Method of Testing the Operativeness of a Control System

The present invention concerns methods for testing the operativeness of certain types of control systems. Control systems of the type here in question are provided with a feedback transducer for sensing the value of a monitored variable, a control device and actuatable adjuster units, the control device being provided with a self-monitoring circuit operative, when the control device is switched on, for implementing a testing program comprised of a sequence of test functions of operations devised to test the operativeness of the entire negative-feedback control system. In the event that the negative-feedback control system, as a result of the test program runthrough, is found to be inoperative or malfunctioning in any tested respect, the control device of the system is shut off and a malfunction indication is generated.

Such negative-feedback control systems are used, for example, in the context of anti-wheel-lock control in automotive braking systems. Such anti-wheel-lock systems are often provided with a built-in self-monitoring circuit. At the start of a trip, for example as the driver turns on the vehicle's engine, the self-monitoring circuit initiates a sequence of tests in accordance with a predetermined test program. If as a result of the test program the self-monitoring circuit ascertains that there is a malfunction in any tested part of the control system, a warning signal is triggered informing the user of the fact, e.g., a dashboard lamp becoming illuminated. This serves to inform the user that the anti-lock system has been shut off, and that he is not to rely on it during any possible hard braking.

Hard-braking contexts are hazardous by definition, and it is important that a driver know whether the anti-wheel-lock action afforded by his braking system is or is not operative, when commencing to brake very hard. A problem with systems of the type just outlined, is that the self-monitoring circuit itself may be inoperative or improperly functioning, so that despite inoperativeness of the anti-wheel-lock system, the user is not informed of the situation.

It is accordingly a general object of the invention to provide a system of the type outlined above, in which furthermore the operativeness and proper functioning of the self-monitoring circuit of the system is likewise tested.

In the preferred embodiment of the invention, when the control device of the control system is initially not yet switched on, artificially generated signals simulating predetermined values of control signals, and also operating voltage, are applied to the control device in order to initiate the test program, and the course of performance of the test program is automatically monitored. Upon completion of the test program without the generation of a malfunction signal, the test program is repeated with the simulation of a predetermined malfunction to ascertain whether a malfunction signal will actually result. The test program may then be performed a further time, with a different simulated malfunction. In this way, one or even a long sequence of simulated malfunctions are presented, and the response of the self-monitoring circuit to each ascertained.

Proceeding in accordance with the inventive technique, it is possible, if desired quite exhaustively, to ascertain correct operation of the self-monitoring circuit by making use of its own inherent malfunction-responsive actions, i.e., without having to provide a second self-monitoring circuit to monitor the operativeness of the first self-monitoring circuit in the sense that the first self-monitoring circuit has to monitor operation of the whole system. Instead, the means needed to perform the simulations of predetermined malfunctions to which the self-monitoring circuit is supposed to respond, need not be complex or extensive. Another advantage of the invention is that because predetermined malfunctions, to which the self-monitoring circuit is supposed to respond, are simulated in sequence, failure of the self-monitoring circuit to generate a warning signal in response to one of these simulations indicates, inherently, which malfunction the self-monitoring circuit is presently incapable of detecting.

The novel features which are considered as characteristic for the invention are set forth in particular in the appended claims. The invention itself, however, both as to its construction and its method of operation, together with additional objects and advantages thereof, will be best understood from the following description of specific embodiments when read in connection with the accompanying drawing.

FIG. 1 is a schematic block diagram of a negative-feedback control system provided with a testing device which can be switched into circuit with the control system for implementing the inventive method; and

FIG. 2 is a schematic block diagram of an embodiment of the testing device, along with parts of the control system of FIG. 1.

