Method and device for controlling the functional unit of a motor vehicle

• US 7,437,218 B2
• Filed: 12/20/2002
• Issued: 10/14/2008
• Est. Priority Date: 12/21/2001
• Status: Expired due to Fees

• Current Assignee: Robert Bosch GmbH
• Original Assignee: Robert Bosch GmbH
• Inventors: Keller, Stefan, Funcke, Guido
• Primary Examiner(s): To; Tuan C
• Application Number:
  US10/499,769
• Publication Number:
  US 20050251308A1
• Time in Patent Office: 2,125 Days
• Field of Search: 701/1, 701/45, 701/114, 123/350, 706/908, 706/916, 280/735
• US Class Current: 701/1
• CPC Class Codes: B60W 2050/0005 Processor details or data handling, e.g. memory registers or chip architecture
• CPC Class Codes: B60W 2050/041 Built in Test Equipment [BITE]
• CPC Class Codes: F02D 2041/1418 Several control loops, either as alternatives or simultaneous
• CPC Class Codes: F02D 37/02 one of the functions being ignition
• CPC Class Codes: F02D 41/22 Safety or indicating devices for abnormal conditions in air/fuel ratio feedback systems F02D41/1495, in electric control linkage F02D11/107, in purge control systems F02M25/0809
• CPC Class Codes: F02D 41/2422 Selective use of one or more tables
• CPC Class Codes: G06F 11/0736 in functional embedded systems, i.e. in a data processing system designed as a combination of hardware and software dedicated to performing a certain function testing or monitoring of automated control systems G05B23/02
• CPC Class Codes: G06F 11/0739 in a data processing system embedded in automotive or aircraft systems
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/0796 Safety measures, i.e. ensuring safe condition in the event of error, e.g. for controlling element
• CPC Class Codes: G06F 11/1494 N-modular type
• CPC Class Codes: G06F 11/3013 where the computing system is an embedded system, i.e. a combination of hardware and software dedicated to perform a certain function in mobile devices, printers, automotive or aircraft systems testing or monitoring of control systems or parts thereof G05B23/02
• CPC Class Codes: G06F 11/302 where the computing system component is a software system
• CPC Class Codes: G06F 11/3065 Monitoring arrangements determined by the means or processing involved in reporting the monitored data error or fault reporting or logging G06F11/0766
• CPC Class Codes: Y10S 706/908 Electronic or computer, internal or network, circuit

Abstract

A method and a device for controlling a functional unit of a motor vehicle are provided. In the method, a function sequence is implemented in a functional program. The functional program is verified here by a safety program, which is in turn monitored by a monitoring module. Like the safety program, the functional program has a modular structure. The monitoring of the safety program is accordingly implemented in multiple stages corresponding to the number of modules.

Claims

1. A method for controlling a functional unit of a motor vehicle, comprising:

implementing a function sequence for the functional unit by a functional program, wherein the functional program has a modular organizational structure including at least two functional modules;

verifying the functional program by a safety program, wherein the safety program has a modular organizational structure including at least two safety modules corresponding to the at least two functional modules; and

monitoring the safety program by a monitoring module, wherein the monitoring of the safety program is implemented in multiple parts corresponding to the number of safety modules;

wherein the at least two safety modules of the safety program each generate a partial contribution as output, and wherein the partial contributions are fed to the monitoring module for evaluation; and

wherein the partial contributions are initially provided from the at least two safety modules to a decoder, and wherein the partial contributions are fed to the monitoring module from the decoder.

2. A method for controlling a functional unit of a motor vehicle, comprising:

implementing a function sequence for the functional unit by a functional program, wherein the functional program has a modular organizational structure including at least two functional modules;

verifying the functional program by a safety program, wherein the safety program has a modular organizational structure including at least two safety modules corresponding to the at least two functional modules; and

monitoring the safety program by a monitoring module, wherein the monitoring of the safety program is implemented in multiple parts corresponding to the number of safety modules;

wherein the at least two safety modules of the safety program each generate a partial contribution as output, and wherein the partial contributions are fed to the monitoring module for evaluation; and

wherein the partial contribution of a first one of the two safety modules is initially forwarded to a second one of the two safety modules, and wherein the partial contributions of the two safety modules are fed to the monitoring module from the second one of the two safety modules.

3. A method for controlling a functional unit of a motor vehicle, comprising:

implementing a function sequence for the functional unit by a functional program, wherein the functional program has a modular organizational structure including at least two functional modules;

verifying the functional program by a safety program, wherein the safety program has a modular organizational structure including at least two safety modules corresponding to the at least two functional modules; and

monitoring the safety program by a monitoring module, wherein the monitoring of the safety program is implemented in multiple parts corresponding to the number of safety modules;

wherein the monitoring includes;

sending test data from the monitoring module to the two safety modules;

generating, from the two safety modules, output data; and

comparing, in the monitoring module, the output data with the test data.

