long as the first engine control unit 5 is active as a controller, it sees a closed control system because the control variable 27 it generates is forwarded to the actuator 29 via the switching device 9. The second engine control unit 7, on the other hand, sees an open control loop because there is no operative connection to the actuator 29 as long as the switching device forwards the control variable 27 of the first engine control unit 5 to it. This gives rise to the problem that, over time, the integral components in the second engine control unit 7 assume values ​​that are not suitable for controlling the controlled variable 23. To solve this problem, one of the alternative procedures described above is used when switching the control to the second engine control unit 7.

[0063] In a preferred embodiment of the method, the manipulated variable 23 is a rotational speed of the internal combustion engine or a speed of a vehicle driven by the internal combustion engine. The actuator 29 in this case is at least one injector. Preferably, all injectors of the internal combustion engine are used as actuators. Alternatively, the manipulated variable 23 is preferably the pressure in a high-pressure accumulator of an injection device of the internal combustion engine, in particular the pressure control for a rail of an internal combustion engine designed as a common-rail diesel engine. The actuator 29 in this case is the suction throttle of a high-pressure pump, the passage cross-section of which is varied in order to regulate the rail pressure.

[0064] An embodiment of the method is also preferred in which the first engine control unit 5 or the second engine control unit 7 regulates both a rotational speed or a speed of the internal combustion engine and a high pressure for an injection device. In this case, the scheme according to Figure 3 to virtually duplicate, or the first engine control unit 5 and the second engine control unit 7 each generate two control variables, namely a first for controlling the at least one injector and a second for controlling the intake throttle. Accordingly, separate measuring elements are also provided for the engine speed or velocity on the one hand and the high pressure on the other. Furthermore, the engine control units 5, 7 each have two inputs for two control deviations in the two control circuits.

[0065] It is evident that switching from the first engine control unit 5 to the second engine control unit 7 must be performed within a short time interval, preferably within a time interval of less than 100 ms, to prevent the internal combustion engine from stalling, for example, because no or too little fuel is injected, or because the high pressure is excessively high. For this purpose, it is particularly necessary to supply current to the intake throttle of the high-pressure pump without interruption. To ensure this, the switching device 9 preferably comprises an interruption prevention means.

[0066] Figure 4shows an embodiment of an arrangement 1 in which the switching device 9 has such an interruption prevention means 45. Identical and functionally identical elements are provided with the same reference numerals, so that reference is made to the previous description in this regard. The first engine control unit 5 and the second engine control unit 7 are identical here, so that only the structure of the first engine control unit 5 will be explained in more detail. This comprises a switch 47, through which a voltage source 49 can be connected to an output 51, which is connected to a first input 53 of the switching device 9. As a control variable, a current flows from the voltage source 49 via the output 51 and the input 53 of the switching device 9 to a suction throttle (not shown) serving as an actuator, the opening or passage cross-section of which is controlled by the current flow through a coil 55.The current flows back via a first output 57 of the switching device 9 to an input 59 of the first engine control unit 5. This preferably comprises a measuring device 61 for measuring the current flowing through the coil 55. With the help of the measuring device 61, the first engine control unit 5 can also decide whether it is currently controlling the intake throttle or not. This will be explained in more detail below in connection with the second engine control unit 7. Preferably, however, both engine control units 5, 7 detect whether they are currently responsible for control or are controlling the actuators, for example the intake throttle. In order to avoid excessive voltage peaks when the switch 47 opens, i.e. when the voltage source 49 is disconnected from the output 51, a freewheeling diode 63 is arranged between the output 51 and the input 59 in a known manner.

