Method and device for controlling the functional unit of a motor vehicle

• US 20050251308A1
• Filed: 12/20/2002
• Published: 11/10/2005
• Est. Priority Date: 12/21/2001
• Status: Active Grant

• Current Assignee: Robert Bosch GmbH
• Original Assignee: Robert Bosch GmbH
• Inventors: Keller, Stefan, Funcke, Guido
• Granted Patent: US 7,437,218 B2
• Time in Patent Office: Days
• US Class Current: 701/36
• CPC Class Codes: B60W 2050/0005 Processor details or data handling, e.g. memory registers or chip architecture
• CPC Class Codes: B60W 2050/041 Built in Test Equipment [BITE]
• CPC Class Codes: F02D 2041/1418 Several control loops, either as alternatives or simultaneous
• CPC Class Codes: F02D 37/02 one of the functions being ignition
• CPC Class Codes: F02D 41/22 Safety or indicating devices for abnormal conditions in air/fuel ratio feedback systems F02D41/1495, in electric control linkage F02D11/107, in purge control systems F02M25/0809
• CPC Class Codes: F02D 41/2422 Selective use of one or more tables
• CPC Class Codes: G06F 11/0736 in functional embedded systems, i.e. in a data processing system designed as a combination of hardware and software dedicated to performing a certain function testing or monitoring of automated control systems G05B23/02
• CPC Class Codes: G06F 11/0739 in a data processing system embedded in automotive or aircraft systems
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/0796 Safety measures, i.e. ensuring safe condition in the event of error, e.g. for controlling element
• CPC Class Codes: G06F 11/1494 N-modular type
• CPC Class Codes: G06F 11/3013 where the computing system is an embedded system, i.e. a combination of hardware and software dedicated to perform a certain function in mobile devices, printers, automotive or aircraft systems testing or monitoring of control systems or parts thereof G05B23/02
• CPC Class Codes: G06F 11/302 where the computing system component is a software system
• CPC Class Codes: G06F 11/3065 Monitoring arrangements determined by the means or processing involved in reporting the monitored data error or fault reporting or logging G06F11/0766
• CPC Class Codes: Y10S 706/908 Electronic or computer, internal or network, circuit

Abstract

A method and a device for controlling a functional unit of a motor vehicle are provided. In the method, a function sequence is implemented in a functional program. The functional program is verified here by a safety program, which is in turn monitored by a monitoring module. Like the safety program, the functional program has a modular structure. The monitoring of the safety program is accordingly implemented in multiple stages corresponding to the number of modules.

Claims

1-12. -12. (canceled)

13. A method for controlling a functional unit of a motor vehicle, comprising:

implementing a function sequence for the functional unit by a functional program, wherein the functional program has a modular organizational structure including at least two functional modules;

verifying the functional program by a safety program, wherein the safety program has a modular organizational structure including at least two safety modules corresponding to the at least two functional modules; and

monitoring the safety program by a monitoring module, wherein the monitoring of the safety program is implemented in multiple parts corresponding to the number of safety modules.

14. The method as recited in claim 13, wherein the at least two safety modules of the safety program each generate a partial contribution as output, and wherein the partial contributions are fed to the monitoring module for evaluation.

15. The method as recited in claim 14, wherein the partial contributions are initially provided from the at least two safety modules to a decoder, and wherein the partial contributions are fed to the monitoring module from the decoder.

16. The method as recited in claim 14, wherein the partial contribution of a first one of the two safety modules is initially forwarded to a second one of the two safety modules, and wherein the partial contributions of the two safety modules are fed to the monitoring module from the second one of the two safety modules.

17. The method as recited in claim 13, wherein the monitoring includes:

sending test data from the monitoring module to the two safety modules;

generating, from the two safety modules, output data; and

comparing, in the monitoring module, the output data with the test data.

18. The method as recited in claim 14, wherein the monitoring includes:

sending test data from the monitoring module to the two safety modules;

generating, from the two safety modules, the partial contributions as output data; and

comparing, in the monitoring module, the output data with the test data.

19. The method as recited in claim 15, wherein the monitoring includes:

sending test data from the monitoring module to the two safety modules;

generating, from the two safety modules, the partial contributions as output data; and

comparing, in the monitoring module, the output data with the test data.

20. A device for controlling a functional unit of a motor vehicle, comprising:

a processor for executing a functional program and a safety program that verifies the functional program, wherein the functional program implements a function sequence for the functional unit, the functional program having a modular organizational structure including at least two functional modules, and the safety program having a modular organizational structure including at least two safety modules corresponding to the at least two functional modules; and

a monitoring module for monitoring the safety program, wherein the monitoring of the safety program is implemented in multiple parts corresponding to the number of safety modules.

21. The device as recited in claim 20, wherein each of the functional modules and the safety modules are stored in separate memory units.

22. The device as recited in claim 20, further comprising:

a decoder, wherein the two safety modules generate partial contributions as outputs, and wherein the partial contributions are forwarded to the decoder.

23. The device as recited in claim 20, wherein the monitoring module is a microcontroller.

24. The device as recited in claim 22, wherein the monitoring module is a microcontroller.

25. The device as recited in claim 21, wherein the monitoring module is a gate logic.

26. The device as recited in claim 22, wherein the monitoring module is a gate logic.

27. A computer program product having a plurality of program codes for implementing, when the program codes are executed on a computer, a control of a functional unit of a motor vehicle by performing:

implementing a function sequence for the functional unit by a functional program, wherein the functional program has a modular organizational structure including at least two functional modules;

verifying the functional program by a safety program, wherein the safety program has a modular organizational structure including at least two safety modules corresponding to the at least two functional modules; and

monitoring the safety program by a monitoring module, wherein the monitoring of the safety program is implemented in multiple parts corresponding to the number of safety modules.

28. A computer-readable storage medium for storing a computer program having a plurality of program codes for implementing, when the program codes are executed on a computer, a control of a functional unit of a motor vehicle by performing:

implementing a function sequence for the functional unit by a functional program, wherein the functional program has a modular organizational structure including at least two functional modules;

verifying the functional program by a safety program, wherein the safety program has a modular organizational structure including at least two safety modules corresponding to the at least two functional modules; and

monitoring the safety program by a monitoring module, wherein the monitoring of the safety program is implemented in multiple parts corresponding to the number of safety modules.