Control system

• US 7,269,492 B2
• Filed: 06/02/2004
• Issued: 09/11/2007
• Est. Priority Date: 06/03/2003
• Status: Active Grant

• Current Assignee: Hitachi Astemo Ltd. (Hitachi, Ltd.)
• Original Assignee: Hitachi, Ltd.
• Inventors: Tanabe, Itaru
• Primary Examiner(s): Chin; Gary
• Application Number:
  US10/857,906
• Publication Number:
  US 20040249478A1
• Time in Patent Office: 1,196 Days
• Field of Search: 701/1, 701/36, 701/51, 701/62, 714/1, 714/2, 714/23, 714/55
• US Class Current: 701/62
• CPC Class Codes: G06F 11/0736 in functional embedded systems, i.e. in a data processing system designed as a combination of hardware and software dedicated to performing a certain function testing or monitoring of automated control systems G05B23/02
• CPC Class Codes: G06F 11/0739 in a data processing system embedded in automotive or aircraft systems
• CPC Class Codes: G06F 11/0796 Safety measures, i.e. ensuring safe condition in the event of error, e.g. for controlling element
• CPC Class Codes: G06F 11/1441 Resetting or repowering

Abstract

To offer a control system that is not only equipped with a high fail-safe function but also capable of avoiding erroneous failure detection.

The CPU 110 outputs a drive signal DC for driving the load L according to the input signals from sensors S1 and S2 by means of the load drive element 120. The monitor IC 150 detects abnormal condition of equipment and outputs the first reset signal RES 1 for resetting the CPU 110 and also outputs the second reset signal RES2 when the first reset signal RES1 has been outputted for a specified number of times. The compulsory turn-off circuit 160 stops the output to the load L according to the second reset signal RES2 outputted from the monitor IC 150.

Claims

1. A control unit built in a casing of a vehicle automatic transmission, said control unit comprising:

a CPU which outputs a drive signal according to signals from at least one sensor for sensing vehicle operating parameters;

a load drive element which supplies a drive current to a load according to the drive signal;

a temperature sensor which detects a temperature of the control unit;

a monitor circuit which is connected to receive a periodic signal that is output from the CPU whenever the temperature detected by the temperature sensor is below a specified value and the CPU is in normal operation; and

a compulsory turn-off circuit which is connected between a control input terminal of the load drive element and ground potential;

wherein,

the monitor circuit outputs a first reset signal to a reset terminal of the CPU when the CPU fails to output the periodic signal;

the monitor circuit outputs a second reset signal to the compulsory turn-off circuit when the number of the outputs of the first reset signal has reached a specified number;

upon receipt of the second reset signal, the compulsory turn-off circuit turns off the load drive element and stops the supply of drive current to the load, even if the CPU thereafter outputs said periodic signal; and

the number of the outputs of the first reset signals is cleared to zero when a key of a vehicle is turned on.

2. A control system according to claim 1, wherein

the compulsory turn-off means interrupts the drive signal supplied to the load drive element.

3. A control system according to claim 1, wherein

the specified number of times which is a condition of outputting the second reset signal is preselectable.

4. A control system according to claim 1, wherein

the monitor circuit outputs the second reset signal when the first reset signal has been output for the specified number of times within a specified length of time.

5. A control system according to claim 1, wherein

the monitor circuit sets a failure flag when the second reset signal is output.

6. A control unit built in a casing of a vehicle automatic transmission, said control unit comprising:

a CPU which outputs a drive signal according to signals from at least one sensor for sensing vehicle operating parameters;

a load drive element which supplies a drive current to a load according to the drive signal;

a temperature sensor which detects a temperature of the control unit;

a monitor circuit which is connected to receive a periodic signal that is output from the CPU whenever the temperature detected by the temperature sensor is below a specified value and the CPU is in normal operation; and

a compulsory turn-off circuit which is connected in series with said load drive element for interrupting the supply of drive current from said load drive element and said load;

wherein,

the monitor circuit outputs a first reset signal to a reset terminal of the CPU when the CPU fails to output the periodic signal;

the monitor circuit outputs a second reset signal to the compulsory turn-off circuit when the number of the outputs of the first reset signal has reached a specified number;

upon receipt of the second reset signal, the compulsory turn-off circuit interrupts the supply of drive current to the load, even if the CPU thereafter outputs said periodic signal; and

the number of the outputs of the first reset signal cleared to zero when a key of a vehicle is turned on.

7. A control system according to claim 6, wherein

the specified number of times which is a condition of outputting the second reset signal is preselectable.

8. A control system according to claim 6, wherein

the monitor circuit output the second reset signal when the first reset signal has been output for the specified number of times within a specified length of time.

9. A control system according to claim 6, wherein

the monitor circuit sets a failure flag on when the second reset signal is output.