[0067] As already indicated, the second engine control unit 7 is identical to the first engine control unit 5. Here, the measuring device 61 serves, in particular, to detect whether the intake throttle (not shown) is being controlled by the second engine control unit 7. As long as this is not the case, an output 51' is not connected to the input 53 of the switching device 9. Likewise, an input 59' of the second engine control unit 7 is not connected to the output 57 of the switching device 9. Therefore, although the voltage generated by the voltage source (not shown) of the second engine control unit 7 is present at the output 51', no current flows. To switch from the first engine control unit 5 to the second engine control unit 7, the switching device 9 in the illustrated embodiment comprises a first switch 65 and a second switch 67.The first switch 65 can be used to break the connection between output 51 and input 53, and a connection can be established between the first output 51' and input 53. Similarly, the second switch 67 can be used to establish a connection between input 59' and output 57, while a connection between input 59 and output 57 can be broken. After switching has taken place, the circuit of the second engine control unit 7 is closed via output 51', input 53, coil 55, output 57, and input 59'. In this case, the measuring device of the second engine control unit 7 detects a current flow that is preferably greater than a predetermined threshold value. The second engine control unit 7 thereby recognizes that the control of the intake throttle has been switched to it. The integral components of the second engine control unit 7 are then preferably initialized according to one of the previously described embodiments.

[0068] The current flow through coil 55 must preferably be maintained when switching from the first engine control unit 5 to the second engine control unit 7 so that the internal combustion engine does not stall or an impermissible pressure does not build up in the high-pressure accumulator. To ensure this, the switching device 9 comprises the interruption prevention means 45, which is designed here as a freewheeling means 69. This is designed such that the circuit remains closed via the freewheeling means 69, or the current flow through coil 55 via the freewheeling means 69 is maintained while the first switch 65 and the second switch 67 are switched. The freewheeling means 69 preferably comprises at least one diode, here three diodes 71 / 1, 71 / 2, 71 / 3.

[0069] The interruption prevention means 45 is preferably designed such that it does not influence the current measurement in the measuring device 61 or the corresponding measuring device in the second engine control unit 7. For this purpose, it is particularly provided that the freewheeling means 69 is correspondingly matched to the freewheeling diode 63. This is ensured in the illustrated embodiment by the fact that three diodes 71 / 1, 71 / 2, 71 / 3 are used in the freewheeling means 69, while only one freewheeling diode 63 is provided in the first engine control unit 5 and, accordingly, also in the second engine control unit 7.

[0070] It can be seen that the current flow through coil 55 correlates with the fuel delivery rate through the intake throttle. As a result, the current flow influences the pressure in the high-pressure accumulator. The interruption prevention device 45 keeps the current flow essentially constant even during switching, so that the pressure in the high-pressure accumulator also remains essentially constant during switching.

[0071] Overall, it can be seen that the method and arrangement for controlling an internal combustion engine make it easy to detect whether an engine control unit regulating the internal combustion engine has a malfunction that jeopardizes its proper operation. It is then possible to switch from one engine control unit to another in a timely and seamless manner without causing a significant disruption to the operation of the internal combustion engine, such as stalling. The method is straightforward and very safe.

Claims

1. Method for controlling an internal combustion engine (3), wherein a first engine control unit (5) generates at least one control signal in order to actuate at least one function of the internal combustion engine (3), wherein a switchover device (9) passes on the at least one control signal of the first engine control unit (5) to the internal combustion engine (3) for actuating the at least one function of the internal combustion engine (3), wherein the first engine control unit (5) continuously or periodically transmits a sign-of-life signal indicating its functionality to the switchover device (9), wherein the first engine control unit (5) does not transmit the sign-of-life signal or does not transmit it correctly when an error occurs that puts the proper actuating of the at least one function of the internal combustion engine (3) by the first engine control unit (5) at risk, and wherein the switchover device (9) stops the passing on of the control signals of the first engine control unit (5) to the internal combustion engine (3) and begins to pass on at least one control signal generated by a second engine control unit (7) for actuating the at least one function of the internal combustion engine (3) to the internal combustion engine (3), if the sign-of-life signal of the first engine control unit (5) is not received or is not correctly received by the switchover device (9), characterised in that the second engine control unit (7) generates a voltage continuously as a control signal during operation of the internal combustion engine (3), even when this is not passed on to the internal combustion engine (3) by the switchover device (9), wherein a current flows based on the voltage when the second engine control unit (7) controls the at least one function of the internal combustion engine (3), wherein no current flows, when the control signal is not passed on by the switchover device (9) to the internal combustion engine (3), wherein the second engine control unit (7) monitors the current flow to detect whether it actuates the at least one function of the internal combustion engine (3) if the current exceeds a predetermined threshold value, and wherein the second engine control unit (7) initialises parameters for actuating the at least one function of the internal combustion engine (3) with stored values or releases retained values of the parameters for variation when it detects that it is actuating the at least one function of the internal combustion engine (3).

