Electronic control apparatus for vehicles, which is provided with plural microcomputers

• US 8,155,824 B2
• Filed: 02/03/2009
• Issued: 04/10/2012
• Est. Priority Date: 02/04/2008
• Status: Active Grant

• Current Assignee: DENSO Corporation
• Original Assignee: DENSO Corporation
• Inventors: Sakai, Naoto, Itabashi, Toru, Nakamura, Michio
• Primary Examiner(s): Chen, Shelley
• Application Number:
  US12/364,671
• Publication Number:
  US 20090198407A1
• Time in Patent Office: 1,162 Days
• Field of Search: 701/31
• US Class Current: 701/34.3
• CPC Class Codes: B60W 50/0205 Diagnosing or detecting failures; Failure detection models

Abstract

An electric control apparatus for a vehicle is provided. The apparatus comprises at least two microcomputers, an external monitoring unit, and an internal monitoring means. The two microcomputers are composed of a first microcomputer and a second microcomputer, The first microcomputer is assigned to controlling travel functions of a vehicle. The external monitoring unit monitors whether or not the first microcomputer is in a normal operation and is placed outside the first and second microcomputers. The internal monitoring means monitors whether or not the first microcomputer is in a normal operation and is within the first microcomputer.

Claims

1. An electric control apparatus for a vehicle, comprising:

at least two microcomputers composed of at least a first microcomputer and a second microcomputer, the first microcomputer being assigned to controlling travel functions of a vehicle;

an external monitoring unit that monitors whether or not the first microcomputer is in a normal operation, wherein the external monitoring unit is placed outside the first and second microcomputers; and

an internal monitoring means that monitors whether or not the first microcomputer is in a normal operation, wherein the internal monitoring means is within the first microcomputer;

the first microcomputer comprises output means that outputs a monitoring signal to the internal monitoring means and the external monitoring unit at intervals which are set within a given period of time, the monitoring signal being for allowing both of the internal monitoring means and the external monitoring unit to monitor the operations of the first microcomputer; and

each of the second microcomputer and the external monitoring unit is formed to output a reset signal to the first microcomputer when the monitoring signal has not been provided from the first microcomputer for a given period of monitoring time, the reset signal resetting the operations of the first microcomputer;

wherein the internal monitoring means is given a monitoring time which is set to monitor the operations of the first microcomputer and the external monitoring unit is given a further monitoring time monitor to monitor the operations of the first microcomputer, the monitoring time given to the internal monitoring means being different from the further monitoring time given to the external monitoring unit;

wherein the further monitoring time given to the external monitoring unit is longer than the monitoring time given to the internal monitoring means.

2. The apparatus of claim 1, comprising a power supply unit is that supplies power-supply voltage to the first microcomputer in response to a power control signal, the power-supply voltage starting up the first microcomputer,

wherein the second microcomputer comprises

determining means that determines whether or not the first microcomputer needs to start up, and

switching means that switches over between an output action and a non-output action of the power control signal to be given to the power supply unit based on results determined by the determining means as to starting up the first microcomputer.

3. The apparatus of claim 1, wherein

the first microcomputer comprises providing means that provides the external monitoring unit with an operation signal showing that the first microcomputer is in operation, and

the external monitoring unit is formed to monitor operations of the first microcomputer during reception of the operation signal.

5. The apparatus of claim 1, wherein

a the first microcomputer comprises means for monitoring whether or not the second microcomputer is in a normal operation.

6. The apparatus of claim 5, wherein the second microcomputer comprises outputting means that outputs a monitoring signal to the first microcomputer at intervals which are set within a given period of time, the monitoring signal being for allowing the first microcomputer to monitor operations of the second microcomputer and

the first microcomputer is formed to output a reset signal to the second microcomputer when the monitoring signal has not been provided from the second microcomputer for a given period of monitoring time, the reset signal resetting the operations of the second microcomputer.

8. The apparatus of claim 2, wherein

the first microcomputer comprises providing means that provides the external monitoring unit with an operation signal showing that the first microcomputer is in operation, and

the external monitoring unit is formed to monitor operations of the first microcomputer during reception of the operation signal.

9. The apparatus of claim 2, wherein

the first microcomputer comprises output means that outputs a monitoring signal to the internal monitoring means and the external monitoring unit at intervals which are set within a given period of time, the monitoring signal being for allowing both of the internal monitoring means and the external monitoring unit to monitor the operations of the first microcomputer and

each of the second microcomputer and the external monitoring unit is formed to output a reset signal to the first microcomputer when the monitoring signal has not been provided from the first microcomputer for a given period of monitoring time, the reset signal resetting the operations of the first microcomputer.