4. A method for controlling a functional unit of a motor vehicle, comprising:

implementing a function sequence for the functional unit by a functional program, wherein the functional program has a modular organizational structure including at least two functional modules;

verifying the functional program by a safety program, wherein the safety program has a modular organizational structure including at least two safety modules corresponding to the at least two functional modules; and

monitoring the safety program by a monitoring module, wherein the monitoring of the safety program is implemented in multiple parts corresponding to the number of safety modules;

wherein the at least two safety modules of the safety program each generate a partial contribution as output, and wherein the partial contributions are fed to the monitoring module for evaluation; and

wherein the monitoring includes;

sending test data from the monitoring module to the two safety modules;

generating, from the two safety modules, the partial contributions as output data; and

comparing, in the monitoring module, the output data with the test data.

5. A method for controlling a functional unit of a motor vehicle, comprising:

implementing a function sequence for the functional unit by a functional program, wherein the functional program has a modular organizational structure including at least two functional modules;

verifying the functional program by a safety program, wherein the safety program has a modular organizational structure including at least two safety modules corresponding to the at least two functional modules; and

monitoring the safety program by a monitoring module, wherein the monitoring of the safety program is implemented in multiple parts corresponding to the number of safety modules;

wherein the at least two safety modules of the safety program each generate a partial contribution as output, and wherein the partial contributions are fed to the monitoring module for evaluation;

wherein the partial contributions are initially provided from the at least two safety modules to a decoder, and wherein the partial contributions are fed to the monitoring module from the decoder; and

wherein the monitoring includes;

sending test data from the monitoring module to the two safety modules;

generating, from the two safety modules, the partial contributions as output data; and

comparing, in the monitoring module, the output data with the test data.

6. A hardware-implemented computer-readable storage medium having stored thereon a computer program including a plurality of program codes executable by a computer, the program codes, when executed, causing the computer to perform a method for controlling a functional unit of a motor vehicle, the method comprising:

implementing a function sequence for the functional unit by a functional program, wherein the functional program has a modular organizational structure including at least two functional modules;

verifying the functional program by a safety program, wherein the safety program has a modular organizational structure including at least two safety modules corresponding to the at least two functional modules; and

monitoring the safety program by a monitoring module, wherein the monitoring of the safety program is implemented in multiple parts corresponding to the number of safety modules;

wherein the at least two safety modules of the safety program each generate a partial contribution as output, and wherein the partial contributions are fed to the monitoring module for evaluation; and

wherein the partial contributions are initially provided from the at least two safety modules to a decoder, and wherein the partial contributions are fed to the monitoring module from the decoder.

7. A device for controlling a functional unit of a motor vehicle, comprising:

a processor configured to;

execute a functional program that implements a function sequence for the functional unit, wherein the functional program has a modular organizational structure including at least two functional modules;

execute a safety program that verifies the functional program, wherein the safety program has a modular organizational structure including at least two safety modules corresponding to the at least two functional modules;

a hardware-implemented monitoring module configured to monitor the safety program, wherein the monitoring of the safety program is implemented in multiple parts corresponding to the number of safety modules; and

wherein the execution of the at least two safety modules of the safety program each generates a partial contribution as output, and wherein the device is configured for the partial contributions to be fed to the monitoring module for evaluation; and

wherein the device is configured for the partial contributions to be initially provided from the at least two safety modules to a decoder, and for the partial contributions to be fed to the monitoring module from the decoder.

8. The device as recited in claim 7, wherein each of the functional modules and the safety modules are stored in separate memory units.

9. The device as recited in claim 7, wherein the monitoring module is a microcontroller.

10. A device for controlling a functional unit of a motor vehicle, comprising:

a processor configured to;

execute a functional program that implements a function sequence for the functional unit, wherein the functional program has a modular organizational structure including at least two functional modules;

execute a safety program that verifies the functional program, wherein the safety program has a modular organizational structure including at least two safety modules corresponding to the at least two functional modules;

a hardware-implemented monitoring module configured to monitor the safety program, wherein the monitoring of the safety program is implemented in multiple parts corresponding to the number of safety modules; and

wherein the monitoring includes;

sending test data from the monitoring module to the processor for the two safety modules;

generating, via the execution of the two safety modules, output data; and

comparing, in the monitoring module, the output data with the test data.