Electronic control unit

• US 7,248,932 B2
• Filed: 01/20/2004
• Issued: 07/24/2007
• Est. Priority Date: 01/23/2003
• Status: Active Grant

• Current Assignee: DENSO Corporation
• Original Assignee: DENSO Corporation
• Inventors: Sunami, Kenji
• Primary Examiner(s): Knight; Anthony
• Assistant Examiner(s): Norton; Jennifer L.
• Application Number:
  US10/759,070
• Publication Number:
  US 20040148036A1
• Time in Patent Office: 1,281 Days
• Field of Search: 700/21, 700/24, 700/28, 700/79, 700/82, 701101-115, 702 57- 58, 702116-118, 702182-183, 702/188, 702184-186, 326/16, 123/399, 714/11, 714/21, 714 49- 51, 714/55, 708/188
• US Class Current: 700/79
• CPC Class Codes: F02D 41/22 Safety or indicating devices for abnormal conditions in air/fuel ratio feedback systems F02D41/1495, in electric control linkage F02D11/107, in purge control systems F02M25/0809
• CPC Class Codes: F02D 41/266 the computer being backed-up or assisted by another circuit, e.g. analogue
• CPC Class Codes: G05B 19/0428 Safety, monitoring G05B19/0423 takes precedence
• CPC Class Codes: G05B 2219/24033 Failure, fault detection and isolation
• CPC Class Codes: G05B 2219/24034 Model checker, to verify and debug control software
• CPC Class Codes: G05B 2219/24038 Several test signals stored in memory and used as input signals
• CPC Class Codes: G05B 2219/24044 Second controller monitors diagnostics system of first controller
• CPC Class Codes: G05B 9/03 with multiple-channel loop, i.e. redundant control systems

Abstract

A main CPU transmits data used in determination of whether or not a target throttle opening degree calculation logic and an estimated target throttle opening degree calculation logic are normal (a target degree and an estimated target degree of throttle opening, and a dummy estimated target degree of throttle opening and an expected value) to a sub-CPU. The sub-CPU compares the data pieces in each of the pairs so as to calculate monitor data for monitoring whether or not the determination result in the main CPU is correct. In this manner, it is possible to enhance reliability of the routine for determining whether or not the respective logics are normal.

Claims

1. An electronic control unit comprising a first computer and a second computer and outputting a control signal for an object of control based on a predetermined detection signal, the first computer comprising:

a determination routine unit operable to, in order to check an abnormal state of a logic function for operating the control signal based on the predetermined detection signal, operate a dummy control signal by using dummy data stored in advance in accordance with the logic function and to determine whether or not a relationship between the dummy control signal and an expected value of the dummy control signal, which expected value is stored with respect to the dummy data in advance, is normal; and

a transmission unit operable to transmit the dummy control signal and the expected value thereof that are used in a determination routine by the determination routine unit to the second computer;

the second computer comprising;

a receiving unit operable to receive the dummy control signal and the expected value thereof; and

a monitor routine unit operable to compare the dummy control signal and the expected value thereof received by the receiving unit so as to perform a calculation routine for calculating monitor data for monitoring whether or not a result of the determination routine by the determination routine unit is correct;

wherein the electronic control unit further comprises;

a fail-safe routine unit operable to perform a fail-safe routine based on the determination result by the determination routine unit and the monitor data by the monitor routine unit;

the logic function includes a first logic function for operating the control signal based on the predetermined detection signal and a second logic function, for operating a simplified control signal based on the predetermined detection signal;

the determination routine unit further determines whether or not a relationship between the control signal operated in accordance with the first logic function and the simplified control signal operated in accordance with the second logic function is normal; and

the transmission unit transmits the control signal and the simplified control signal, as well as the dummy control signal and the expected value thereof, to the second computer, and the monitor routine unit further compares the control signal with the simplified control signal to perform a calculation routine for calculating the monitor data for monitoring whether or not a result of the determination routine in the determination routine unit is correct.

6. The electronic control unit according to claim 1, wherein the determination routine unit inputs the dummy data to the second logic function to operate a dummy simplified control signal and determines whether or not a relationship between the dummy simplified control signal and an expected value thereof is normal.