10. The apparatus of claim 9, wherein the internal monitoring means is given a monitoring time which is set to monitor the operations of the first microcomputer and the external monitoring unit is given a further monitoring time monitor to monitor the operations of the first microcomputer, the monitoring time given to the internal monitoring means being different from the further monitoring time given to the external monitoring unit.

11. The apparatus of claim 10, wherein the further monitoring time given to the external monitoring unit is longer than the monitoring time given to the internal monitoring means.

12. The apparatus of claim 3, wherein

the first microcomputer comprises output means that outputs a monitoring signal to the internal monitoring means and the external monitoring unit at intervals which are set within a given period of time, the monitoring signal being for allowing both of the internal monitoring means and the external monitoring unit to monitor the operations of the first microcomputer and

each of the second microcomputer and the external monitoring unit is formed to output a reset signal to the first microcomputer when the monitoring signal has not been provided from the first microcomputer for a given period of monitoring time, the reset signal resetting the operations of the first microcomputer.

13. The apparatus of claim 3, wherein

the first microcomputer comprises output means that outputs a monitoring signal to the internal monitoring means and the external monitoring unit at intervals which are set within a given period of time, the monitoring signal being for allowing both of the internal monitoring means and the external monitoring unit to monitor the operations of the first microcomputer and

each of the second microcomputer and the external monitoring unit is formed to output a reset signal to the first microcomputer when the monitoring signal has not been provided from the first microcomputer for a given period of monitoring time, the reset signal resetting the operations of the first microcomputer.

14. The apparatus of claim 10, wherein each of the internal monitoring means and the external monitoring unit comprises

determining means for determining whether or not the first microcomputer is in a disabled state in which no return of the first microcomputer to a normal state thereof. Is expected even if the reset signal is given the first microcomputer, and

stopping means for making the power supply unit stop supplying the power-supply voltage to the first microcomputer.

15. The apparatus of claim 2, wherein

the first microcomputer comprises means for monitoring whether or not the second microcomputer is in a normal operation.

16. The apparatus of claim 2, comprising

a power supply unit that supplies power-supply voltage to the first microcomputer, the power-supply voltage starting up the first microcomputer;

determining means that determines whether or not both the internal monitoring means of the second microcomputer and the external monitoring unit are malfunctioning; and

stopping means that makes the power supply unit stop supplying the power-supply voltage.

4. An electric control apparatus for a vehicle, comprising:

at least two microcomputers composed of at least a first microcomputer and a second microcomputer, the first microcomputer being assigned to controlling travel functions of a vehicle;

an external monitoring unit that monitors whether or not the first microcomputer is in a normal operation, wherein the external monitoring unit is placed outside the first and second microcomputers; and

an internal monitoring means that monitors whether or not the first microcomputer is in a normal operation, wherein;

the internal monitoring means is within the first microcomputer;

the first microcomputer comprises output means that outputs a monitoring signal to the internal monitoring means and the external monitoring unit at intervals which are set within a given period of time, the monitoring signal being for allowing both of the internal monitoring means and the external monitoring unit to monitor the operations of the first microcomputer; and

each of the second microcomputer and the external monitoring unit is formed to output a reset signal to the first microcomputer when the monitoring signal has not been provided from the first microcomputer for a given period of monitoring time, the reset signal resetting the operations of the first microcomputer;

each of the internal monitoring means and the external monitoring unit comprises

determining means for determining whether or not the first microcomputer is in a disabled state in which no return of the first microcomputer to a normal state thereof is expected even if the reset signal is given the first microcomputer, and

stopping means for making the power supply unit stop supplying the power-supply voltage to the first microcomputer based on the determination by the determining means.

7. An electric control apparatus for a vehicle, comprising:

at least two microcomputers composed of at least a first microcomputer and a second microcomputer, the first microcomputer being assigned to controlling travel functions of a vehicle;

an external monitoring unit that monitors whether or not the first microcomputer is in a normal operation, wherein the external monitoring unit is placed outside the first and second microcomputers; and

an internal monitoring means that monitors whether or not the first microcomputer is in a normal operation, wherein the internal monitoring means is within the first microcomputer;

a power supply unit that supplies power-supply voltage to the first microcomputer the power-supply voltage starting up the first microcomputer;

determining means that determines whether or not both the internal monitoring means of the second microcomputer and the external monitoring unit are malfunctioning; and

stopping means that makes the power supply unit stop supplying the power-supply voltage based on the determination by the determining means.