Control method for a vehicle with main and sub computers

• US 5,526,267 A
• Filed: 03/15/1995
• Issued: 06/11/1996
• Est. Priority Date: 07/04/1991
• Status: Expired due to Fees

• Current Assignee: Fuji Jukogyo KK (Subaru Corp.)
• Original Assignee: Fuji Jukogyo KK (Subaru Corp.)
• Inventors: Sogawa, Yoshiyuki
• Primary Examiner(s): Chin, Gary
• Assistant Examiner(s): LOUIS JACQUES, JACQUES H
• Application Number:
  US08/405,398
• Time in Patent Office: 454 Days
• Field of Search: 364/431.11, 364/424.03, 364/426.02, 364/424.05, 364/426.04, 364/DIG. 1, 364/578, 364/133, 364/943.92, 364/431.12, 395/575, 395/425, 395/185.08, 395/182.21, 395/800, 395/309, 395/285, 395/286, 123/479, 123/589, 371/14, 371/0.1, 371/15.1, 371/16.1, 371/11.3, 371/16.3, 371/62, 371/12, 371/68.3, 371/9, 371/24, 371/15, 371/68.1-68.3, 371/71, 180/142, 180/79.1, 180/140
• US Class Current: 701/114
• CPC Class Codes: F02D 41/266 the computer being backed-up or assisted by another circuit, e.g. analogue
• CPC Class Codes: F02P 5/1518 using two or more central computing units, e.g. interpolation
• CPC Class Codes: G05B 15/02 electric
• CPC Class Codes: G05B 2219/25157 Checksum CRC
• CPC Class Codes: G05B 23/0291 Switching into safety or degraded mode, e.g. protection and supervision after failure
• CPC Class Codes: G05B 9/03 with multiple-channel loop, i.e. redundant control systems
• CPC Class Codes: Y02T 10/40 Engine management systems

Abstract

In a control system for controlling the occurrence of an abnormality in one of the computers mounted on a motor vehicle, a decision is made based upon whether a sub CPU has been reset. In the case where the sub CPU is reset by an abnormality or a malfunction, a failsafe mode flag is set and control data are transmitted again from the main CPU to the sub CPU. The interruption is finished after the control command signal is transmitted to the sub CPU. At this time, if the failsafe mode flag is set, the failsafe control is executed. If the failsafe mode flag is not set, the normal control is executed. Therefore, even if the control data in the RAM of the computers are destroyed by the occurrence of an abnormality or malfunction, the system can regain normal operation immediately.

Claims

1. A control method for a vehicle having a control system mounted on said vehicle for controlling said vehicle, the system including a first computer, a second computer and a watchdog timer for monitoring abnormality occurrences of said second computer, the control method comprising:

monitoring abnormality occurrences in said second computer by said watchdog timer;

resetting said second computer by a reset signal outputted from said watchdog timer when an abnormality occurrence is detected;

setting a failsafe mode flag of said first computer responsive to said reset signal, said failsafe mode flag directing the first computer to operate a failsafe control program which does not depend upon information from said second computer;

transmitting control data from said first computer to said second computer;

determining whether transmission of all of said control data is finished;

calculating a sub checksum of received control data in said second computer;

transmitting said sub checksum from said second computer to said first computer;

computing a main checksum of said control data in said first computer;

determining whether said sub checksum is equal to said main checksum; and

when said sub checksum is equal to said main checksum, sending a control start command signal from said first computer to said second computer, thereby

regaining immediately control of said vehicle even after said control data has been destroyed by said abnormality occurrence.

2. A control method for a vehicle according to claim 1, wherein operation of said first computer is maintained while said second computer is reset.

3. A control method for a vehicle having a first computer, a second computer and a watchdog timer for monitoring abnormality occurrences of said second computer, the control method comprising:

monitoring abnormality occurrences in said second computer by said watchdog timer;

resetting said second computer by a reset signal generated from said watchdog timer when an abnormality occurrence is detected;

setting a failsafe mode flag in said first computer after receiving a reset signal outputted from said watchdog timer; and

activating a failsafe program stored in said first computer when said failsafe mode flag is set, the failsafe program operating independent of control information from said second computer, thereby regaining immediately control of said vehicle even after control data for said second computer has been destroyed by said abnormality occurrence.

4. A control method for a vehicle according to claim 3, further including, when an abnormality occurrence has been detected:

transmitting said control data from said first computer to said second computer;

determining whether transmission of all of said control data is finished;

calculating a sub checksum of received control data in said second computer;

transmitting said sub checksum from said second computer to said first computer;

computing a main checksum of said control data in said first computer;

determining whether said sub checksum is equal to said main checksum; and

when said sub checksum is equal to said main checksum, sending a control start command signal from said first computer to said second computer.

5. A control method for a vehicle according to claim 3, wherein operation of said first computer is maintained while said second computer is reset.