Method for operating an internal combustion engine, device for the open-loop and closed-loop control of an internal combustion engine, injection system, and internal combustion engine

Abstract

A method for operating an internal combustion engine with a motor having a number of cylinders and an injection system having a common rail with a number of injectors assigned to the cylinders and similar high pressure components, which is designed to hold fuel from the common rail for the injector, wherein the method has the steps: injecting fuel from the common rail into a cylinder by way of an injector, determining a fuel pressure for a high-pressure component, in particular the common rail, the injector and/or the individual reservoir, having at least one high-pressure sensor measuring the fuel pressure. Provision is made for a defect in the high-pressure sensor to be detected in that a check is made as to whether magnitude of the high-pressure control deviation (ep) during a predetermined time interval (t.sub.Limit1.sup.SD, t.sub.Limit2.sup.SD, t.sub.Limit3.sup.SD) exceeds a predetermined limiting value (e.sub.Limit1.sup.SD, e.sub.Limit2.sup.SD, e.sub.Limit3.sup.SD).

Claims

1. A method for operating an internal combustion engine having a number of cylinders and an injection system comprising high pressure components including a common rail with a respective injector associated with each of the cylinders, wherein the method comprises the steps of: injecting fuel from the common rail into each cylinder by way of the respective injector; determining a fuel pressure for a high-pressure component using at least one high-pressure sensor; and detecting a defect of the high-pressure sensor by checking whether a high-pressure control error (e.sub.p) exceeds a predetermined limit value (e.sub.Limit1.sup.SD, e.sub.Limit2.sup.SD, e.sub.Limit3.sup.SD) in magnitude during a predetermined period of time (t.sub.Limit1.sup.SD, t.sub.Limit2.sup.SD, t.sub.Limit3.sup.SD), wherein output values of the high-pressure sensor (p.sub.mess) remain in a region that is defined by a maximum deviation (p.sub.Limit.sup.SD) during a course of the predetermined period of time (t.sub.Limit1.sup.SD), t.sub.Limit3.sup.SD), wherein a defect of the high-pressure sensor is detected by detecting a variation with time of output values (p.sub.mess) of the at least one high-pressure sensor and detecting a variation of the detected output value (pmess) that is constant or only variable to a limited extent within a predetermined limited range of values, and wherein for the predetermined limited range of values for the predetermined period of time (t.sub.LimitISD, t.sub.Limit.sub.2SD, t.sub.Limit3SD), the maximum deviation (Ap.sub.LimitS.sup.D) of a range of pressure values is set and the variation of the detected output value (pmess) in the predetermined limited range of values is detected using a test condition, wherein the detected output value over the predetermined period of time (t.sub.LimitISD, t.sub.Limit.sub.2SD, t.sub.Limit3SD) does not exceed the maximum deviation) (Ap.sub.Limit.sup.SD).

2. The method according to claim 1, wherein the predetermined period of time t.sub.Limit1.sup.SD and t.sub.Limit2.sup.SD is a continuous period of time.

3. The method according to claim 1, wherein the predetermined period of time t.sub.Limit3.sup.SD is a total time.

4. The method according to claim 1, wherein a setpoint high pressure (p.sub.soll) with a predetermined limit value (e.sub.Limit1.sup.SD) of the high-pressure control error is provided and the variation of the detected output value (p.sub.mess) in the predetermined limited range of values is detected using a further test condition, wherein the output value detected over the predetermined period of time (t.sub.Limit1.sup.SD, t.sub.Limit2.sup.SD, t.sub.Limit3.sup.SD) does not lie in a control range for the setpoint high pressure (p.sub.soll) formed by the predetermined limit value (e.sub.Limit1.sup.SD) for a high-pressure control error.

5. The method according to claim 1, wherein a setpoint high pressure (p.sub.soll) has a variable profile that lies both within and outside the pressure value limit range and the variation of the detected output value (p.sub.mess) within the predetermined limited range of values is detected using a still further test condition, wherein the output values detected over a further limiting time period remain within the range of pressure values characterized by a maximum deviation (p.sub.Limit.sup.SD), and the further limiting time period is made up of non-contiguous individual time periods that are accumulated to form the predetermined period of time (t.sub.Limit3.sup.SD) and the high-pressure control error (e.sub.p) is greater in magnitude than the predetermined limit value (e.sub.Limit3.sup.SD) during one or a number of or all individual time periods.

6. The method according to claim 1, including bringing about a safe emergency mode of the internal combustion engine in response to a fault condition (SD.sub.Stehend).

