Electronic control unit for vehicle having operation monitoring function and fail-safe function

• US 20030060964A1
• Filed: 09/13/2002
• Published: 03/27/2003
• Est. Priority Date: 09/27/2001
• Status: Active Grant

• Current Assignee: DENSO Corporation
• Original Assignee: DENSO Corporation
• Inventors: Takeuchi, Yoshiharu, Ozeki, Yoshifumi
• Granted Patent: US 6,775,609 B2
• Time in Patent Office: Days
• US Class Current: 701/114
• CPC Class Codes: F02D 2041/227 Limping Home, i.e. taking specific engine control measures at abnormal conditions
• CPC Class Codes: F02D 41/22 Safety or indicating devices for abnormal conditions in air/fuel ratio feedback systems F02D41/1495, in electric control linkage F02D11/107, in purge control systems F02M25/0809
• CPC Class Codes: F02D 41/266 the computer being backed-up or assisted by another circuit, e.g. analogue

Abstract

An engine ECU comprises a control CPU for executing engine control and a watchdog circuit for monitoring the CPU. The watchdog circuit stores, whenever a reset signal is outputted to the CPU, a reset information indicating a fault record. The CPU executes, after it is once reset and re-started, the predetermined fail-safe process based on the reset information stored. When a monitor CPU connected to the control CPU for making communication is used as the watchdog circuit, fault detection times X and Y are specified to satisfy the relationship of X≧Y, when the communication fault detection time is defined as X and the watchdog pulse fault detection time as Y.

Claims

1. An electronic control unit for a vehicle comprising:

a CPU having a predetermined fail-safe function required after occurrence of a fault in addition to a vehicle operation control;

a monitor circuit for receiving as an input from the CPU a watchdog pulse generated in a predetermined cycle and outputting a reset signal to the CPU when periodicity of the watchdog pulse is disrupted; and

a memory for storing reset information indicating a record thereof when the reset signal is outputted from the monitor circuit,

wherein the CPU executes the predetermined fail-safe process based on the reset information stored in the memory after the CPU is once reset and thereafter re-started.

2. The electronic control unit as in claim 1,

wherein the memory is integrated with the monitor circuit.

3. The electronic control unit as in claim 1,

wherein the memory is formed as a reset counter for counting up the number of times of reset as the reset information, and

wherein the CPU executes the fail-safe process when a reset counter value reaches a predetermined threshold value when the CPU is re-started.

4. The electronic control unit as in claim 1,

wherein the CPU clears the reset information of the memory.

5. The electronic control unit as in claim 4,

wherein the CPU clears the reset information of the memory after an ignition switch is turned off.

6. An electronic control unit for a vehicle comprising:

a main-CPU for executing a vehicle control;

a monitor circuit for receiving from the main-CPU as an input a watchdog pulse generated in a predetermined cycle, and outputting a reset signal to the main-CPU when periodicity of the watchdog signal is disrupted; and

a sub-CPU connected to the main-CPU for making communication,

wherein the main-CPU subsequently resets the sub-CPU when the main-CPU is rest, and

wherein the sub-CPU monitors the watchdog pulse outputted to the monitor circuit from the main-CPU and stores a reset record of the main-CPU to a memory until at least a reset signal is outputted from the monitor circuit when the periodicity of the watchdog pulse is disrupted.

7. The electronic control unit as in claim 6,

wherein the sub-CPU checks existence of a predetermined edge of the watchdog pulse, assumes, when there is no predetermined edge of the watchdog pulse, that the main-CPU will be reset, and stores a reset record in the memory, and thereafter deletes the reset record stored when the predetermined edge of the watchdog pulse is detected before the monitor circuit outputs the reset signal.

8. The electronic control unit as in claim 6,

wherein the sub-CPU determines that the main-CPU is defective when the reset record is stored for a predetermined number of times.

9. The electronic control unit as in claim 6,

wherein the main-CPU executes, after the main-CPU is once reset and re-started, the predetermined fail-safe process based on the reset record stored in the sub-CPU.

10. The electronic control unit as in claim 6,

wherein the main-CPU outputs a reset signal to the sub-CPU with a constant delay time after the monitor circuit outputs the reset signal to the main-CPU.

11. The electronic control unit as in claim 6,

wherein the main-CPU has an engine control function and an electronic throttle control function for a vehicle, while the sub-CPU monitors the condition of the electronic throttle control of the main-CPU.

