System for controlling a motor vehicle

• US 5,436,837 A
• Filed: 02/28/1992
• Issued: 07/25/1995
• Est. Priority Date: 05/08/1991
• Status: Expired due to Term

• Current Assignee: Robert Bosch GmbH
• Original Assignee: Robert Bosch GmbH
• Inventors: Zimmerman, Werner, Dittrich, Wolfgang, Gerstung, Ulrich, Hall, Dieter, Wessel, Wolf, Bittinger, Wolfgang, Poledna, Stefan, Schmidt, Karl-Heinz, Grosser, Martin, Berger, Joachim, Kirschner, Michael, Forster, Felix, Seher, Dieter
• Primary Examiner(s): Chin, Gary
• Application Number:
  US07/843,011
• Time in Patent Office: 1,243 Days
• Field of Search: 364/424.03, 364/424.04, 364/431.01, 364/431.11, 364/550, 364/551.01, 73/117.2, 73/117.3, 340/438, 340/439, 371/25.1, 371/26, 371/68.1
• US Class Current: 701/29
• CPC Class Codes: F02D 41/266 the computer being backed-up or assisted by another circuit, e.g. analogue
• CPC Class Codes: F16H 2061/1208 with diagnostic check cycles; Monitoring of failures
• CPC Class Codes: F16H 2061/1268 Electric parts of the controller, e.g. a defect solenoid, wiring or microprocessor
• CPC Class Codes: F16H 59/00 Control inputs to control units of change-speed-, or reversing-gearings for conveying rotary motion
• CPC Class Codes: F16H 61/12 Detecting malfunction or potential malfunction, e.g. fail safe in control of hydrostatic gearing F16H61/4192; Circumventing or fixing failures
• CPC Class Codes: G05B 9/03 with multiple-channel loop, i.e. redundant control systems

Abstract

A system for controlling a motor vehicle includes a first device for determining control data required for controlling the motor vehicle. A second device monitors the first device. The first device determines second data on the basis of first data, pursuant to a test function. The second device determines third data on the basis of the first data, pursuant to the same test function. The first and/or the second device recognizes an error state relevant to safety, dependent upon a comparison between the second data and the third data.

Claims

1. A system for controlling a motor vehicle, comprising:

a first device for processing data to control the motor vehicle, the first device receiving first data and determining second data based thereon in accordance with a predetermined test function;

a second device coupled to the first device for monitoring the first device, the second device receiving the first data and determining third data based thereon in accordance with the predetermined test function;

at least one of the first and second devices comparing the second data to the third data for detecting an error state based thereon;

the first device deliberately outputting erroneous second data at predetermined intervals in order to determine whether the second device is functioning properly.

2. The system as recited in claim 1, wherein the at least one of the first and second devices detects an error state if the second data and the third data do not match.

3. The system as recited in claim 1, wherein the at least one of the first and second devices detects an error state if the second data and third data are not available within a predetermined period of time.

4. The system as recited in claim 1, wherein the first data includes a value of a counter.

5. The system as recited in claim 1, wherein the predetermined test function includes forming an inverted value of the first data.

6. The system as recited in claim 1, wherein the first device sends signals to the second device at predetermined time intervals, and the second device checks the signals.

7. The system as recited in claim 1, wherein the first data includes a position of a program counter.

8. The system as recited in claim 1, further comprising a sensor coupled to the first and second devices, the sensor acquiring safety relevant data, the sensor outputting the first data.

9. The system as recited in claim 1, further comprising a first and second sensor, the first sensor being coupled to the first device and the second sensor being coupled to the second device, the first and second sensors each acquiring safety relevant data and outputting the first data.

10. The system as recited in claim 9, wherein each of the first and second sensors independently acquires the safety relevant data.

11. The system as recited in claim 9, wherein an output signal of the first and second sensors is fed to an input of the first and second devices, respectively, and the first and second devices compare the output signals for detecting an error state if the signals are different.

12. The system as recited in claim 9, wherein the first and second devices determine whether output signals from the first and second sensors, respectively, are within a predetermined range of values.

13. The system as recited in claim 1, wherein the first device sends the second data to the second device.

14. The system as recited in claim 1, further comprising a data/address bus coupled between the first and second devices.

15. The system as recited in claim 1, wherein the second device includes a gate array.

16. The system as recited in claim 1, wherein if the second device detects an error state of the first device, emergency driving measures are initiated.

17. The system as recited in claim 1, wherein the second device includes means for counting the number of error states of the first device, and after a predetermined number of error states, emergency driving measures are initiated.