7. The method according to claim 6, including outputting a fault message to an operator of the internal combustion engine as a further response to the fault condition (SD.sub.Stehend).

8. The method according to claim 1, wherein the predetermined period of time (t.sub.Limit1.sup.SD) is 4-6 seconds and the predetermined limit value (p.sub.Limit.sup.SD) is 2-6 bar.

9. The method according to claim 1, including operating the internal combustion engine in a safe emergency mode with a suction choke open and a pressure regulating valve open.

10. A device, comprising: an engine controller and an injection computer module configured to carry out a method according to claim 1 for controlling the internal combustion engine.

11. The method according to claim 1, wherein a single reservoir is associated with each injector and is configured to hold fuel from the common rail for the injector, wherein the fuel pressure is determined for the high-pressure temperatures.

Description

BRIEF DESCRIPTION OF THE DRAWING

(1) Further advantages, features, and details of the invention arise from the following description of the preferred embodiments and using the drawing; in the figures:

(2) FIG. 1 shows a device for controlling an injection system of an internal combustion engine,

(3) FIG. 2A shows a block diagram of the actuation of a pressure regulating valve when there is no excess pressure valve,

(4) FIG. 2B shows an influence diagram for the first signal (signal 1) activating the pressure regulating valve controller,

(5) FIG. 3 shows a state diagram of the actuation of the pressure regulating valve when there is no excess pressure valve,

(6) FIG. 4A shows a block diagram of the actuation of a suction choke when there is no excess pressure valve,

(7) FIG. 4B shows an influence diagram for the second signal (signal 2) triggering the emergency mode,

(8) FIG. 5 shows a time profile diagram of a high-pressure sensor failure,

(9) FIG. 6 shows a pressure regulating valve characteristic field,

(10) FIG. 7 shows a time profile diagram of a preferred embodiment of a method for detecting a high-pressure sensor failure,

(11) FIG. 8 shows a time profile diagram of a preferred embodiment of a method for detecting a high-pressure sensor failure in the case of a setpoint high pressure value varying over the limited time period,

(12) FIG. 9 shows a time profile diagram of a preferred embodiment of a method for detecting a high-pressure sensor failure with a different imposed range of pressure values,

(13) FIG. 10 shows a flow chart of the implementation of all configurations of a preferred embodiment of a method.

DETAILED DESCRIPTION OF THE INVENTION

(14) FIG. 1 shows a device corresponding to the prior art as described in DE 10 2014 213 648 B3. In this case, an internal combustion engine 1 comprises an injection system 3. The injection system 3 is preferably embodied as a common rail injection system. It comprises a low-pressure pump 5 for supplying fuel from a fuel reservoir 7, an adjustable suction choke 9 on the low-pressure side for influencing a fuel volumetric flow flowing to a high-pressure pump 11, the high-pressure pump 11 for supplying the fuel under raised pressure into a high-pressure reservoir 13, the high-pressure reservoir 13 for storing the fuel, and preferably a number of injectors 15 for injecting the fuel into combustion chambers 16 of the internal combustion engine 1. Optionally, it is possible that the injection system 3 is also implemented with individual reservoirs, wherein for example a single reservoir 17 is integrated within the injector 15 as an additional buffer volume. With the exemplary embodiment illustrated here, an in particular electrically actuatable pressure regulating valve 19 is provided, by means of which the high-pressure reservoir 13 is fluidically connected to the fuel reservoir 7. By means of the pressure regulating valve 19, a volumetric fuel flow is defined that is discharged from the high-pressure reservoir 13 into the fuel reservoir 7. Said volumetric fuel flow is denoted by VDRV in FIG. 1 and in the following text and is a high-pressure interference variable of the injection system 3.

(15) The injection system 3 comprises no mechanical excess pressure valve, as the function thereof is carried out by the pressure regulating valve 19. The manner of operation of the internal combustion engine 1 is determined by an electronic control unit 21 that is preferably embodied as an engine control unit of the internal combustion engine 1, namely as a so-called Engine Control Unit (ECU). The electronic control unit 21 contains the usual components of a microcomputer system, for example a microprocessor, I/O modules, buffer and memory modules (EEPROM, RAM): the relevant operational data for the operation of the internal combustion engine 1 are applied in characteristic fields/characteristic curves in the memory modules. Using the same, the electronic control unit 21 calculates output variables from input variables. In FIG. 1, the following input variables are shown by way of example: A measured, still unfiltered high pressure p that prevails in the high-pressure reservoir 13 and that is measured by means of a high-pressure sensor 23, a current engine revolution rate n.sub.1, a signal FP for specifying power by an operator of the internal combustion engine 1, and an input variable E. The input variable E is preferably a combination of further sensor signals, for example a charging air pressure of an exhaust turbocharger. With an injection system 3 with individual reservoirs 17, an individual storage pressure p.sub.E is preferably an additional input variable of the control unit 21.

