Electronic control system and method having monitor program

• US 6,230,094 B1
• Filed: 03/04/1999
• Issued: 05/08/2001
• Est. Priority Date: 04/13/1998
• Status: Expired due to Fees

• Current Assignee: DENSO Corporation
• Original Assignee: DENSO Corporation
• Inventors: Kato, Kuraji, Ohashi, Hideyuki, Shibata, Hiroshi
• Primary Examiner(s): Dolinar, Andrew M.
• Application Number:
  US09/262,348
• Time in Patent Office: 796 Days
• Field of Search: 701/107, 701/114, 701/110, 701/31, 123/396, 700/3, 700/4, 700/81
• US Class Current: 701/107
• CPC Class Codes: F02D 11/107 Safety-related aspects
• CPC Class Codes: F02D 2041/227 Limping Home, i.e. taking specific engine control measures at abnormal conditions
• CPC Class Codes: F02D 41/22 Safety or indicating devices for abnormal conditions in air/fuel ratio feedback systems F02D41/1495, in electric control linkage F02D11/107, in purge control systems F02M25/0809
• CPC Class Codes: F02D 41/266 the computer being backed-up or assisted by another circuit, e.g. analogue
• CPC Class Codes: G05B 19/0428 Safety, monitoring G05B19/0423 takes precedence

Abstract

An electronic control system has an engine control computer and a throttle control computer. The engine control computer has a monitor program separate from an engine control program. The monitor program is for checking the operation of the throttle control computer and executed by the engine control computer as a timer interrupt routine. A watch dog timer is connected to the engine control computer to detect malfunction of the monitor program in response to a watch dog pulse produced during the execution of the monitor program. The watch dog timer disables an electronic throttle control by the throttle control computer upon detection of the malfunction of the monitor program. At the same time, the engine control mode is changed from a normal engine control to an engine power reduction control thereby to ensure a limp-home operation of the engine.

Claims

1. An electronic control system comprising:

a first computer programmed to control a first object;

a second computer having a control program and programmed to control a second object by the control program, the second computer having a monitor program for checking a malfunction of the first computer; and

a program watching unit for detecting a malfunction of only the monitor program of the second computer,

wherein the program watching unit is connected to the first computer to apply a malfunction signal to the first computer upon detection of malfunction of the monitor program;

wherein the first computer is programmed to transmit to the second computer the malfunction signal applied from the program watching unit; and

wherein the second computer is programmed to change to a second object control mode in response to the malfunction signal transmitted from the first computer.

2. An electronic control system as in claim 1 further comprising:

a computer watching unit for detecting a malfunction of the second computer separately from the program watching unit and resetting the second computer upon detection of the malfunction of the second computer irrespective of an output of the program watching unit.

3. An electronic control system as in claim 1 wherein:

the monitor program of the second computer is stored separately from the control program; and

the second computer is programmed to execute the monitor program as an interrupt routine.

4. An electronic control system as in claim 1 wherein:

the second computer is programmed to produce watch dog pulses during execution of the monitor program; and

the program watching unit is a watch dog timer connected to the second computer to detect malfunction of only the monitor program in response to the watch dog pulses.

5. An electronic system comprising:

a first computer programmed to control a first object;

a second computer programmed to control a second object, the second computer having a monitor program for checking a malfunction of the first computer; and

a program watching unit for detecting a malfunction of the monitor program of the second computer, the first object is a motor for a throttle valve and

the second object is an engine.

6. An electronic control system as in claim 5 further comprising:

a computer watching unit for detecting a malfunction of the second computer separately from the program watching unit.

7. An electronic control system as in claim 5, wherein:

the monitor program of the second computer is stored separately from an engine control program; and

the second computer is programmed to execute the monitor program as an interrupt routine.

8. An electronic control system as in claim 5, wherein:

the program watching unit is connected to shut off a power supply to the motor upon detection of a malfunction of the monitor program, thereby disabling throttle control by the first computer through the motor.

9. An electronic control system as in claim 5, wherein:

the second computer is programmed to control the engine in a manner to reduce an engine power upon detection of the malfunction of the monitor program by the program watching unit.

10. An engine control system as in claim 5, wherein:

operation of the program watching unit is checked under a condition that the engine is at rest and the second computer is held operative.

11. An electronic control system as in claim 5, wherein:

the second computer is programmed to produce a watch dog pulse during execution of the monitor program; and

the program watching unit is a watch dog timer connected to the second computer to detect the malfunction of the monitor program in response to watch dog pulses.

12. An electronic control system as in claim 11, wherein:

the program watching unit is connected to the first computer to apply a malfunction signal to the first computer upon detection of a malfunction of the monitor program;

the first computer is programmed to transmit to the second computer the malfunction signal applied from the program watching unit; and

the second computer is programmed to change engine control mode to reduce engine power in response to the malfunction signal transmitted from the first computer.

13. A method of controlling an engine operation by a throttle control computer for a throttle valve and an engine control computer for an air-fuel mixture combustion, the method comprising:

monitoring an operation of the throttle control computer by executing a monitor program in the engine control computer, the monitoring producing a monitor output during execution of the monitor program;

checking execution of the monitor program in response to the monitor output to produce a malfunction output when a malfunction occurs in the monitor program; and

disabling throttle control by the throttle control computer in response to the malfunction output.

14. A method as in claim 13, further comprising:

changing the engine control computer form a normal engine control mode to a power reduction control mode in response to the malfunction output.

15. A method as in claim 14, further comprising:

transmitting the malfunction output to the engine control computer through the throttle control computer.

16. A method as in claim 13, further comprising:

producing another monitor output from the engine control computer while the engine control computer is in operation;

checking the operation of the engine control computer in response to the another monitor output; and

resetting the engine control computer when a malfunction is detected by the operation checking step.

17. A method as in claim 13, wherein:

the disabling shuts off a power supply to a throttle control motor which is connected to the throttle valve and controlled by the throttle control computer.

18. A method as in claim 13, further comprising:

executing an engine control program in the engine control computer provided separately from the monitor program; and

executing the monitor program in the engine control computer as an interrupt to the engine control program.

19. A method as in claim 18, wherein:

the monitor program is executed at predetermined time intervals.

20. An electronic control system comprising:

a computer having an object control program and programmed to control a controlled object, the computer having a monitor program for checking a malfunction of another control system; and

a program watching unit for detecting a malfunction of only the monitor program of the computer,

wherein the controlled object is a motor for a throttle valve; and

wherein the another control system is one of fuel supply and ignition of the engine.

21. An electronic control system as in claim 20, further comprising:

a computer watching unit for detecting a malfunction of the computer separately from the program watching unit, wherein the computer is enabled to execute the object control program when only the malfunction of the monitor program is detected by the program watching unit, and the computer is disabled to execute both of the programs when the malfunction of the computer is detected by the computer watching unit.

22. A multi-computer electronic control system comprising:

a first computer having at least one monitoring program executed therein and generating first and second recurrent watch dog signals respectively indicative of normal and abnormal operation of;

(1) a second inter-connected computer of the system, and (2) the monitoring program executed in said first computer; and

first and second watch dog timers connected to respectively receive said first and second watch dog signals, to detect said abnormal operations and to feed back corresponding control signals to said first and second computers.

23. A multi-computer electronic control method comprising:

executing at least one monitoring program in a first computer and generating first and second recurrent watch dog signals respectively indicative of normal and abnormal operation of;

(1) a second inter-connected computer of the system, and (2) the monitoring program executed in said first computer; and

using said first and second watch dog signals to detect said abnormal operations and to feed back corresponding control signals to said first and second computers.