Multiple microcomputer system with comonitoring/back-up for an automotive vehicle

• US 4,532,594 A
• Filed: 07/09/1982
• Issued: 07/30/1985
• Est. Priority Date: 07/13/1981
• Status: Expired due to Fees

• Current Assignee: Nissan Motor Co., Ltd.
• Original Assignee: Nissan Motor Co., Ltd.
• Inventors: Hosaka, Akio, Oshiage, Katsunori, Yamamoto, Akito
• Primary Examiner(s): Gruber, Felix D.
• Application Number:
  US06/396,658
• Time in Patent Office: 1,117 Days
• Field of Search: 364/431.11, 364/187, 371/8, 371/9, 371/10, 371/61, 371/62, 73/119 A
• US Class Current: 701/114
• CPC Class Codes: F02D 41/266 the computer being backed-up or assisted by another circuit, e.g. analogue
• CPC Class Codes: F02D 43/00 Conjoint electrical control of two or more functions, e.g. ignition, fuel-air mixture, recirculation, supercharging or exhaust-gas treatment
• CPC Class Codes: F02P 15/008 Reserve ignition systems; Redundancy of some ignition devices
• CPC Class Codes: F02P 5/1518 using two or more central computing units, e.g. interpolation
• CPC Class Codes: G06F 11/0757 by exceeding a time limit, i.e. time-out, e.g. watchdogs
• CPC Class Codes: G06F 11/085 using codes with inherent redundancy, e.g. n-out-of-m codes
• CPC Class Codes: G06F 11/2035 without idle spare hardware
• CPC Class Codes: G06F 11/2048 where the redundant components share neither address space nor persistent storage
• CPC Class Codes: G06F 2201/85 Active fault masking without idle spares active fault masking without idle spare hardware where processing functionality is redundant G06F11/2035
• CPC Class Codes: G07C 5/10 using counting means or digital clocks
• CPC Class Codes: Y02T 10/40 Engine management systems

Abstract

An electronic control system for an automotive vehicle including an engine control system for controlling the engine operation using a microcomputer and a vehicle driving information system for preparing and displaying various driving information using another microcomputer, wherein a back up program is assembled into each microcomputer for backing up at least the critical jobs of the partner microcomputer when the partner fails so as to ensure continuing, safe operation of the vehicle.

Claims

1. An electronic data processing system mounted in an automotive vehicle, comprising:

(a) a first microcomputer for performing engine control functions including primary control over primary engine functions including fuel injection start and duration, ignition timing, and fuel pump energization, and secondary control over secondary engine functions;

(b) a second microcomputer for performing display control functions including primary control over primary indications including speedometer and odometer indications and secondary control over secondary vehicle driving indications;

(c) first means provided within said first microcomputer for outputting to the second microcomputer a first signal for indicating whether said first microcomputer is operating properly;

(d) second means provided in said second microcomputer for outputting to the first microcomputer a second signal indicating whether said second microcomputer is operating properly;

(e) third means, provided in said first microcomputer and responsive to said second signal from said second means, for determining whether said second microcomputer is functioning properly;

(f) fourth means, provided in said second microcomputer and responsive to said first signal from said first means, for determining whether said first microcomputer is functioning properly;

(g) fifth means, provided in said first microcomputer and responsive to a negative determination by said third means, for enabling and causing said first microcomputer to assume at least said primary control over said primary indications from second microcomputer, with said first microcomputer additionally continuing to perform at least its primary control over primary engine functions; and

(h) sixth means, provided in said second microcomputer and responsive to a negative determination by said fourth means, for enabling and causing said second microcomputer to assume at least said primary control over said primary engine functions from said first microcomputer, with said second microcomputer additionally continuing to perform at least its primary control over said primary indications.

2. A system as claimed in claim 1 wherein said first means enables and causes the first microcomputer to assume only said primary control over said primary indications, with said first microcomputer additionally continuing to perform only its primary control over said primary engine functions, and wherein said sixth means enables and causes the second microcomputer to assume only said primary control over primary engine functions, with said second microcomputer additionally continuing to perform only its primary control over said primary indications.

3. The electronic control system as set forth in claim 1, wherein said first and second signals have a frequency within a predetermined error range when said first and second microcomputers are functioning normally, respectively.

4. The electronic control system as set forth in claim 1, wherein said first and second signals have a predetermined frequency and wherein the fourth and third means are operable to determine whether the first and second microcomputers are functioning normally based on said predetermined frequency, respectively.

5. A method of operating an electronic control system for an automotive vehicle having two microcomputers respectively performing different vehicle control and monitoring functions, comprising the steps of:

(a) outputting, directly from each microcomputer to the other microcomputer, a monitor signal indicative of whether the outputting microcomputer is malfunctioning;

(b) monitoring the monitor signal outputted by each of said microcomputers with the other microcomputer, each of said microcomputers being operable to recognize whenever the other microcomputer is malfunctioning;

(c) performing at least some functions of a malfunctioning one of said microcomputers with the other of said microcomputers whenever said one of said microcomputers is malfunctioning; and

(d) executing steps (a) and (b) with both microcomputers concurrently.

6. The method of claim 5, wherein said step (c) comprises performing those functions of the malfunctioning microcomputer which are necessary for continued, safe operation of the vehicle by using the other microcomputer with said other computer continuing to perform its normal functions.

7. The method of claim 5, wherein said step (c) comprises performing those functions of the two microcomputers which are necessary for continued, safe operation of the vehicle by using the other microcomputer.

8. The method of any one of claims 5, 6, or 7, wherein each microcomputer executes a control program at intervals which fall within a predetermined range, and said step of outputting further comprises outputting said monitor signal at the end of the control program each time the program is executed, and the step of monitoring further comprises monitoring a period of said monitor signal and recognizing a malfunction whenever the period of said monitor signal does not fall within said predetermined range.