(16) In FIG. 1 a signal PWMSDR for actuation of the suction choke 9 as a first pressure control element, a signal ve for actuation of the injector 15which in particular specifies a start of injection and/or an end of injection or even a duration of injection, a signal PWMDRV for the actuation of the pressure regulating valve 19 and thereby the high-pressure interference variable VDRV are defined as output variables of the electronic control unit 21 by way of example. The output variable A is representative of further control signals for controlling and/or regulating the internal combustion engine 1, for example for a control signal for the activation of a second exhaust turbocharger in the case of multi-stage turbocharging.

(17) FIG. 2A shows the actuation of the pressure regulating valve according to the prior art. The setpoint volumetric flow V.sub.Soll.sup.DRV of the pressure regulating valve is calculated depending on at least one of the following variables: the measured engine revolution rate n.sub.mess, a signal that determines power, for example, the setpoint injection quantity Q.sub.Soll, the setpoint high pressure p.sub.Soll, the measured fuel rail pressure p.sub.mess and the dynamic fuel rail pressure p.sub.dyn. Said calculation is however only valid if the dynamic rail pressure p.sub.dyn is less than the limit value P.sub.Grz1.sup.DRV. In this case, the calculated pressure regulating valve setpoint volumetric flow V.sub.Soll.sup.Ber is equal to the input variable V.sub.Soll.sup.DRV of the pressure regulating valve characteristic field, because the logic signal 1 adopts the value false and thereby the switch S1 takes up the lower switch position. If the dynamic rail pressure p.sub.dyn reaches the limit value p.sub.Grz1.sup.DRV, then the signal 1 adopts the logic value true and the switch S1 is equal to the upper switch position. The pressure regulating valve setpoint volumetric flow V.sub.Soll.sup.DRV is thus in this case equal to the limited output V.sub.Regler.sup.DRV of the pressure regulating valve controller. This means that if the dynamic rail pressure p.sub.dyn reaches the limit value p.sub.Grz1.sup.DRV, the fuel rail pressure is always then regulated by the pressure regulating valve controller and indeed until the engine off state is detected, because in this case the variable engine off adopts the value 1 and thus the signal 1 adopts the logic value false, whereby the switch S1 is again equal to the lower switch position. The pressure regulating valve controller has the high-pressure control error e.sub.p as its input variable, which is calculated as the difference of the setpoint high pressure p.sub.Soll and the measured high pressure p.sub.mess. Further input variables of the pressure regulating valve controller are inter alia the maximum pressure regulating valve volumetric flow V.sub.Max.sup.DRV, the calculated pressure regulating valve setpoint volumetric flow V.sub.Soll.sup.Ber and the proportional coefficient kp.sub.DRV. The pressure regulating valve controller is preferably implemented as a PI(DT.sub.1) algorithm. In this case, the integrating component (I-component) is initialized with the calculated pressure regulating valve setpoint volumetric flow V.sub.Soll.sup.Ber at the point in time at which the switch S1 is switched from the lower switch position to the upper switch position. The I-component of the pressure regulating valve controller is limited at its upper end to the maximum pressure regulating valve volumetric flow V.sub.Max.sup.DRV. In this case, the maximum pressure regulating valve volumetric flow V.sub.Max.sup.DRV is the output variable of a two-dimensional characteristic curve with the measured fuel high pressure p.sub.mess as an input variable. The output variable of the pressure regulating valve controller is likewise limited to the maximum pressure regulating valve volumetric flow V.sub.Max.sup.DRV, so that the limited pressure regulating valve controller setpoint volumetric flow V.sub.Regler.sup.DRV finally results. This is equal to the resulting pressure regulating valve setpoint volumetric flow V.sub.Soll.sup.DRV if the signal 1 adopts the logic value true, i.e. if the switch S1 is in the upper switch position.

(18) The relationship between the dynamic rail pressure p.sub.dyn, the limit value p.sub.Grz1.sup.DRV and the variable engine off is represented in FIG. 2B regarding the influence thereof on the signal 1.