12. An electronic control unit for a vehicle comprising:

a main-CPU for executing a vehicle control;

a monitor circuit for receiving as an input from the main-CPU a watchdog pulse which is generated in the predetermined cycle, and outputting a reset signal to the main-CPU when the periodicity of the watchdog pulse is disrupted; and

a sub-CPU connected to the main-CPU for making communication,

wherein the main-CPU subsequently resets the sub-CPU when the main-CPU is reset, and

wherein the sub-CPU monitors the reset signal outputted to the main-CPU from the monitor circuit and stores a reset record in a memory at the time of outputting the reset signal.

13. The electronic control unit as in claim 12,

wherein the sub-CPU determines that the main-CPU is defective when the reset record is stored for a predetermined number of times.

14. The electronic control unit as in claim 12,

wherein the main-CPU executes, after the main-CPU is once reset and re-started, the predetermined fail-safe process based on the reset record stored in the sub-CPU.

15. The electronic control unit as in claim 12,

wherein the main-CPU outputs a reset signal to the sub-CPU with a constant delay time after the monitor circuit outputs the reset signal to the main-CPU.

16. The electronic control unit as in claim 12,

wherein the main-CPU has an engine control function and an electronic throttle control function for a vehicle, while the sub-CPU monitors the condition of the electronic throttle control of the main-CPU.

17. An electronic control unit for a vehicle comprising:

a control CPU for executing a vehicle control; and

a monitor CPU connected to the control CPU for making communication,

wherein the monitor CPU includes a first fault detection means which monitors communicating condition with the control CPU, stores a defective condition when a fault occurs in the communicating condition and resets the control CPU, and a second fault detection means which monitors a watchdog pulse outputted from the control CPU, detects a fault from periodicity of the watchdog pulse and stores the condition when a fault occurs in the watchdog pulse, and

wherein the fault detection times X, Y are specified to satisfy a relationship of X≧

Y when the fault detection time of the first fault detection means is defined as X and the fault detection time of the second fault detection means as Y.

18. The electronic control unit as in claim 17, further comprising:

a watchdog monitor circuit for receiving, from the control CPU, a watchdog pulse as an input and outputting a reset signal to the control CPU when the watchdog pulse is interrupted for a predetermined monitor time Z,

wherein the fault detection time X of the first fault detection means and the monitor time Z of the WD monitor circuit are specified to satisfy the relationship of X≦

Z.

19. The electronic control unit as in claim 17, further comprising:

a watchdog monitor circuit for receiving, from the control CPU, a watchdog pulse as an input and outputting a reset signal to the control CPU when the watchdog pulse is interrupted for a predetermined monitor time Z,

wherein the fault detection time Y of the second fault detection means and the monitor time Z of the WD monitor circuit are specified to satisfy the relationship of Y≦

Z.

20. An electronic control unit comprising:

a control CPU for executing a vehicle control; and

a monitor CPU connected the control CPU for making communication,

wherein the monitor CPU includes a first fault detection means which monitors communicating condition with the control CPU, stores a defective condition when a fault occurs in the communicating condition and resets the control CPU, and a second fault detection means which monitors a watchdog pulse outputted from the control CPU, detects a fault from periodicity of the watchdog pulse and stores the condition when a fault occurs in the watchdog pulse,

wherein when a fault detection time of the first fault detection means is defined as X and a fault detection time of the second fault detection means as Y, the fault detection times X and Y are specified to satisfy the relationship of X<

Y, and

wherein the monitor CPU determines, when a communication fault is detected by the first fault detection means, whether a reset signal may be outputted to the control CPU and restricts output of the reset signal depending on the result of determination.

21. The electronic control unit as in claim 20,

wherein the monitor CPU assumes, when a communication fault is detected by the first fault detection means, whether a watchdog pulse is normal or defective and does not reset the control CPU when the watchdog pulse is assumed to be defective.

22. The electronic control unit as in claim 20, further comprising:

a watchdog monitor circuit for receiving, from the control CPU, a watchdog pulse as an input and outputting a reset signal to the control CPU when the watchdog pulse is interrupted for a predetermined monitor time Z,

wherein the fault detection time Y of the second fault detection means and the monitor time Z of the WD monitor circuit are specified to satisfy the relationship of Y≦

Z.