2. An electronic control unit comprising a first computer and a second computer and outputting a control signal for an object of control based on a predetermined detection signal, the first computer comprising:

a determination routine unit operable to, in order to check an abnormal state of a logic function for operating the control signal based on the predetermined detection signal, operate a dummy control signal by using dummy data stored in advance in accordance with the logic function and to determine whether or not a relationship between the dummy control signal and an expected value of the dummy control signal, which expected value is stored with respect to the dummy data in advance, is normal; and

a transmission unit operable to transmit the dummy control signal and the expected value thereof that are used in a determination routine by the determination routine unit to the second computer;

the second computer comprising;

a receiving unit operable to receive the dummy control signal and the expected value thereof; and

a monitor routine unit operable to compare the dummy control signal and the expected value thereof received by the receiving unit so as to perform a calculation routine for calculating monitor data for monitoring whether or not a result of the determination routine by the determination routine unit is correct;

wherein the electronic control unit further comprises;

a fail-safe routine unit operable to perform a fail-safe routine based on the determination result by the determination routine unit and the monitor data by the monitor routine unit;

a plurality of types of the dummy data are prepared;

when the determination routine unit determines that the relationship between the dummy control signal and the expected value thereof is normal, the determination routine unit repeats the determination routine while changing the plurality of types of dummy data; and

when the determination routine unit determines that the relationship between the dummy control signal and the expected value thereof is abnormal in the previous determination routine, the determination routine unit operates the dummy control signal by using the same dummy data as that used in the previous determination routine and determines whether or not the relationship between the thus calculated dummy control signal and the expected value thereof is normal again.

7. The electronic control unit according to claim 2, wherein

the logic function includes a first logic function for operating the control signal based on the predetermined detection signal and a second logic function, for operating a simplified control signal based on the predetermined detection signal, and

the determination routine unit further determines whether or not a relationship between the control signal operated in accordance with the first logic function and the simplified control signal operated in accordance with the second logic function is normal.

8. The electronic control unit according to claim 7, wherein

the determination routine unit inputs the dummy data to the second logic function to operate a dummy simplified control signal and determines whether or not a relationship between the dummy simplified control signal and an expected value thereof is normal.

3. An electronic control unit comprising a first computer and a second computer and outputting a control signal for an object of control based on a predetermined detection signal, the first computer comprising:

a determination routine unit operable to, in order to check an abnormal state of a logic function for operating the control signal based on the predetermined detection signal, operate a dummy control signal by using dummy data stored in advance in accordance with the logic function and to determine whether or not a relationship between the dummy control signal and an expected value of the dummy control signal, which expected value is stored with respect to the dummy data in advance, is normal; and

a transmission unit operable to transmit the dummy control signal and the expected value thereof that are used in a determination routine by the determination routine unit to the second computer;

the second computer comprising;

a receiving unit operable to receive the dummy control signal and the expected value thereof; and

a monitor routine unit operable to compare the dummy control signal and the expected value thereof received by the receiving unit so as to perform a calculation routine for calculating monitor data for monitoring whether or not a result of the determination routine by the determination routine unit is correct;

wherein the electronic control unit further comprises;

a fail-safe routine unit operable to perform a fail-safe routine based on the determination result by the determination routine unit and the monitor data by the monitor routine unit;

in a case where it is determined, in the determination by the determination routine unit whether the relationship between the dummy control signal and the expected value thereof is normal or abnormal, that the relationship is abnormal a predetermined number of times, or in a case where the monitor data indicating that the determination routine by the determination routine unit is to determine that the relationship between the dummy control signal and the expected value thereof is abnormal is calculated in the monitor routine unit a predetermined number of times, the abnormal state of the determination routine is settled and the fail-safe routine unit performs different fail-safe routines before and after settlement of the abnormal state, respectively.

4. The electronic control unit according to claim 3, wherein the fail-safe routine allows the output of the control signal to the object of control before the settlement of the abnormal state, and prohibits the control of the object of control by the control signal after settlement of the abnormal state.

9. The electronic control unit according to claim 3, wherein

the logic function includes a first logic function for operating the control signal based on the predetermined detection signal and a second logic function, for operating a simplified control signal based on the predetermined detection signal, and

the determination routine unit further determines whether or not a relationship between the control signal operated in accordance with the first logic function and the simplified control signal operated in accordance with the second logic function is normal.