(19) The pressure regulating valve characteristic field calculates the pressure regulating valve setpoint current I.sub.Soll.sup.DRV from the resulting pressure regulating valve setpoint volumetric flow V.sub.soll.sup.DRV and the measured rail pressure p.sub.mess. The pressure regulating valve flow controller determines the pressure regulating valve-setpoint voltage U.sub.Soll.sup.DRV from the pressure regulating valve setpoint current I.sub.Soll.sup.DRV, the measured pressure regulating valve current I.sub.mess.sup.DRV and further variables, such as the proportional coefficient kp.sub.1.sup.DRV and the ohmic pressure regulating valve resistance R.sub.1.sup.DRV. The switch-on duration PWM.sub.DRV of the pressure regulating valve PWM signal is calculated from the pressure regulating valve setpoint voltage U.sub.Soll.sup.DRV by division by the battery voltage U.sub.Batt and then multiplication with the factor 100 if the switch S2 is in the lower switch position. If the switch S2 adopts the upper switch position, then the switch-on duration PWM.sub.DRV of the pressure regulating valve PWM signal is specified at 0%. The switch positions of the switch S2 are determined by the state variable. If said variable has the value 2, then the lower switch position applies, if said variable has the value 1, then the upper switch position applies. The function of the switch S2 is represented in detail in FIG. 3 in the form of a state transition diagram. The raw values I.sub.Roh.sup.DRV are in turn filtered through a current filter, so that the measured current I.sub.mess.sup.DRV results.

(20) FIG. 3 shows the calculation of the switch-on duration PWM.sub.DRV of the pressure regulating valve PWM signal in the form of a state transition diagram for the case of a normally open pressure regulating valve. The state transition diagram consists of two states, which are indicated by the state variable. After the switch-on of the engine electronics, at first the engine off function is active. In said state, the state variable adopts the value 1 and the switch-on duration PWM.sub.DRV of the pressure regulating valve PWM signal is equal to the value 0%. If the measured rail pressure p.sub.mess exceeds the limit value p.sub.start and if the engine is detected to be running (variable engine off is equal to 0), then a change to the normal function is carried out, and in this case the state variable state adopts the value 2. The switch-on duration PWM.sub.DRV of the pressure regulating valve PWM signal is calculated from the pressure regulating valve setpoint voltage U.sub.Soll.sup.DRV and the battery voltage U.sub.Batt. The transition to the first state with a deenergized pressure regulating valve is then carried out if either an engine off state is detected or if there is a defective high-pressure sensorindicated by the binary variable SD.sub.HDor if the dynamic rail pressure p.sub.dyn exceeds a limit value P.sub.Grz2.sup.DRV. The opening of the pressure regulating valve in the event of a sensor defect of the high-pressure sensor and on exceeding a pressure limit p.sub.Grz2.sup.DRV constitutes a protective function for the engine because of the lack of an overpressure valve, i.e. the original function of the mechanical (passive) overpressure valve is reproduced electronically.

(21) FIG. 4A shows the actuation of the suction choke for an arrangement with no excess pressure valve according to the prior art. In FIG. 3, it is shown that the pressure regulating valve is changed to the open state if the dynamic rail pressure p.sub.dyn exceeds the limit value P.sub.Grz2.sup.DRV or if there is a sensor defect of the high-pressure sensor. If one of said two conditions is met, the signal 2 shown in FIG. 4A adopts the value true when the engine is running (variable engine off is equal to 0) and thereby the switch S changes to the lower switch position. If the lower switch position is active, then the suction choke setpoint current I.sub.Soll.sup.SDR is equal to the specifiable, preferably constant suction choke current I.sub.Notbetrieb.sup.SDR. In this case, the same is set so that the suction choke can be operated in the open state, for example at the value 0 Amperes. Thus, in the case in which the dynamic rail pressure exceeds the limit value P.sub.Grz2.sup.DRV or a sensor defect of the high-pressure sensor is detected, a running engine is operated with the pressure regulating valve open and the suction choke open at the same time, whereby stable engine operation is enabled. If the engine is off (variable engine off is equal to 1), then the switch S again adopts the upper switch position, so that the suction choke setpoint current I.sub.Soll.sup.SDR matches the output value I.sub.KL.sup.SDR of the pump characteristic curve.

(22) In FIG. 3 and FIG. 4B, a sensor defect of the high-pressure sensor is indicated by the variable SD.sub.HD. A sensor defect of this type can have different causes. According to the prior art, it is usual to check the output voltage of the high-pressure sensor for conformance to lower and upper range limits. A sensor defect is detected for example if in the case of a sensor with the measurement range 5 Volts, the output voltage undershoots the value 0.25 Volts and exceeds the value 4.75 Volts.