2. Method according to claim 1, characterised in that the first engine control unit (5) transmits data necessary for actuating the at least one function of the internal combustion engine (3) to the second engine control unit (7) a single time after or at starting of the internal combustion engine (3), periodically or as needed, or after a change in the data, or in that data necessary for actuating the at least one function of the internal combustion engine (3) are stored in the second engine control unit (7), wherein the data are called up when the actuating of the at least one function of the internal combustion engine (3) is switched over to the second engine control unit (7).

3. Method according to one of the preceding claims, characterised in that the second engine control unit (7) transmits a sign-of-life signal indicating its functionality continuously or periodically to the switchover device (9) or to the first engine control unit (5).

4. Method according to one of the preceding claims, characterised in that an actuator system of the internal combustion engine (3), in particular at least one injector and / or at least one suction throttle, is actuated by the first or the second engine control unit (5, 7).

5. Method according to one of the preceding claims, characterised in that the second engine control unit (7) continuously actuates a suction throttle, wherein it monitors a current flowing from the second engine control unit (7) through the suction throttle.

6. Arrangement (1) for controlling an internal combustion engine (3), in particular for carrying out a method according to one of claims 1 to 5, having a first engine control unit (5), a second engine control unit (7) and a switchover device (9), wherein the first and second engine control units (5, 7) are adapted to generate control signals to actuate at least one function of the internal combustion engine (3), wherein the first and second engine control units (5, 7) can be operatively connected to an internal combustion engine (3) via the switchover device (9) in order to pass on the control signals to the internal combustion engine (3), wherein the first engine control unit (5) is adapted to generate and transmit a sign-of-life signal indicating its functionality, wherein the first engine control unit (5) is adapted such that the sign-of-life signal is not generated and / or transmitted, or is not generated and / or transmitted correctly, when an error occurs, which puts at risk a proper actuating of the at least one function of the internal combustion engine (3) by the first engine control unit (5), wherein the first engine control unit (5) is functionally connected to the switchover device (9) such that the sign-of-life signal can be received by the switchover device (9), and wherein the switchover device (9) is configured to stop passing on of the at least one control signal of the first engine control unit (5) to the internal combustion engine (3) and to start the passing on of the at least one control signal of the second engine control unit (7) to the internal combustion engine (3) if the sign-of-life signal of the first engine control unit (5) is not or not correctly received by the switchover device (9), characterised in that the second engine control unit (7) is adapted to generate a voltage continuously as a control signal during operation of the internal combustion engine (3), even when this is not passed on to the internal combustion engine (3) by the switchover device (9), wherein a current flows based on the voltage, when the second engine control unit (7) controls the at least one function of the internal combustion engine (3), wherein no current flows if the control signal is not passed on to the internal combustion engine (3) by the switchover device (9), wherein the second engine control unit (7) is adapted to monitor the current flow in order to recognise whether it controls the at least one function of the internal combustion engine (3) if the current exceeds a predetermined threshold value, and wherein the second engine control unit (7) is adapted to initialise parameters for actuating the at least one function of the internal combustion engine (3) with stored values or to release retained values of the parameters for variation when it detects that it is actuating the at least one function of the internal combustion engine (3).

7. Arrangement (1) according to claim 6, characterised in that the switchover device (9) comprises at least one switch, preferably a semiconductor switch or an electromechanical switch, in particular a relay.

8. Arrangement (1) according to one of claims 6 and 7, characterised in that the switchover device (9) comprises an anti-interrupt means (45), by means of which a transmission of at least one control signal from the switchover device (9) to the internal combustion engine (3) can be maintained during a switchover between the engine control units (5, 7).

9. Internal combustion engine (3), characterised by an arrangement according to one of claims 6 to 8.

10. Internal combustion engine (3) according to claim 9, characterised in that the internal combustion engine is configured as a common rail engine, in particular as a diesel engine or as a gas engine, wherein the internal combustion engine is preferably configured for use in a submarine or in a fire pump.