Method and device for monitoring and controlling a vehicle engine

An electronic engine control unit comprising a memory, the electronic engine control unit being configured for monitoring and controlling a vehicle engine, comprising:

• a multicore computer (C),
• a first module (L1) that is designed, on its own, nominally and in full, to provide functions for driving the engine of the vehicle,
• a second module (L2) that is designed to monitor correct operation of the first module (L1) and to command a safety procedure when a failure of the first module (L1) is detected, and
• a third module (L3) that is designed to monitor correct operation of the multicore computer (C) and to implement said safety procedure command at request of the second module (L2) or when a failure of the first module (L1) is detected by its own means,
• wherein:
• the first module (L1) is designed to run on a first core (C1) of the multicore computer (C),
• the second module (L2) is designed to run on a second core (C2) of the multicore computer (C) that is different to the first core (C1),
• the electronic engine control unit comprises a fourth module (LM) that is designed, in a redundant and simplified manner, to provide main functions for driving the engine of the vehicle, and is furthermore designed to run under the monitoring of the second module (L2) and on the second core (C2), the third module (L3) arbitrating between a command produced by the first module (L1) and a command produced by the fourth module (LM),
• and in that the third module (L3) is configured so that the arbitration between the command produced by the first module (L1) and the command produced by the fourth module (LM) comprises the following steps:
• evaluating a first condition (T1):
• determining whether the command produced by the first module (L1) is close to, or equal to, the command produced by the fourth module (LM),
• evaluating a second condition (T2):
• determining whether the monitoring of the second module (L2) by the third module (L3) has not detected any error,
• when the first condition (T1) and the second condition (T2) are both true, applying the command produced by the first module (L1) to the engine,
• when the first condition (T1) is false and the second condition (T2) is true, applying the command produced by the fourth module (LM) to the engine,
• when the first condition (T1) is false and the second condition (T2) is false, commanding the safety procedure, and when the first condition (T1) is true and the second condition (T2) is false, commanding the safety procedure;
• and
• controlling the vehicle engine based on the safety procedure.