(23) It is the object of the disclosure of the invention to detect a failure of the high-pressure sensor for the case of a static measurement value, i.e. for the case in which the output voltage of the sensor remains at a constant value. If the high-pressure sensor fails in this way, this should be indicated by a separate fault message. If a sensor defect caused by violation of the range limits has the designation SD.sub.MB and a sensor defect caused by a static measurement value has the designation SD.sub.Stehend, then the following applies:
SD.sub.HD=SD.sub.MB v SD.sub.Stehend

(24) This means that a sensor defect of the high-pressure sensor results from an OR combination of the two sensor defects SD.sub.MD and SD.sub.Stehend. If a failure of the high-pressure sensor is detected, then regardless of the cause the engine should be transitioned into the safe engine mode represented in FIG. 3 and FIG. 4A, i.e. both the suction choke and the pressure regulating valve should be operated in the open state.

(25) FIG. 4B illustrates the relationship between the dynamic rail pressure p.sub.dyn, the limit value p.sub.Grz2.sup.DRV, the sensor defect SD.sub.HD and the variable engine off regarding the influence thereof on the signal 2.

(26) FIG. 5 illustrates how a static measurement value of the high-pressure sensor affects the engine operation, and indeed for the case in which the value of the high pressure lies below the setpoint high pressure. The first time diagram represents profiles of the setpoint high pressure P.sub.Soll, the high pressure p.sub.mess measured by the high-pressure sensor and the actual high pressure p.sub.ist present in the rail. At the point in time t.sub.1, the high-pressure sensor fails, wherein as a result the measurement value p.sub.mess of the high-pressure sensor remains at the value p.sub.SD. As the profile of the setpoint high pressure p.sub.Soll lies above p.sub.SD, a residual positive high-pressure control error results:
e.sub.p>0
with
e.sub.p=p.sub.Sollp.sub.mess

(27) In the event of a positive high-pressure control error, the high-pressure regulator corresponding to FIG. 4 increases the setpoint volumetric flow V.sub.Soll.sup.SDR. In the case of a normally open suction choke, this results in a lower suction choke setpoint current I.sub.Soll.sup.SDR and finally in a shorter switch-on duration of the PWM signal PWM.sub.SDR. This results in the measured suction choke current I.sub.mess.sup.SDR being smaller and the suction choke as a result being operated in the opening direction, i.e. the opening cross-section of the suction choke is increased.

(28) The second diagram in FIG. 5 shows the suction choke current I.sub.mess.sup.SDR, which decreases from the point in time t.sub.1 and reaches the value 0 at the point in time t.sub.2. The opening of the suction choke results in a rise in the actual rail pressure p.sub.ist, which is represented in the first diagram, starting from the point in time t.sub.1. In order to make the further variation of the rail pressure understood, in FIG. 6 the pressure regulating valve characteristic field is illustrated. The input variables of said characteristic field are the measured high pressure p.sub.mess and the setpoint volumetric flow V.sub.Soll.sup.DRV to be controlled, and the output variable is the pressure regulating valve setpoint current I.sub.Soll.sup.DRV. By way of example, the following assumptions will now be made:
P.sub.soll=2000 bar
P.sub.SD=1500 bar
V.sub.Soll.sup.DRV=01/min

(29) According to FIG. 6, in this case the constant pressure regulating valve setpoint current 0.879 A has been calculated. Said value W is shown hashed in the table. As the first, shaded row Z of the pressure regulating valve characteristic field for the pressure regulating valve setpoint current 0 1/min shows, in the case of a rising rail pressure, greater energization of the pressure regulating valve is necessary in order to hold said valve closed. As the rail pressure p.sub.ist corresponding to FIG. 5 following the failure of the high-pressure sensor rises at the point in time t.sub.1, for which reason the pressure regulating valve opens, and indeed opens further, the higher the rail pressure rises. At the point in time t.sub.3, the pressure regulating valve opens so far that the fuel volumetric flow delivered by the high-pressure pump exactly equals the sum of the injected fuel volumetric flow, the discharged pressure regulating valve volumetric flow and the fuel leakage volumetric flow. The result of this is that the rise in the high pressure p.sub.ist is ended and starts to fall again. As a result, the pressure regulating valve is closed again until the high-pressure finally rises again, etc. As a result, there is a high-pressure limit cycle, i.e. a periodic oscillation, wherein the high pressure swings between an upper limit value p.sub.max and a lower limit value p.sub.min.

