Air bag operation device
BACKGROUND OF THE INVENTION 
     The present invention relates to an air bag device that maintains safety for the passengers in a vehicle crash, and particularly to an air bag device adapted for use in automobiles. 
     In order to improve reliability of processing in an air bag control, known prior art controls use two CPUs to perform the same processing, the results are compared by a comparator (that is not guaranteed fail-safe), and an operation signal is output to the air bag device only when the results processed by the two CPUs are the same. Such a control arrangement is described, for example, in SAE Paper 901123 &#34;Sensing and Systems Aspects of Fault Tolerant Electronics Applied to Vehicle Systems.&#34; 
     In Japanese Laid-Open Patent Publication No. 168545/1989, furthermore, a diagnosing circuit (which is likewise not guaranteed for fail-safety) is added to detect any fault that has developed in the air bag device. In this manner, a fault in the system is removed as early as possible, in order to improve reliability. Methods for detecting the occurrence of a failure in computer systems by means of regular self diagnosis are also used in fault tolerant systems, such as railway controls, for example. 
     One disadvantage of the above-mentioned conventional systems is that two CPU modules (CPUs and memories) are required, which not only adds expense, but also makes the hardware bulky. Moreover, despite the redundant processing of data, it is still possible for such devices to inflate the air bag in the absence of a crash, which poses a serious safety hazard, especially if such erroneous inflation occurs at high vehicle speed. On the other hand, if the air bag fails to inflate in the event of a crash in which it should have been inflated, there is a substantial likelihood that the driver will be killed. 
     Such processing which affects the human life must be guaranteed fail-safe. However, according to the method of the prior art, though relatively high reliability has been maintained, fail-safety has not been guaranteed. 
     SUMMARY OF THE INVENTION 
     An object of the present invention is to provide an air bag operation device which guarantees sufficient fail-safety for the operation of the air bag by using only one CPU module, without increasing the size of the hardware. 
     This object is accomplished by the control arrangement according to the invention, which utilizes a single CPU module, provided with a plurality of crash-discriminating programs of different versions and a plurality of self-diagnosing programs of different versions. Operation signal generation processing on the air bag device according to the invention is based on a comparison of the results provided by the plurality of versions of crash-discriminating programs. In addition, abnormality alarm display processing is also provided, based on the comparison of the discriminated results by the plurality of self-diagnosing programs. 
     According to the invention, the CPU module receives an output signal from a crash sensor that detects the acceleration and outputs a value corresponding thereto. Upon receipt of a signal from the crash sensor, the CPU module determines whether or not the signal is due to a crash, relying upon the results received from a plurality of different versions of crash-discriminating programs. The CPU module sends the plurality of discriminated results as alternating signals having a predetermined frequency to a frequency logic fail-safe circuit. 
     At all times when there is no input signal from the crash sensor, the CPU module operates a plurality of versions of self-diagnosing programs, so that it continuously checks the CPU itself, the memory and the peripheral equipment (power source, crash sensor, abnormality warning display, air bag igniter, etc.) to determine whether a failure exists in the system. The CPU module also sends the plurality of the self-diagnosed results as alternating signals of a predetermined frequency to the frequency logic fail-safe circuit. 
     In the event that such alternating signals are no longer produced, or when signals of an incorrect frequency are output from the CPU module, the frequency logic fail-safe circuit fixes the output to the air bag at a value which will not inflate the air bag and, at the same time, outputs a signal to an alarm device to warn of the occurrence of an abnormal condition. Furthermore, if the frequency logic fail-safe circuit itself becomes defective, it likewise fixes the output to the air bag igniting device to a value that does not inflate the air bag and, at the same time, outputs an alarm signal in the same manner as in the event of a crash. Thus, if an abnormal condition (a fault) develops in any part of the air bag system, it can be reliably detected by the plurality of self-diagnosing programs, and can be displayed so far as the CPU module is properly functioning. 
     Moreover, although the plural versions of crash-discriminating programs and self-diagnosing programs have the same function and perform the same diagnosis, they are so constituted as to use separate instructions, registers and memories to the greatest extent possible. Therefore, if a fault develops in the CPU module which causes it to produce an erroneous output, the results of the plurality of self-diagnosing programs will be inconsistent with each other. Moreover, since the diagnosed result is discriminated based on the outputs of the plurality of these programs, any such fault will cause the frequency logic fail-safe circuit to send a signal to the alarm device to warn of the occurrence of an abnormal condition. Thus, a fail-safety guaranteed air bag system is provided. 