10. The electronic control unit according to claim 9, wherein

the determination routine unit inputs the dummy data to the second logic function to operate a dummy simplified control signal and determines whether or not a relationship between the dummy simplified control signal and an expected value thereof is normal.

5. An electronic control unit comprising a first computer and a second computer and outputting a control signal for an object of control based on a predetermined detection signal, the first computer comprising:

a determination routine unit operable to, in order to check an abnormal state of a logic function for operating the control signal based on the predetermined detection signal, operate a dummy control signal by using dummy data stored in advance in accordance with the logic function and to determine whether or not a relationship between the dummy control signal and an expected value of the dummy control signal, which expected value is stored with respect to the dummy data in advance, is normal; and

a transmission unit operable to transmit the dummy control signal and the expected value thereof that are used in a determination routine by the determination routine unit to the second computer;

the second computer comprising;

a receiving unit operable to receive the dummy control signal and the expected value thereof; and

a monitor routine unit operable to compare the dummy control signal and the expected value thereof received by the receiving unit so as to perform a calculation routine for calculating monitor data for monitoring whether or not a result of the determination routine by the determination routine unit is correct;

wherein the electronic control unit further comprises;

a fail-safe routine unit operable to perform a fail-safe routine based on the determination result by the determination routine unit and the monitor data by the monitor routine unit;

the logic function includes a first logic function for operating the control signal based on the predetermined detection signal and a second logic function, for operating a simplified control signal based on the predetermined detection signal;

the determination routine unit further determines whether or not a relationship between the control signal operated in accordance with the first logic function and the simplified control signal operated in accordance with the second logic function is normal; and

in a case where the determination routine unit determines that the relationship between the control signal and the simplified control signal is not normal, or in a case where the monitor routine unit calculates the monitor data indicating that it is to be determined in the determination routine by the determination routine unit that the relationship between the control signal and the simplified control signal is abnormal, when the determination routine unit determines that the relationship between the dummy simplified control signal and the expected value thereof is normal and the monitor routine unit calculates the monitor data indicating that it is to be determined in the determination routine by the determination routine unit that the relationship between the dummy simplified signal and the expected value thereof is normal, the fail-safe routine unit performs a fail-safe routine for controlling the object of control using the simplified control signal.

11. The electronic control unit according to claim 5, wherein

the determination routine unit inputs the dummy data to the second logic function to operate a dummy simplified control signal and determines whether or not a relationship between the dummy simplified control signal and an expected value thereof is normal.

12. A method of controlling an electronic control unit having at least a first computer and a second computer to output a control signal for an object of control based on a predetermined detection signal, the method comprising:

operating the first computer to;

operate the control signal based on the predetermined detection signal in accordance with a logic function;

in order to check an abnormal state of the logic function, operate a dummy control signal by using dummy data stored in advance in accordance with the logic function and determine whether or not a relationship between the dummy control signal and an expected value of the dummy control signal, which expected value is stored with respect to the dummy data in advance, is normal; and

transmit the dummy control signal and the expected value thereof that are used in a determination routine by the first computer to the second computer;

operating the second computer to;

receive the dummy control signal and the expected value thereof; and

compare the received dummy control signal and the expected value so as to perform a calculation routine for calculating monitor data for monitoring whether or not a result of the determination routine by the first computer is correct;

performing a fail-safe routine based on the determination result by the first computer and the monitor data by the second computer;

wherein the logic function includes a first logic function for operating the control signal based on the predetermined detection signal and a second logic function, for operating a simplified control signal based on the predetermined detection signal, and

the first computer further determines whether or not a relationship between the control signal operated in accordance with the first logic function and the simplified control signal operated in accordance with the second logic function is normal,

the control signal and the simplified control signal, as well as the dummy control signal and the expected value thereof, is transmitted to the second computer, and

the second computer further compares the control signal with the simplified control signal to perform a calculation routine for calculating the monitor data for monitoring whether or not a result of the determination routine in the first computer is correct.

