Method for operating a control unit of a motor vehicle

• US 10,642,259 B2
• Filed: 11/07/2016
• Issued: 05/05/2020
• Est. Priority Date: 11/13/2015
• Status: Active Grant

• Current Assignee: Robert Bosch GmbH
• Original Assignee: Robert Bosch GmbH
• Inventors: Haas, Michael Wilhelm, Huber, Jochen, Haag, Wolfgang
• Primary Examiner(s): Antonucci, Anne Marie
• Application Number:
  US15/775,885
• Publication Number:
  US 20180321669A1
• Time in Patent Office: 1,275 Days
• CPC Class Codes: F02D 41/22 Safety or indicating devices for abnormal conditions in air/fuel ratio feedback systems F02D41/1495, in electric control linkage F02D11/107, in purge control systems F02M25/0809
• CPC Class Codes: F02D 41/2403 using essentially up/down counters
• CPC Class Codes: F02D 41/266 the computer being backed-up or assisted by another circuit, e.g. analogue
• CPC Class Codes: G05B 19/0428 Safety, monitoring G05B19/0423 takes precedence
• CPC Class Codes: G05B 2219/2637 Vehicle, car, auto, wheelchair
• CPC Class Codes: G05B 23/0262 Confirmation of fault detection, e.g. extra checks to confirm that a failure has indeed occurred
• CPC Class Codes: G06F 11/0739 in a data processing system embedded in automotive or aircraft systems
• CPC Class Codes: G06F 11/076 by exceeding a count or rate limit, e.g. word- or bit count limit
• CPC Class Codes: G06F 2201/81 Threshold

Abstract

A method for operating a control unit of a motor vehicle including a function unit and a monitoring unit which have a communication connection to one another. In a first check, the function unit is checked for errors, an error of the function unit being inferred if an error counter reaches a threshold value, and the monitoring unit and the function unit exchange first data with one another. In the event of a correct exchange of the first data, a positive change of the error counter is carried out. Otherwise, a negative change of the error counter is carried out. In a second check, the monitoring unit and the function unit exchange second data with one another. In the event of an incorrect exchange of the second data, a negative change of the error counter and a negative change of the threshold value are carried out.

Claims

1. A method for operating a control unit of a motor vehicle including a function unit and a monitoring unit, which have a communication connection to one another, the method comprising:

in a first check, checking the function unit for errors, an error of the function unit is inferred if an error counter reaches a threshold value, and in the first check, the monitoring unit and the function unit exchanging first data with one another, wherein in the event of a correct exchange of the first data, a positive change of the error counter is carried out, and in the event of an incorrect exchange of the first data, a negative change of the error counter is carried out; and

in a second plausibility check, the monitoring unit and the function unit exchanging second data with one another, wherein during the exchanging in the second plausibility check, the function unit intentionally exchanging the second data incorrectly with the monitoring unit, wherein in the second plausibility check;

(i) when the monitoring unit detects the incorrect exchange of the second data, the negative change of the error counter and a negative change of the threshold value are carried out, and (ii) when the event the monitoring unit does not detect the incorrect exchange of the second data, an error in the monitoring unit is inferred.

2. The method as recited in claim 1, wherein, in the event of the correct exchange of at least one of the first data and the second data, the positive change of the error counter and a positive change of the threshold value are carried out.

3. The method as recited in claim 2, wherein the positive change of the threshold value is carried out only if the threshold value has not yet reached a threshold starting value.

4. The method as recited in claim 1, wherein the monitoring unit and the function unit exchange the first data with one another in that the monitoring unit transmits questions to the function unit and the function unit thereupon transmits answers to the monitoring unit.

5. The method as recited in claim 4, wherein at least one of:

(i) the exchange of the first data is incorrect if the function unit at least one of;

transmits incorrect answers, and transmits answers at incorrect points in time, and (b) the exchange of the first data is correct if the function unit transmits correct answers at correct points in time.

