Electronic control unit

• US 20040148036A1
• Filed: 01/20/2004
• Published: 07/29/2004
• Est. Priority Date: 01/23/2003
• Status: Active Grant

• Current Assignee: DENSO Corporation
• Original Assignee: DENSO Corporation
• Inventors: Sunami, Kenji
• Granted Patent: US 7,248,932 B2
• Time in Patent Office: Days
• US Class Current: 700/2
• CPC Class Codes: F02D 41/22 Safety or indicating devices for abnormal conditions in air/fuel ratio feedback systems F02D41/1495, in electric control linkage F02D11/107, in purge control systems F02M25/0809
• CPC Class Codes: F02D 41/266 the computer being backed-up or assisted by another circuit, e.g. analogue
• CPC Class Codes: G05B 19/0428 Safety, monitoring G05B19/0423 takes precedence
• CPC Class Codes: G05B 2219/24033 Failure, fault detection and isolation
• CPC Class Codes: G05B 2219/24034 Model checker, to verify and debug control software
• CPC Class Codes: G05B 2219/24038 Several test signals stored in memory and used as input signals
• CPC Class Codes: G05B 2219/24044 Second controller monitors diagnostics system of first controller
• CPC Class Codes: G05B 9/03 with multiple-channel loop, i.e. redundant control systems

Abstract

A main CPU transmits data used in determination of whether or not a target throttle opening degree calculation logic and an estimated target throttle opening degree calculation logic are normal (a target degree and an estimated target degree of throttle opening, and a dummy estimated target degree of throttle opening and an expected value) to a sub-CPU. The sub-CPU compares the data pieces in each of the pairs so as to calculate monitor data for monitoring whether or not the determination result in the main CPU is correct. In this manner, it is possible to enhance reliability of the routine for determining whether or not the respective logics are normal.

Claims

1. An electronic control unit comprising a first computer and a second computer and outputting a control signal for an object of control based on a predetermined detection signal, the first computer comprising:

a determination routine unit operable to, in order to check an abnormal state of a logic function for operating the control signal based on the predetermined detection signal, operate a dummy control signal by using dummy data stored in advance in accordance with the logic function and to determine whether or not a relationship between the dummy control signal and an expected value of the dummy control signal, which expected value is stored with respect to the dummy data in advance, is normal; and

a transmission unit operable to transmit the dummy control signal and the expected value thereof that are used in a determination routine by the determination routine unit to the second computer;

the second computer comprising;

a receiving unit operable to receive the dummy control signal and the expected value thereof; and

a monitor routine unit operable to compare the dummy control signal and the expected value thereof received by the receiving unit so as to perform a calculation routine for calculating monitor data for monitoring whether or not a result of the determination routine by the determination routine unit is correct;

the electronic control unit further comprising;

a fail-safe routine unit operable to perform a fail-safe routine based on the determination result by the determination routine unit and the monitor data by the monitor routine unit.

2. The electronic control unit according to claim 1, wherein

the logic function includes a first logic function for operating the control signal based on the predetermined detection signal and a second logic function, for operating a simplified control signal based on the predetermined detection signal, and

the determination routine unit further determines whether or not a relationship between the control signal operated in accordance with the first logic function and the simplified control signal operated in accordance with the second logic function is normal.

3. The electronic control unit according to claim 2, wherein

the determination routine unit inputs the dummy data to the second logic function to operate a dummy simplified control signal and determines whether or not a relationship between the dummy

simplified control signal and an expected value thereof is normal.

4. The electronic control unit according to claim 2, wherein

the transmission unit transmits the control signal and the simplified control signal, as well as the dummy control signal and the expected value thereof, to the second computer, and

the monitor routine unit further compares the control signal with the simplified control signal to perform a calculation routine for calculating the monitor data for monitoring whether or not a result of the determination routine in the determination routine unit is correct.

5. The electronic control unit according to claim 1, wherein

a plurality of types of the dummy data are prepared;

when the determination routine unit determines that the relationship between the dummy control signal and the expected value thereof is normal, the determination routine unit repeats the determination routine while changing the plurality of types of dummy data; and

when the determination routine unit determines that the relationship between the dummy control signal and the expected value thereof is abnormal in the previous determination routine, the determination routine unit operates the dummy control signal by using the same dummy data as that used in the previous determination routine and determines whether or not the relationship between the thus calculated dummy control signal and the expected value thereof is normal again.

6. The electronic control unit according to claim 1, wherein

in a case where it is determined, in the determination by the determination routine unit whether the relationship between the dummy control signal and the expected value thereof is normal or abnormal, that the relationship is abnormal a predetermined number of times, or in a case where the monitor data indicating that the determination routine by the determination routine unit is to determine that the relationship between the dummy control signal and the expected value thereof is abnormal is calculated in the monitor routine unit a predetermined number of times, the abnormal state of the determination routine is settled and the fail-safe routine unit performs different fail-safe routines before and after settlement of the abnormal state, respectively.

7. The electronic control unit according to claim 6, wherein

the fail-safe routine allows the output of the control signal to the object of control before the settlement of the abnormal state, and prohibits the control of the object of control by the control signal after settlement of the abnormal state.

8. The electronic control unit according to claim 2, wherein

in a case where the determination routine unit determines that the relationship between the control signal and the simplified control signal is not normal, or in a case where the monitor routine unit calculates the monitor data indicating that it is to be determined in the determination routine by the determination routine unit that the relationship between the control signal and the simplified control signal is abnormal, when the determination routine unit determines that the relationship between the dummy simplified control signal and the expected value thereof is normal and the monitor routine unit calculates the monitor data indicating that it is to be determined in the determination routine by the determination routine unit that the relationship between the dummy simplified signal and the expected value thereof is normal, the fail-safe routine unit performs a fail-safe routine for controlling the object of control using the simplified control signal.