13. A method of controlling an electronic control unit having at least a first computer and a second computer to output a control signal for an object of control based on a predetermined detection signal, the method comprising:

operating the first computer to;

operate the control signal based on the predetermined detection signal in accordance with a logic function;

in order to check an abnormal state of the logic function, operate a dummy control signal by using dummy data stored in advance in accordance with the logic function and determine whether or not a relationship between the dummy control signal and an expected value of the dummy control signal, which expected value is stored with respect to the dummy data in advance, is normal; and

transmit the dummy control signal and the expected value thereof that are used in a determination routine by the first computer to the second computer;

operating the second computer to;

receive the dummy control signal and the expected value thereof; and

compare the received dummy control signal and the expected value so as to perform a calculation routine for calculating monitor data for monitoring whether or not a result of the determination routine by the first computer is correct;

performing a fail-safe routine based on the determination result by the first computer and the monitor data by the second computer;

wherein a plurality of types of the dummy data are prepared;

when the first computer determines that the relationship between the dummy control signal and the expected value thereof is normal, the first computer repeats the determination routine while changing the plurality of types of dummy data; and

when the first computer determines that the relationship between the dummy control signal and the expected value thereof is abnormal in the previous determination routine, the first computer operates the dummy control signal by using the same dummy data as that used in the previous determination routine and determines whether or not the relationship between the thus calculated dummy control signal and the expected value thereof is normal again.

14. A method of controlling an electronic control unit having at least a first computer and a second computer to output a control signal for an object of control based on a predetermined detection signal, the method comprising:

operating the first computer to;

operate the control signal based on the predetermined detection signal in accordance with a logic function;

in order to check an abnormal state of the logic function, operate a dummy control signal by using dummy data stored in advance in accordance with the logic function and determine whether or not a relationship between the dummy control signal and an expected value of the dummy control signal, which expected value is stored with respect to the dummy data in advance, is normal; and

transmit the dummy control signal and the expected value thereof that are used in a determination routine by the first computer to the second computer;

operating the second computer to;

receive the dummy control signal and the expected value thereof; and

compare the received dummy control signal and the expected value so as to perform a calculation routine for calculating monitor data for monitoring whether or not a result of the determination routine by the first computer is correct;

performing a fail-safe routine based on the determination result by the first computer and the monitor data by the second computer;

wherein in a case where it is determined, in the determination by the first computer whether the relationship between the dummy control signal and the expected value thereof is normal or abnormal, that the relationship is abnormal a predetermined number of times, or in a case where the monitor data indicating that the determination routine by the first computer is to determine that the relationship between the dummy control signal and the expected value thereof is abnormal is calculated in the second computer a predetermined number of times, the abnormal state of the determination routine is settled and different fail-safe routines are performed before and after settlement of the abnormal state, respectively.

15. The method according to claim 14, wherein

the fail-safe routine allows the output of the control signal to the object of control before the settlement of the abnormal state, and prohibits the control of the object of control by the control signal after settlement of the abnormal state.

16. A method of controlling an electronic control unit having at least a first computer and a second computer to output a control signal for an object of control based on a predetermined detection signal, the method comprising:

operating the first computer to;

operate the control signal based on the predetermined detection signal in accordance with a logic function;

in order to check an abnormal state of the logic function, operate a dummy control signal by using dummy data stored in advance in accordance with the logic function and determine whether or not a relationship between the dummy control signal and an expected value of the dummy control signal, which expected value is stored with respect to the dummy data in advance, is normal; and

transmit the dummy control signal and the expected value thereof that are used in a determination routine by the first computer to the second computer;

operating the second computer to;

receive the dummy control signal and the expected value thereof; and

compare the received dummy control signal and the expected value so as to perform a calculation routine for calculating monitor data for monitoring whether or not a result of the determination routine by the first computer is correct;

performing a fail-safe routine based on the determination result by the first computer and the monitor data by the second computer;

wherein the logic function includes a first logic function for operating the control signal based on the predetermined detection signal and a second logic function, for operating a simplified control signal based on the predetermined detection signal, and

the first computer further determines whether or not a relationship between the control signal operated in accordance with the first logic function and the simplified control signal operated in accordance with the second logic function is normal,

in a case where the first computer determines that the relationship between the control signal and the simplified control signal is not normal, or in a case where the second computer calculates the monitor data indicating that it is to be determined in the determination routine by the first computer that the relationship between the control signal and the simplified control signal is abnormal, when the first computer determines that the relationship between the dummy simplified control signal and the expected value thereof is normal and the second computer calculates the monitor data indicating that it is to be determined in the determination routine by the first computer that the relationship between the dummy simplified signal and the expected value thereof is normal, a fail-safe routine is performed for controlling the object of control using the simplified control signal.