Control system having effective error detection capabilities

• US 5,966,305 A
• Filed: 12/18/1998
• Issued: 10/12/1999
• Est. Priority Date: 07/15/1996
• Status: Expired due to Term

• Current Assignee: DENSO Corporation
• Original Assignee: DENSO Corporation
• Inventors: Watari, Daisuke, Hirata, Sanae
• Primary Examiner(s): Grant, William
• Assistant Examiner(s): Garland, Steven R.
• Application Number:
  US09/215,302
• Time in Patent Office: 298 Days
• Field of Search: 364/131, 364/184, 364/187, 364/132, 364/137, 714/23, 714/24, 714/55, 701/39, 701/43, 701/62, 701/76, 701/92, 701/97, 701/102, 701/107, 701/114, 123/396
• US Class Current: 700/82
• CPC Class Codes: G05B 19/0421 Multiprocessor system
• CPC Class Codes: G05B 2219/2239 Reallocate, reschedule execution of controlled functions if one processor fails
• CPC Class Codes: G05B 2219/24203 Restart, recover from error only if detected states equal stored states
• CPC Class Codes: G06F 11/2236 to test CPU or processors

Abstract

A control system has a plurality of processors connected in a series order. Each of the processors monitors a preceding processor for operating abnormalities. If an abnormality is detected the operation of abnormal preceding processor is terminated and a resetting unit resets the abnormal processor along with any preceding processor to the abnormal processor in the series order. The system also includes failsafe mechanisms to insure failsafe operation of the vehicle when the operation of an abnormal processor is terminated.

Claims

1. A control system for a vehicle, said control system comprising:

a first processor for executing a first control operation to control a throttle valve provided in an intake air path of an internal combustion engine of a vehicle;

a fail-safe unit for ensuring the supply of air to said internal combustion engine when said first processor terminates said first control operation on said throttle valve;

a second processor for executing a second control operation to perform fuel injection and ignition control operations of said internal combustion engine and for monitoring said first processor to determine if said first processor is operating properly;

a third processor for monitoring said second processor to determine if said second processor is operating properly, and for inhibiting said second processor from executing said fuel injection and ignition control operations when it determines that there is an abnormality in said second processor;

a resetting unit for resetting said first processor when said second processor determines that there is an abnormality in said first processor and for resetting both said first processor and said second processor when said third processor determines that there is an abnormality in said second processor; and

a diagnostic unit for executing a target operation, which is at least one of a) said first control operation and b) said second control operation of said first processor and said second processor, respectively, based on predetermined test data, said diagnostic unit generating a signal indicative of abnormality in its own operation when a result of said target operation differs from prescribed reference data.

2. A control system for a vehicle according to claim 1, wherein said diagnostic unit is for executing said first control operation as said target operation.

3. A control system according to claim 2, said control system further comprising a control termination unit for inhibiting said first control operation of said first processor on said throttle valve when there is an abnormality in said diagnostic unit.

4. A vehicle control system, comprising:

a plurality of processors each being programmed for independently executing vehicle control functions, the processors being interconnected in a series order so that each subsequent processor monitors each preceding processor for operating abnormalities based on determination data output from the preceding processor, and so that the subsequent processor terminates operation of the preceding processor when an abnormality is detected thereat, a last processor in the series order being operative to monitor a preceding unit without itself being monitored;

a resetting unit in communication with the plurality of processors that resets a processor detected to have an operating abnormality, along with each preceding processor or processors in the series order; and

a plurality of failsafe mechanisms associated with the plurality of processors to ensure continuous vehicle operation when the operation of one or more of the plurality of processors is terminated.

5. The system of claim 4 further comprising at least one output mechanism connected to an output of each of the plurality of processors to control a specific vehicle function in accordance with vehicle function commands output by the respective processor.

6. The system of claim 4 wherein each of the plurality of processors independently executes the vehicle control functions based on received vehicle control data and vehicle condition data.

7. The system of claim 4 wherein the operation of a processor is terminated after the respective subsequent processor determines that the processor has operated abnormally for a predetermined number of monitoring periods.

8. The system of claim 4 wherein the last processor in the series order monitors the respective preceding unit based on a watchdog signal output from the respective preceding unit.

9. The system of claim 8 wherein the last processor in the series order comprises one of the plurality of failsafe mechanisms by outputting a vehicle control signal for the respective preceding unit after terminating operation of the respective preceding unit.

10. The system of claim 9 wherein the last processor in the series order comprises the resetting unit for the respective preceding unit.

11. The system of claim 4 wherein one of the plurality of processors performs control of an engine throttle valve, and wherein one of the failsafe mechanisms comprises an intake air bypass that ensures continued engine operation after the engine throttle valve control is terminated.