FIG. 1 very schematically depicts, as an example of a negative-feedback control system with which the invention would be concerned, an anti-wheel-lock system for vehicular braking systems. The anti-wheel-lock system includes an rpm feedback transducer unit 1 which, in conventional manner, senses the rotary speeds of the wheels of a vehicle and transmits corresponding rpm signals via a cable 2 to the control device 3 of the anti-wheel-lock system. The control device 3 contains all the usual signal-evaluating circuitry of such an anti-wheel-lock system, e.g., circuitry for ascertaining the differences in rotary speed as among different braked and unbraked wheels, circuitry for responding to rates of change of rotary speed of abruptly braked wheels, and so forth, such control devices being familiar to persons familiar with anti-wheel-lock systems. The control device 3 converts its evaluations of braking performance into actuating signals which are transmitted via a cable 4 to the hydraulics unit 5 of the system, e.g., to actuate valves to lower hydraulic braking pressure when a skid is developing, and so forth. The cables 2 and 4 branch together to form a common cable 6, into which a testing device 7 can be connected in circuit by means of changeover switches 8. Instead of changeover switches 8, e.g., when the system is not permanently to be provided with the testing device 7, use can be made of corresponding plug-and-socket connectors for connecting the cables 9 of testing device 7 into circuit with cable 6. As already indicated, the hydraulics unit 5 of the anti-wheel-lock system typically comprises a set of electromagnetically controlled valves each associated with one respective brake wheel of the vehicle and controllable for varying the braking force applied to each individually associated vehicle wheel.

At its simplest, the control device 3, in addition to amplifiers and other such signal-processing circuitry, may comprise for example four circuit stages each operative for monitoring the rate of change of rotary speed of a respective one of the four braked wheels of a vehicle. When the rotary-speed decrease attendant to the deceleration of braking exhibits a rate of change in excess of a predetermined magnitude, for a particular one of the braked wheels, the control device 3 sends out to hydraulics unit 5 a control signal commanding that the braking force applied to that wheel be lowered, in order to prevent the onset of skidding or wheel lock. This rate of rotary-speed change evaluating circuitry may, for example, comprise four storage-capacitor circuits, each storage capacitor of which can react to changes in value of the rpm signal of the associated wheel up to a predetermined maximum rate of change, but for rates of change higher than the maximum instead transmits a signal resultant from the abrupt rate of rpm change.

The control device 3 additionally includes a self-monitoring circuit which is operative, when the vehicle is being started up, for automatically implementing an internal test program which serves to test the anti-wheel-lock system with respect to predetermined possibilities of malfunction. If as a result of the test program a malfunction or improper operation is detected, a warning is generated for the driver, e.g., by the illumination of a dashboard warning light, and simultaneously the anti-wheel-lock system is automatically shut off. However, automatic shutoff of the anti-wheel lock system and the generation of the warning signal do not occur if it is the self-monitoring circuit itself which is malfunctioning.

FIG. 2 schematically depicts the internal configuration of a testing device 7 used in accordance with the present invention, as well as components of the anti-wheel-lock system. The testing device 7 includes a pulse or A.C. waveform generator 11 which generates a signal simulating a wheel-rpm feedback signal such as is applied to the anti-wheel-lock system during normal operation of the system. This simulated-rpm signal is transmitted via a normally conductive electronic switch 12 and applied to a set of contacts 13, which in turn are connectable via plug-and-socket connections, or the equivalent, to the four rpm feedback-signal inputs of control device 3. In addition to this simulated-rpm signal, when testing device 7 is switched on, operating voltage is furnished to control device 3, via non-illustrated connections, as a result of which the self-monitoring circuit 15 internal to control device 3 initiates implementation of the test program and, upon completion of the test program, transmits a pulse via line 14 to testing device 7. This pulse serves to inform testing device 7 that the test program implemented by self-monitoring circuit 15 has been finished. If the self-monitoring circuit 15 has not ascertained the presence of a malfunction, this can be attributed to the fact that the self-monitoring circuit 15 is itself defective in operation. To test the self-monitoring circuit 15, the test program is reinitiated, but only after a malfunction has been simultated, by interruption of looped lines performed by testing device 7. In FIG. 2 only one such line 16 is depicted, which connects the valve-control stage 17 of control device 3 with the hydraulics unit 5 of the system. Connected in this line 16 is a switch 18 which can be opened to simulate a fault in this line. After switch 18 is opened the test program is reinitiated, and if the self-monitoring circuit is operating properly with respect to this possible malfunction a malfunction signal is generated by self-monitoring circuit 15. In contrast, if self-monitoring circuit 15 issues no malfunction signal and instead transmits a pulse via line 14 at the end of the test program, this serves to indicate that the self-monitoring circuit is defective. The type of malfunction or fault simulated furthermore provides an indication of what part or aspect of the self-monitoring circuit, or what part of the test program, is defective. It will be understood that testing device 7 may have a switch like switch 18 for each connection between control circuit 3 and other components of the anti-wheel-lock system, for instance in each line leading from valve-control stage 7 to the solenoid 22 of a respective one of the solenoids associated with individual braked wheels in hydraulics unit 5, between control device 3 and the individual rpm feedback transducers of the rpm feedback stage 1, and so forth. It is likewise possible to loop special lines of control device 3 through the testing device 7 in order to be able to test these lines with respect to faults. It will be understood that when a plurality of switches such as switch 18 is provided the switches can be closed and then opened in accordance with a predetermined program, with the test program implemented by self-monitoring circuit 15 being reinitiated each time a different one of such succession of switches is closed, until such time as despite the simulated fault or malfunction no malfunction signal is triggered.