     According to the present invention in which a fault alarm and an air bag ignition signal are output from the fail-safe circuit, the following two features can be guaranteed: 
     (1) The air bag is never inflated erroneously when the car is driven ordinarily; and 
     (2) When the car has crashed and no fault alarm is being produced, the air bag is inflated without fail. 
     Other objects, advantages and novel features of the present invention will become apparent from the following detailed description of the invention when considered in conjunction with the accompanying drawings. 
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS 
     FIG. 1 is a block diagram which shows an air bag operation device according to the present invention; 
     FIG. 2 is a block diagram which shows in greater detail the air bag operation device according to the present invention; 
     FIG. 3 is a diagram explaining the operation of the present invention; 
     FIG. 4 is a flow chart illustrating operating steps performed by the present invention; 
     FIGS. 5A and 5B are flow charts illustrating additional operating steps performed by the present invention; 
     FIG. 6 is a timing chart for explaining the operation of the present invention. 
     FIG. 7 is a second timing chart for explaining the operation of the present invention; 
     FIG. 8 is a third timing chart for explaining the operation of the present invention; 
     FIG. 9 is a table of truth values for explaining the operation of the frequency logic fail-safe circuit according to the present invention; and 
     FIG. 10 is a partial circuit diagram of an AC-driven amplifier suitable for use in the air bag operation device according to the invention. 
    
    
     DETAILED DESCRIPTION OF THE DRAWINGS 
     FIG. 1 illustrates an embodiment of the present invention which is constituted by a control module 1 that controls the air bag system, a power supply unit 2 for supplying electric power to the air bag system, a crash sensor 3 including a detector which detects a negative acceleration, an alarm device 4 which indicates the occurrence of an abnormal condition (fault) in the air bag system so that the driver may perceive it, an air bag igniting device 5 which causes the air bag to be inflated in case of a crash, and a recorder 6 which records the occurrence of a crash. 
     The control module 1 sends predetermined diagnostic signals to the power source unit 2, crash sensor 3, alarm device 4, air bag igniting device 5 and recorder 6, and examines responses therefrom, in order to diagnose these portions in the manner disclosed, for example, in U.S. Pat. No. 4,999,775. 
     FIG. 2 shows the details of the control module 1, which is constituted by a frequency logic fail-safe circuit 10C and a CPU module 10 which is made up of a CPU 10A and a memory 10B. 
     The AC-driven amplifiers 40 and 50 will be described later. When a signal of a level &#34;1&#34; is input from the AC-driven amplifier 40, the abnormality alarm device 4 performs the display operation in a predetermined manner, so that the driver of the car is informed of the occurrence of any abnormal condition in the air bag system. That is, the driver of the car is informed that the air bag will not work, even in case of a crash. Upon receipt of a signal of the level &#34;1&#34; from the AC-driven amplifier 50, on the other hand, the air bag igniting device 5 operates to inflate the air bag (not shown). 
     The control module 1 receives a crash signal from the crash sensor 3, and the CPU module 10 determines whether or not the car has actually crashed. When it is determined by the CPU module 10 that the car has crashed, the CPU module 10 outputs an air bag igniting signal to the frequency logic fail-safe circuit 10C to inflate the air bag. 
     The frequency logic fail-safe circuit 10C determines whether or not a correct output is produced from the CPU module 10. When the output is determined to be correct, the air bag igniting device 5 is actuated to inflate the air bag. Thus, the frequency logic fail-safe circuit 10C literally has a fail-safe function, and the processing steps according to the invention are all fail-safe. (As the term is used herein, a fail-safe circuit is a circuit which produces a predetermined signal without fail in case a fault has occurred inside the circuit.) 
     FIG. 3 illustrates the processing steps executed by the CPU module 10. In the air bag system as described above, the occurrence of a fault anywhere in the system (including the CPU module 10) that may lead to erroneous control must be detected by the fail-safe circuit. As shown in FIG. 2, furthermore, the air bag system has only one CPU, which is provided with a plurality of programs having the same function, but being different versions. The programs are individually executed, and the results are compared by the fail-safe circuit in order to detect a fault in the CPU module. 