(30) The energization period of the injectors is calculated as the output variable of the injector characteristic field. The input variables of the injector characteristic field are the measured rail pressure p.sub.mess and the setpoint injection quantity Q.sub.Soll. Following failure of the high-pressure sensor, the input variable p.sub.mess of the injector characteristic field remains constant and is equal to the value p.sub.SD, whereas the actual rail pressure rises and then changes to a continuous oscillation. The result of this is that a false energization period is calculated and as a result the oscillations of the rail pressure are transferred to the revolution rate control circuit, so that the engine revolution rate n.sub.mess is also stimulated to oscillate. If the engine revolution rate n.sub.mess is oscillating, then the setpoint torque M.sub.Soll also oscillates, because the same is calculated as a function of the engine revolution rate. As the setpoint high pressure p.sub.Soll is calculated as the output variable of a three-dimensional characteristic field with the input variables engine revolution rate and setpoint torque, oscillations of the setpoint high pressure can also occur depending on the parameterization of the characteristic field. This is indicated in FIG. 5 by a dotted graph.

(31) If the high-pressure sensor fails and the output value of the sensor remains constant, then as described unstable behavior of the engine can occur, whereby the engine can be damaged. In order to protect the engine, a defect of this type in the high-pressure sensor must be detected and an emergency operation function must be activated, wherein the engine is operated in a stable manner with the suction choke open and the pressure regulating valve open. On detecting the sensor defect, a suitable fault message must be issued to the operator of the engine.

(32) It is thus the object of invention to detect failure of the high-pressure sensor when the measurement value is constant. Three designs of the invention for this are described below.

(33) The first design of the invention is represented in FIG. 7. The diagram shows the rail pressure P.sub.mess represented by a thick line, which initially decreases, then at the point in time t.sub.1 remains at the value p.sub.SD, as the high-pressure sensor fails. The setpoint high pressure p.sub.Soll is constant, which is indicated by a solid thin line. In accordance with the method according to the invention, a check is carried out as to whether the measured rail pressure p.sub.mess is in the brightly marked region during a period of time t.sub.Limit1.sup.SD. Said region is a range of pressure values with a width defined by the value p.sub.Limit.sup.SD. The magnitude of the value p.sub.Limit.sup.SD is typically 5 in this case, the period of time t.sub.Limit1.sup.SD is typically 5 seconds. Furthermore, a check is carried out as to whether the rail pressure deviates from the setpoint high pressure in magnitude by at least the value e.sub.Limit1.sup.SD during the same period of time t.sub.Limit1.sup.SD, i.e. whether the high-pressure control error e.sub.p corresponds in magnitude at least to the value e.sub.Limit1.sup.SD. According to FIG. 7, the rail pressure may not therefore remain within the dark characterized region if a sensor defect is to be detected. If both conditions are met, i.e. the measured rail pressure changes during the specifiable period of time t.sub.Limit1.sup.SD only by no more than 0.5*P.sub.Limit.sup.SD and the rail pressure deviates in magnitude from the setpoint high pressure P.sub.Soll by more than e.sub.Limit1.sup.SD at the same time, then at the point in time t.sub.2 a sensor defect of the rail pressure is detected. Said sensor defect is indicated by a separate alarm, which indicates that it is a defect caused by a static measurement value. Accordingly, the binary variable SD.sub.Stehend in the second diagram changes from the value 0 to the value 1 at the point in time t.sub.2. Likewise, at the point in time t.sub.2 the binary variable SD.sub.HD changes from the value 0 to the value 1, whereby it is indicated that there is a high-pressure sensor defect, without accurately classifying said defect. If a high-pressure sensor defect occurs, the high-pressure regulator emergency mode is activated, i.e. at the point in time t.sub.2, both the switch-on duration PWM.sub.SDR of the PWM signal of the suction choke and the switch-on duration PWM.sub.DRV of the PWM signal of the pressure regulating valve are reduced from the static values PWM.sub.Stat.sup.SDR and PWM.sub.Stat.sup.DRV thereof to the value 0%.

(34) As a result, the suction choke and the pressure regulating valve are opened, because both control elements are normally open, and the engine can thus be operated in the safe emergency mode. This is indicated by diagrams three and four.

