Vehicle electronic control apparatus incorporating a plurality of microcomputers and implementing a microcomputer monitoring function

• US 20030171858A1
• Filed: 03/06/2003
• Published: 09/11/2003
• Est. Priority Date: 03/07/2002
• Status: Active Grant

• Current Assignee: DENSO Corporation
• Original Assignee: DENSO Corporation
• Inventors: Kondo, Hiroshi
• Granted Patent: US 6,996,463 B2
• Time in Patent Office: Days
• US Class Current: 701/29
• CPC Class Codes: F02D 41/22 Safety or indicating devices for abnormal conditions in air/fuel ratio feedback systems F02D41/1495, in electric control linkage F02D11/107, in purge control systems F02M25/0809
• CPC Class Codes: F02D 41/266 the computer being backed-up or assisted by another circuit, e.g. analogue

Abstract

A vehicle ECU (Electronic Control Unit) has a main microcomputer and an auxiliary microcomputer, with the main microcomputer periodically executing a processing routine for calculating values such as degrees of throttle opening of the vehicle engine based upon the current operating condition of the engine, wherein the main microcomputer generates resource inspection data during each execution of the routine and transmits the resource inspection data to the auxiliary microcomputer, with the resource inspection data including for example respective checksums for values calculated in successive steps of the routine and information indicating whether all steps of the routine have been actually executed, and with the auxiliary microcomputer monitoring the operation of the main microcomputer based upon the received resource inspection data.

Claims

1. An electronic control apparatus of a motor vehicle, including a first microcomputer and a second microcomputer, the apparatus configured for monitoring of at least one of said microcomputers by the other one thereof, wherein

said first microcomputer is adapted to calculate resource inspection data relating to each of respective resources of said first microcomputer, based on internal processing executed by said first microcomputer, and to transmit said resource inspection data to said second microcomputer, and

said second microcomputer is adapted to receive said resource inspection data and monitor the functioning of said first microcomputer, based on said resource inspection data.

2. An electronic control apparatus of a motor vehicle, including a first microcomputer and a second microcomputer, said first microcomputer periodically calculating a value of a target control quantity for use in controlling an actuator of an engine of said vehicle, based on parameter values expressing a current operating condition of the engine, wherein

said second microcomputer is adapted to monitor operations of said first microcomputer including processing to calculate said target control quantity,

each time that said first microcomputer calculates a target control quantity value, said first microcomputer calculates resource inspection data relating to each of respective resources of said first microcomputer which are involved in said calculation, and transmits said resource inspection data to said second microcomputer, and

said second microcomputer is adapted to receive said resource inspection data and monitor the functioning of said first microcomputer, based on said resource inspection data.

3. An electronic control apparatus as claimed in claim 2, said first microcomputer including a RAM (Random Access Memory), with values which are successively derived by said first microcomputer during a processing sequence to calculate said target control quantity being temporarily stored in said RAM, wherein

said first microcomputer is adapted to read out each of said calculated values from said RAM and transmits said each calculated value to said second microcomputer together with the inverse value of said each calculated value, as resource inspection data.

4. An electronic control apparatus as claimed in claim 2, said first microcomputer including memory means having calculation processing codes stored therein, with a plurality of said calculation processing codes being read out and utilized by said first microcomputer during a processing sequence to calculate said target control quantity, wherein

said first microcomputer is adapted to calculate a checksum value of said calculation processing codes used in said processing sequence and transmits said checksum value to said second microcomputer, as resource inspection data.

5. An electronic control apparatus as claimed in claim 4, said electronic control apparatus being supplied with power from a power source having a shutdown delay function whereby a shutdown delay interval occurs following actuation of a switch for interruption of said supply of power, with power continuing to be supplied to said electronic control apparatus until completion of said shutdown delay interval, wherein

said first microcomputer is adapted to transmit said calculation processing codes used in said processing sequence to said second microcomputer, during each occurrence of said shutdown delay, and said second microcomputer is adapted to calculate a checksum value for said calculation processing codes received from said first microcomputer, and judge said checksum value to detect abnormal operation of said first microcomputer.

6. An electronic control apparatus as claimed in claim 2, wherein said first microcomputer is adapted to

initialize a value for use as a processing sequence inspection value, prior to execution of a processing sequence to calculate a target control quantity value,

successively update said processing sequence inspection value at each of one or more predetermined timings during said processing sequence, and

transmit said processing sequence inspection value to said second microcomputer, as resource inspection data, upon completion of said processing sequence.

7. An electronic control apparatus as claimed in claim 2, wherein said first microcomputer calculates said target control quantity by combining a plurality of determining factors, and wherein

said first microcomputer is adapted to calculate resource inspection data sets respectively corresponding to said determining factors, and transmit said resource inspection data sets to said second microcomputer, and

said second microcomputer is adapted to judge said resource inspection data sets respectively separately.

8. An electronic control apparatus as claimed in claim 7, wherein said first microcomputer is adapted to

initialize a value for use as a processing sequence inspection value, prior to execution of a processing sequence to calculate a target control quantity value,

successively update said processing sequence inspection value on completion of each of respective calculation processing stages for deriving said determining factors, and

transmit said processing sequence inspection value to said second microcomputer, as resource inspection data, upon completion of said processing sequence.

9. An electronic control apparatus as claimed in claim 2, including data communication means whereby said first microcomputer transmits data to said second microcomputer in data packets, wherein said first microcomputer is adapted to transmit each calculated value of said target control quantity together with resource inspection data relating to calculation of said value, within one of said data packets.

10. An electronic control apparatus as claimed in claim 2, wherein

said second microcomputer is adapted to calculate second resource inspection data relating to said monitoring processing, during execution of monitoring processing by said second microcomputer to monitor the operation of said first microcomputer based on said resource inspection data, and to transmit said second resource inspection data to said first microcomputer, and

said first microcomputer is adapted to execute processing for monitoring the operation of said second microcomputer, based upon said second resource inspection data received from said second microcomputer.

11. An electronic control apparatus as claimed in claim 2, wherein said first microcomputer calculates said target control quantity by combining a plurality of determining factors, and wherein

said first microcomputer is adapted to calculate resource inspection data sets respectively corresponding to said plurality of determining factors, during execution of a processing sequence to calculate said target control quantity, and to transmit said resource inspection data sets to said second microcomputer, and

said second microcomputer is adapted to judge said resource inspection data sets respectively separately, to determine for each of said determining factors whether or not said determining factor is valid for use in calculating a value of said target control quantity.

12. An electronic control apparatus as claimed in claim 11, wherein

said determining factors are respectively categorized as being basic control quantity terms or secondary control quantity terms,

said second microcomputer is adapted to produce a command signal for terminating control operation of said actuator by said electronic control apparatus, when it is judged that abnormality has occurred in calculating a determining factor that is a basic control quantity term, based on a resource inspection data set corresponding to said determining factor, and

said second microcomputer is adapted to execute processing whereby a value of said target control quantity is calculated with said secondary control quantity term being omitted from the calculation, when it is judged that abnormality has occurred in calculating a determining factor which is a secondary control quantity term, based on a resource inspection data set corresponding to said determining factor.