     When electric power supply 2 initiates the supply of electric power to the air bag system of the invention, the system first executes an initial diagnosis on the peripheral apparatus such as the crash sensor 3, power source unit 2, recorder 6, abnormality alarm device 4, and the igniter device 5, all connected to the CPU. If an abnormal condition is detected by the initial diagnosis, the output values to the frequency logic fail-safe circuit 10C are all fixed to 0, and subsequent processing is discontinued. When no abnormal condition is detected in the initial diagnosis, the system transfers to the self diagnosis made, in which two versions of a self-diagnosing program are executed alternately as shown in FIG. 3 in order to detect any fault in the CPU module 10. The purpose of the self-diagnosing programs executed in the self-diagnosing mode is to check the memory and bus used by the CPU 10A and the instructions of the CPU, which detect the crash. 
     FIG. 4 illustrates the application of the self-diagnosing programs when there is no input signal from the crash sensor 3. In this event, two kinds of programs--i.e., version 1 and version 2--are always alternately applied. 
     FIGS. 5A and 5B are flow charts illustrating the processing steps performed by the first and second versions of the self-diagnosing program. The first version first checks the content of the memory (n bytes having address 0-n, containing data X o  -X n ), used for detecting a crash. X n  is a test value for the sum check, selected such that X 0  +X 1  +- - - +X n-1  =X n . The values from X 0  to X n-1  are added in the A register, and the final calculation, A=A-X n , is performed after finishing of the above described additional calculation. Accordingly, the value in the A register becomes 00 (16 order system expression) when no failure exists in the system. Next, an instruction check of the CPU is performed, in which a diagnostic calculation (such as sum check, or the like) is performed in a known manner such that when the value of the A register before the calculation is 00 (16 order system), the value of the A register as the result of the calculation is also 00 (16 order system). And, a binary data word obtained by the diagnosis is entered in a predetermined register X in the CPU. Accordingly, as a result of the check, if no abnormality is detected, an 8-bit binary data word 00000000 is entered into the register X, but if an abnormality is detected, a value other than 00000000 is entered into the register X. 
     The second version of the self-diagnosing program (FIG. 5B) first resets the values of the register A and index i, and then checks the instruction of the CPU. For this purpose, a diagnostic calculation (such as sum check, etc.) is performed in the same manner as in the first version of the self-diagnosing program, so that when the value stored in the A register before the calculation is 00 (16 order system), the value contained in the A register as the result of the calculation is also 00 (16 order system). The content of the memory (n bites having address 0-n, containing data X 0  -X n ) used for detecting a crash is checked. Xn is a test value for sum check, selected such that X 0  +X 1  +- - - +X n-1  =X n . The values from X 0  to X n-1  are added in the A register, and the final calculation, A=A-X n , is performed after finishing the above described additional calculation. Accordingly, the value in the A register becomes 00  (16 order system expression) when no failure exists in the system. Then, a number complementary to the value in the A register is calculated and re-entered into the A register, and the binary data word obtained by the diagnosis is entered in the predetermined register X in the CPU. Accordingly, as a result of the check, if no abnormality is detected, the 8-bit binary data 11111111 is entered into the register X, but if an abnormality is detected, a value other than 11111111 is entered into the register X. 
     As described above, and illustrated in FIGS. 3 and 4, these two versions of the self diagnosing program are alternated repeatedly in a manner as shown in FIG. 6. When they are properly operating with no abnormal condition, and the values of the 8 bits stored in the register X are read out serially, the output alternates between &#34;1&#34; and &#34;0&#34; at predetermined intervals as shown in FIG. 6. Therefore, alternating signals having a predetermined frequency f 0  are obtained by reading the data of bits 1 to 8 of the register X. 
     It is apparent that, according to the invention, the first and second versions of the self-diagnosing program have the same function. However, these two programs are so constituted as to use different instructions, registers and memories to the greatest extent possible, though they perform the same diagnosis. Therefore, if a fault develops for example, in the CPU 10A, and an incorrect value is output, the results of the two kinds of diagnosing programs become inconsistent. That is, the above described alternating pattern stops, at least for one or more bits among the 1st to 8th bit signals of the register X. 
     When, on the other hand, a crash signal is input to the CPU 10A from the crash sensor 3, the CPU operation in the self-diagnosing mode is interrupted, and the CPU shifts to the crash discriminating mode, which determines whether a crash has actually occurred, as shown in FIGS. 7 and 8. 