If it emerges that the self-monitoring circuit 15 is not operating correctly, then testing of the anti-wheel-lock system can be performed by testing the electronic control device 3 itself. To this end, a switch 19 is closed, connecting line 14, on which the end of program pulse is furnished, with the electronically controllable switch 12, so that the appearance of the end of program pulse have the result of rendering switch 12 non-conductive. Frequency generator 11 is then connected to the contacts 13 via a gate 20, gate 20 being maintained transmissive for the duration of a gating pulse furnished by a monostable circuit 21. Monostable circuit 21 is triggered by the end of program pulse furnished by self-monitoring circuit 15, so that control device 3 upon completion of the test program continue to receive rpm-simulating signals via the gate 20 for a predetermined limited time interval, the rpm-signals furnished simulating a predetermined speed. At the end of the gating pulse furnished by monostable circuit 21, gate 20 becomes nontransmissive, so that control device 3 no longer receive simulated-rpm signals. This disappearance of simulated-rpm signals simulates locking of the braked wheels. This wheel-lock situation should result in a response on the part of the solenoid valves 22 of hydraulics unit 5. Accordingly, upon simulation of wheel-lock, control device 3 should supply to solenoid valves 22 a signal commanding that they reduce braking force. Thus, the operativeness of control device 3 can be tested by measuring the current which it supplies to the solenoid valves. The duration of the gating pulse furnished by monostable circuit 21 is such that the rpm-signal storing capacitors referred to earlier have enough time to assume stored rpm-signal values so dimensioned that, upon occurrence of simulated wheel-lock, enough time remains for one or a plurality of current measurements to be performed. The flow of current begins with the abrupt removal of the simulated-rpm signals and terminates at the latest when the stored rpm values, which upon simulated wheel-lock decrease at the maximum rate of change of which the signal-storing capacitors are capable, drop below a predetermined lower threshold value. It is accordingly necessary that the current measurements be performed exactly within this time interval. To this end, the trailing flank of the gating signal furnished by monostable circuit 21 is used to trigger a second monostable circuit 23 which furnishes a gating pulse to a current-metering stage 24, the latter performing a measurement of solenoid current in cooperation with a series resistor 25 connected in a respective solenoid current path; current-metering stage 24 is provided with a display 26 for display of the measured current value. If the indicated current value lies within prescribed limits, then this is an indication of correct functioning of the control device 3 in such respect. It will be understood that in order to test control device 3 other signals and values of signals can be applied to it in order to monitor other aspects of the operation of the control device, to ascertain whether the magnitudes of the signals generated by control device 3 are in accordance with the negative-feedback control action which control device 3 is intended to implement.

It will be understood that each of the elements described above, or two or more together, may also find a useful application in other types of circuit configurations differing from the types described above.

While the invention has been illustrated and described as embodied in the context of an anti-wheel-lock system for vehicular braking systems, it is not intended to be limited to the details shown, since various modifications and structural changes may be made without departing in any way from the spirit of the present invention.

Without further analysis, the foregoing will so fully reveal the gist of the present invention that others can, by applying current knowledge, readily adapt it for various applications without omitting features that, from the standpoint of prior art, fairly constitute essential characteristics of the generic or specific aspects of this invention.