(35) The second design of the invention is represented in FIG. 8. The first diagram again shows the rail pressure p.sub.mess represented by a thick line, which initially decreases, then remains static at the value p.sub.SD at the point in time t.sub.1, as the high-pressure sensor fails. The setpoint high pressure p.sub.Soll is not constant in this case, but swings periodically about the measured rail pressure p.sub.mess, i.e. here it is the dotted variation of the setpoint high pressure represented in FIG. 5. The second diagram shows the high-pressure control error e.sub.p:
e.sub.p=p.sub.sollp.sub.mess

(36) With this design of the invention, the total time t.sub.Gesamt.sup.SD, during which the high-pressure control error e.sub.p is greater in magnitude than a specifiable limit value e.sub.Limit1.sup.SD, is detected:
t.sub.Gesamt.sup.SD=t.sub.e.sup.1+t.sub.e.sup.2+t.sub.e.sup.3+ . . .

(37) if said total time is greater than or equal to a specifiable time limit t.sub.Limit3.sup.SD and at the same time the measured rail pressure changes in magnitude by no more than 0.5*p.sub.Limit.sup.SD, i.e. the measured rail pressure remains in the region shown in grey at the same time, then a sensor defect of the high-pressure sensor is detected and the high-pressure regulator emergency mode is activated. This means that the binary variable SD.sub.Stehend, which indicates a static measurement value of the high-pressure sensor, changes from the value 0 to the value 1 at the point in time t.sub.2. This is indicated in the third diagram. The binary variable SD.sub.HD, which primarily indicates a high-pressure sensor defect, changes from the value 0 to the value 1 at the point in time t.sub.2, which is represented in the fourth diagram. Diagrams five and six again indicate that the emergency mode is activated in the case of a high-pressure sensor defect, i.e. that then both the switch-on duration PWM.sub.Soll of the PWM signal of the suction choke and the switch-on duration PWM.sub.DRV of the PWM signal of the pressure regulating valve are reduced from the static values thereof PWM.sub.Stat.sup.SDR and PWM.sub.Stat.sup.DRV to the value 0%.

(38) It is particularly advantageous with said design of the invention that a sensor defect of the high-pressure sensor as a result of a static measurement value is also detected if the setpoint high pressure oscillations are carried out about the measured high pressure. Typical values for e.sub.Limit3.sup.SD and t.sub.Limit3.sup.SD are 10 bar and 3 seconds with this method.

(39) FIG. 9 shows a third design of the invention. In the first diagram, the measured rail pressure p.sub.mess is again represented. At the point in time t.sub.1, the high-pressure sensor fails, resulting in the corresponding measurement value remaining static. The same diagram also illustrates the setpoint high pressure p.sub.Soll, which is assumed to be constant. With this method, a sensor defect of the high-pressure sensor is then detected if the measured rail pressure deviates in magnitude from the setpoint high pressure p.sub.Soll at least by the value of the also specifiable value e.sub.Limit2.sup.SD during the specifiable period of time t.sub.Limit2.sup.SD. In this case, the value e.sub.Limit2.sup.SD is typically very small, set for example to 2 bar, whereas the period of time t.sub.Limit2.sup.SD is typically set to a very large value, for example 60 seconds. At the point in time t.sub.2, after expiry of the period of time t.sub.Limit2.sup.SD, the sensor defect of the high-pressure sensor is detected and the binary variables SD.sub.Stehend and SD.sub.HD change from the value 0 to the value 1. At the same time, the variables PWM.sub.SDR and PWM.sub.DRV change to the value 0%.

(40) With this version of sensor defect detection, it does take longer until a sensor defect is detected, but in return said method is particularly reliable because of the small set value of the variable e.sub.Limit2.sup.SD.

(41) FIG. 10 shows the implementation of all designs of the method according to the invention mentioned in the form of a flow chart. In the step S1, a query is made as to whether either the high-pressure sensor is defective or the engine is still in the starting phase or the injection is not yet enabled. If this is the case, the process continues at step S2. In step S2, the time variables t.sub.1, t.sub.2, t.sub.3, t.sub.4 and t.sub.5 are set to the value 0. As a result, the process continues at step S23.

(42) If the result of the query in step S1 is negative, the process is continued at step S3. Here the query is made as to whether the two time variables t.sub.1 or t.sub.2 are greater than or equal to the time limit t.sub.Limit1.sup.SD or whether the time variable t.sub.5 is greater than or equal to the time limit t.sub.Limit3.sup.SD. In the event of a positive result of the query, the process is continued at step S4. In this case, the variables SD.sub.Stehend and SD.sub.HD are set to the value 1. At the same time, the time variables t.sub.1, t.sub.2, t.sub.3, t.sub.4 and t.sub.5 are set to the value 0. Then the process is continued at step S23 here too. If the result of the query in step S3 is negative, the process is continued at step S5. In step S5, the magnitude of the difference of p.sub.mess and the stored recent measurement value p.sub.alt up to the period of time Ta.sub.p.sup.SD is formed and a check is carried out as to whether said magnitude is less than the limit value P.sub.Limits.sup.SD.