     Processing in the crash-iscriminating mode is constituted by two different versions of similar crash-discriminating programs, in a manner analogous to the processing in the self-diagnosing mode. Thus, when a crash signal is input from the crash sensor 3, the two versions of crash-diagnosing programs are executed alternately as shown in FIGS. 7 and 8. 
     The first version of the crash-discriminating program concludes that a crash has occurred when the level of an input signal from the crash sensor 3 exceeds a predetermined value (for example, when a predetermined acceleration is exceeded), and concludes that no crash has occurred when it does not exceed the predetermined value. The CPU is programmed to provide the 8-bit binary word 11000000 when it is determined that a crash has occurred as illustrated in FIG. 7. This binary word is stored in a predetermined register X in the CPU 10A. Next, the second version of the crash-discriminating program is run. Similarly to the first version, it concludes that a crash has occurred when the level of an input signal from the crash sensor (e.g., an acceleration measurement) exceeds a predetermined value, and that no crash has occurred when it does not exceed the predetermined value. When it is determined that a crash has in fact occurred (FIG. 7), the CPU is programmed to provide the 8-bit binary word 00110000, which is then stored in the predetermined register X in the CPU 10A, replacing the 8-bit binary word output by version 1. 
     Because the crash-discriminating programs of these two versions are alternated and executed repeatedly, when it is determined by the crash-discriminating program that a crash has occurred (as shown in FIG. 7), the values of the first and second bits stored in the register X form alternating signals of a predetermined frequency f 1 , as shown in FIG. 7, line e, while the values of the third and fourth bits stored in the register X form alternating signals of frequency f 1 , as shown in line f. The values of the fifth to eighth bits become zero, as shown in lines g and h. 
     When it is determined by the crash-discriminating program of the second version that no crash has occurred on the other hand, the CPU is programmed to generate the 8-bit binary word 00001100, which is stored in the register X in response to the calculation results of the first version of the crash discrimination program, and to generate the 8-bit binary word 00000011 in response to the calculation results of the second version, which is then entered in register X replacing the binary word 00001100 from the first version. (See FIG. 8.) Thus, the values of the first to fourth bits become zero as shown in lines e and f in FIG. 8, and the values of the fifth to eighth bits form alternating signals of the predetermined frequency f 1 , as shown in lines g and h. 
     It is apparent that the first and second versions of the crash-discriminating program have the same function. However, these two programs are constituted so as to use different instructions, registers and memories to the greatest extent possible, though they perform the same crash-discrimination. Therefore, if a fault develops, for example, in the CPU 10A and an incorrect value is output, the results of the two programs become inconsistent, and the alternating signals of the register X cease to be produced. 
     In this regard it should be noted that a separate crash detection circuit for judging whether a crash has occurred may also be added directly to the crash sensor 3 itself, so that a crash signal is output only when a crash has occurred. In this case, an operation signal may be output directly to the air bag igniter 5, bypassing the crash discrimination mode subsequent to interruption of the self-discrimination mode. 
     The crash decision mode continues its operation as long as the signal from the crash sensor is input. During that time, when the signal level from the crash sensor does not reach a predetermined threshold value (indicating that no crash has occurred), the 5th to 8th bit values of the X register become an alternating signal. When the signal from the crash sensor is discontinued, the crash decision mode returns to the self diagnosis mode. 
     The frequency logic fail-safe circuit 10C (FIG. 1) is constituted by a logic circuit disclosed, for example, in U.S. Pat. No. 4,564,774, and executes the frequency logic operation shown in FIG. 9 to maintain fail-safety. Thus, when the air bag system is in the self-diagnosing mode and no abnormal condition is detected, the output signals from the register X in the CPU 10A form alternating signals of a frequency f 0 . In this case, the frequency logic fail-safe circuit 10C outputs alternating signals of a frequency f 2  as signals to the abnormality alarm device 4, and outputs a value 0 as a signal to the air bag igniting device 5. 
     When the air bag system is in the crash-discriminating mode, and a crash has in fact occurred, the serial output signals of first to fourth bits of the register X in the CPU 10A form alternating signals of the frequency f 1  and other output signals (5th to 8th bits) are all 0. The frequency logic fail-safe circuit 10C then outputs alternating signals of the frequency f 2  to the abnormality alarm device 4 and outputs alternating signals of the frequency f 2  to the air bag igniting device 5 as shown in FIG. 9. 