6. The method as recited in claim 1, wherein the monitoring unit and the function unit exchange the second data with one another in that the monitoring unit transmits questions to the function unit and the function unit thereupon transmits answers to the monitoring unit.

7. The method as recited in claim 6, wherein the exchange of the second data is incorrect if the function unit transmits one of incorrect answers, and answers at incorrect points in time.

8. The method as recited in claim 1, wherein at least one of the error counter and the threshold value are decremented by one or multiple decrements, in the course of the positive change.

9. The method as recited in claim 1, wherein at least one of the error counter and the threshold value are incremented by one or multiple increments in the course of the negative change.

10. The method as recited in claim 1, wherein the function unit determines when first data are exchanged and when second data are exchanged.

11. The method as recited in claim 1, wherein the monitoring unit specifies a fixed time window, using which points in time of the received data are checked for plausibility.

12. The method as recited in claim 1, wherein the function unit provides information to the monitoring unit of whether the negative change of the threshold value has to be carried out.

13. The method as recited in claim 1, wherein the function unit specifies a specific threshold value to the monitoring unit.

14. The method as recited in claim 1, wherein in the second plausibility check:

(i) the function unit also reports to the monitoring unit that the incorrect exchange of the second data by the function unit was intentional, and (ii) the negative change of the threshold value is carried out by the monitoring unit.

15. A processing unit, which is configured to operate a control unit of a motor vehicle including a function unit and a monitoring unit, which have a communication connection to one another, the processing unit configured to:

in a first check, check the function unit for errors, an error of the function unit is inferred if an error counter reaches a threshold value, and in the first check, the monitoring unit and the function unit exchange first data with one another, wherein in the event of a correct exchange of the first data, a positive change of the error counter is carried out, and in the event of an incorrect exchange of the first data, a negative change of the error counter is carried out; and

in a second plausibility check, the monitoring unit and the function unit exchange second data with one another, wherein during the exchange in the second plausibility check, the function unit intentionally exchanges the second data incorrectly with the monitoring unit, wherein in the second plausibility check, (i) in the event the monitoring unit detects the incorrect exchange of the second data, the negative change of the error counter and a negative change of the threshold value are carried out, and (ii) in the event the monitoring unit does not detect the incorrect exchange of the second data, a error in the monitoring unit is inferred.

16. The processing unit as recited in claim 15, wherein in the second plausibility check:

(i) the function unit also reports to the monitoring unit that the incorrect exchange of the second data by the function unit was intentional, and (ii) the negative change of the threshold value is carried out by the monitoring unit.

17. A non-transitory machine-readable storage on which is stored a computer program for operating a control unit of a motor vehicle including a function unit and a monitoring unit, which have a communication connection to one another, the computer program, when executed by a processor, causing the processor to perform:

in a first check, checking the function unit for errors, an error of the function unit is inferred if an error counter reaches a threshold value, and in the first check, the monitoring unit and the function unit exchanging first data with one another, wherein in the event of a correct exchange of the first data, a positive change of the error counter is carried out, and in the event of an incorrect exchange of the first data, a negative change of the error counter is carried out; and

in a second plausibility check, the monitoring unit and the function unit exchanging second data with one another, wherein during the exchanging in the second plausibility check, the function unit intentionally exchanging the second data incorrectly with the monitoring unit, wherein in the second plausibility check;

(i) when the monitoring unit detects the incorrect exchange of the second data, the negative change of the error counter and a negative change of the threshold value are carried out, and (ii) when the event the monitoring unit does not detect the incorrect exchange of the second data, an error in the monitoring unit is inferred.

18. The non-transitory machine-readable storage as recited in claim 17, wherein in the second plausibility check:

(i) the function unit also reports to the monitoring unit that the incorrect exchange of the second data by the function unit was intentional, and (ii) the negative change of the threshold value is carried out by the monitoring unit.