(43) An investigation is also conducted as to whether the current measured rail pressure P.sub.mess has changed by less than P.sub.Limits.sup.SD during the period of time Ta.sub.p.sup.SD. If this is not the case, the process is continued at step S6 and the time variables t.sub.1, t.sub.2 and t.sub.5 are reset to the value 0. If this is the case on the other hand, a check is carried out in step S7 as to whether the high-pressure control error e.sub.p is greater than or equal to the limit value e.sub.Limit1.sup.SD. If this is the case, the time variable t.sub.2 is set to the value 0 in the step S8 and the time variable t.sub.1 is incremented by the value 5. Then the process is continued at step S13. If the high-pressure control error e.sub.p is less than the limit value e.sub.Limit1.sup.SD, then the process is continued at step S9. In this case, the time variable t.sub.1 is set to the value 0. In the step S10 a check is then carried out as to whether the high-pressure control error e.sub.p is less than or equal to the negative limit value e.sub.Limit1.sup.SD. If this is the case, the time variable t.sub.2 is incremented by the value 5 in the step S11. If this is not the case, the time variable t.sub.1 is set to the value 0 in the step S12. In both cases, the process is continued at step S13. In this case, a check is carried out as to whether the high-pressure control error e.sub.p is greater than or equal to the specifiable limit value e.sub.Limit3.sup.SD in magnitude. If this is the case, the time variable t.sub.5 is incremented in step S14 by the value 5 and then the process is continued at step S15. If this is not the case, the process is likewise continued at step S15. In step S15, a check is carried out as to whether the time variable t.sub.3 or the time variable t.sub.4 is greater than or equal to the specifiable time limit t.sub.Limit2.sup.SD. If this is the case, the variables SD.sub.Stehend and SD.sub.HD are set to the value 1 in step S16. At the same time, the time variables t.sub.1, t.sub.2, t.sub.3, t.sub.4 and t.sub.5 are set to the value 0. Then the process is continued at step S23. If the result of the query in the step S15 is negative, the process is continued at step S17. In step S17, a check is carried out as to whether the high-pressure control error e.sub.p is greater than or equal to the specifiable limit value e.sub.Limit2.sup.SD. If this is the case, the time variable t.sub.4 is set to the value 0 in step S18. At the same time, the time variable t.sub.3 is incremented by the value 5. Then the process is continued at step S23. If the result of the query in step S17 is negative, the process is continued at step S19. In this case, the time variable t.sub.3 is set to the value 0. Then the process is continued at step S20. In step S20, a check is carried out as to whether the high-pressure control error e.sub.p is less than or equal to the negative limit value e.sub.Limit2.sup.SD. If this is the case, the time variable t.sub.4 is incremented by the value 5 in step S21. If this is not the case, the time variable t.sub.4 is set to the value 0 in step S22. In both cases, the process is continued at step S23. In step S23, the time variable t.sub.b is incremented by the value 5. Then the process is continued at step S24. In step S24, a check is carried out as to whether the time variable t.sub.6 is greater than or equal to the specifiable period of time Ta.sub.p.sup.SD. If this is the case, the current measured rail pressure p.sub.mess is stored by setting the variable p.sub.alt to p.sub.mess. The variable p.sub.alt is thereby updated after each expiry of the period of time Ta.sub.p.sup.SD and, as already mentioned, is compared with the current measured rail pressure p.sub.mess in the step S5. In the step S5, a check is thus carried out as to how much the measured rail pressure changes within the period of time Ta.sub.p.sup.SD. The implementation of the invention in this way is very advantageous, since ring memories, which require a great deal of memory space, can be omitted. Moreover, as a result a great deal of computing time can be saved.

(44) In step S25, in addition the time variable t.sub.6 is reset to the value 0. Then the program execution is ended. If the result of the query in step S24 is negative, the program execution is also ended.

REFERENCE CHARACTER LIST

(45) 1 internal combustion engine 3 injection system 5 low-pressure pump 7 fuel reservoir 9 suction choke 11 high-pressure pump 13 high-pressure reservoir 15 injectors 16 combustion chambers 17 single reservoir 19 pressure regulating valve 21 control unit 23 high-pressure sensor A output variable E input variable p.sub.E individual storage pressure FP signal n.sub.1 engine revolution rate p high-pressure PWMDR signal V VDRV high-pressure interference variabl ve signal