     Moreover, when the air bag system is in the crash-discriminating mode and no crash has occurred, the output signals of the 1st to 4th bits of the register X are 0, and output signals of 5th to 8th bits form alternating signals of the frequency f 1 . The frequency logic fail-safe circuit 10C outputs alternating signals of the frequency f 2  to the abnormality alarm device 4, and outputs a signal which is 0 to the air bag igniting device 5 as shown in FIG. 9. 
     When input signals other than those mentioned above are input to the frequency logic fail-safe circuit 10C, then the frequency logic fail-safe circuit 10C fixes to 0 the output values fed to the abnormality alarm device 4 and to the air bag igniting device 5, as shown in the last line of FIG. 9. The output values are thereafter maintained at 0 and remain unchanged irrespective of any input signals received. 
     The outputs from the frequency logic fail-safe circuit 10C are connected to the fail-safe AC-driven amplifiers 40 and 50 which in turn are connected to the abnormality alarm device 4 and to the air bag igniting device 5, respectively. An example of such an AC-driven amplifier is shown in FIG. 10. When the input signal of the AC-driven amplified is H (high), Transistor Tr 1  turns on and Transistor Tr 2  turns to off. At this time, the electric charge in the capacitor C 1  flows as a current i 1 , and charges the capacitor C 2 . When input signal is L (Low), Tr 1  turns off and Tr 2  turns on. At this time, the electric charge in the C 2  flows as a current i 2 , and C 1  is charged by the 5 volt supply via Tr 2 . Accordingly, only when an alternating signal (repeating, signal of 0 and 1) is supplied as an input, a current continuously flows to the relay Ry. Such an amplifier is called a positive logic type AC-driven amplifier when an A conjunction relay is used for Ry (that is, the switch S, is closed when a current flows to Ry and open when no current flows), and a negative type AC-driven amplifier when a B conjunction relay (S 1  is closed when no current flows to Ry) is used for Ry. 
     For the AC-driven amplifier 40 connected to the alarm device, the negative type AC-driven amplifier is used. Thus, the circuit becomes a fail safe circuit which outputs a signal of the level &#34;0&#34; in response to an input alternating signal of the frequency f 2 , and outputs a signal of the level &#34;1&#34; when a fault occurs in the amplifier or when the alternating signal (frequency F 2 ) of the input signals ceases. Consequently, when a fault occurs in the air bag system, occurrence of the fault is transmitted to the alarm device by the fail-safe processing. Furthermore, a positive type AC-driven amplifier 50 is connected to the air bag igniting device. Accordingly, the circuit becomes a fail safe circuit which outputs a signal of the level &#34;1&#34; in response to an input alternating signal of the frequency f 2 , and outputs a signal of the level &#34;0&#34; when a fault occurs in the amplifier or when the alternating signal (frequency f 2 ) of the input signals ceases. 
     According to the invention, therefore, processing is executed in a manner that maintains fail-safety. That is, if a fault has occurred in the air bag system, the air bag is not inflated, and if a crash has occurred the air bag is inflated without fail. 
     In the foregoing embodiment of the invention, the alternating signals are generated by a CPU module. The present invention, however, also encompasses a system in which the same signals are output from a plurality of programs having different versions, the results are compared by a fail-safe comparator, and alternating signals are output only when the results are in agreement. The present invention also encompasses a system in which the same processing steps are executed by a plurality of CPU modules, the results from the plurality of CPU modules are compared by a fail-safe comparator, and alternating signals are output only when the results are in agreement. 
     According to the present invention, the self-diagnosis and the result of crash-discrimination are based on programs of two versions, in order to guarantee fail-safety of the output signal of the air bag system. Therefore, any fault that has occurred in the air bag system can be reliably detected despite the fact that the system uses only one CPU. When a fault is detected, the output is fixed so that the air bag will not be inflated and, at the same time, the abnormality alarm device warns the driver of the occurrence of a fault in the air bag system. This assures that the air bag is not erroneously inflated by any fault occurring in the air bag. Moreover, unless the driver is informed of a fault in the air bag by the abnormality alarm device, the air bag is guaranteed to be reliably inflated in case a crash has occurred. 
     Although the invention has been described and illustrated in detail, it is to be clearly understood that the same is by way of illustration and example, and is not to be taken by way of limitation. The spirit and scope of the present invention are to be limited only by the terms of the appended claims.