# US 2018/0321669 A1 · Method for operating a control unit of a motor vehicle > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0321669 A1 - Document ID: US20180321669A1 - Status: Published application - Kind: A1 - Application number: 15/775,885 - Filed: 2016-11-07 - Published: 2018-11-08 - Earliest claimed: 2015-11-13 - Assignees: Robert Bosch GmbH - Applicants: Robert Bosch GmbH - Inventors: Michael Wilhelm Haas; Jochen Huber; Wolfgang Haag - Web page: https://patentgrep.com/patent/US20180321669A1 ## CPC - G05B 23/0262: {Confirmation of fault detection, e.g. extra checks to confirm that a failure has indeed occurred} - F02D 41/22: Safety or indicating devices for abnormal conditions {(in air/fuel ratio feedback systems F02D41/1495, in electric control linkage F02D11/107, in purge control systems F02M25/0809)} - F02D 41/2403: {using essentially up/down counters} - F02D 41/266: {the computer being backed-up or assisted by another circuit, e.g. analogue} - G05B 19/0428: {Safety, monitoring (G05B19/0423 takes precedence)} - G06F 11/0739: {in a data processing system embedded in automotive or aircraft systems} - G06F 11/076: {by exceeding a count or rate limit, e.g. word- or bit count limit} - G05B 2219/2637: Vehicle, car, auto, wheelchair - G06F 2201/81: Threshold - G05B: CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS (systems for controlling or regulating non-electric variables G05D; systems for regulating electric or magnetic variables G05F; control devices or systems insofar as characterised by mechanical features only G05G) - F02D: CONTROLLING COMBUSTION ENGINES (vehicle fittings, acting on a single sub-unit only, for automatically controlling vehicle speed B60K31/00; conjoint control of vehicle sub-units of different type or different function, road vehicle drive control systems for purposes other than the control of a single sub-unit B60W) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method for operating a control unit of a motor vehicle including a function unit and a monitoring unit which have a communication connection to one another. In a first check, the function unit is checked for errors, an error of the function unit being inferred if an error counter reaches a threshold value, and the monitoring unit and the function unit exchange first data with one another. In the event of a correct exchange of the first data, a positive change of the error counter is carried out. Otherwise, a negative change of the error counter is carried out. In a second check, the monitoring unit and the function unit exchange second data with one another. In the event of an incorrect exchange of the second data, a negative change of the error counter and a negative change of the threshold value are carried out. ## Claims ### Claim at position 1 1-16. (canceled) ### Claim 17 A method for operating a control unit of a motor vehicle including a function unit and a monitoring unit, which have a communication connection to one another, the method comprising: in a first check, checking the function unit for errors, an error of the function unit is inferred if an error counter reaches a threshold value, and in the first check, the monitoring unit and the function unit exchanging first data with one another, wherein in the event of a correct exchange of the first data, a positive change of the error counter is carried out, and in the event of an incorrect exchange of the first data, a negative change of the error counter is carried out; and in a second check, the monitoring unit and the function unit exchanging second data with one another, wherein in the event of an incorrect exchange of the second data, the negative change of the error counter and a negative change of the threshold value are carried out. ### Claim 18 (depends on 17) The method as recited in claim 17, wherein, in the event of the correct exchange of at least one of the first data and the second data, the positive change of the error counter and the positive change of the threshold value are carried out. ### Claim 19 (depends on 18) The method as recited in claim 18, wherein the positive change of the threshold value is carried out only if the threshold value has not yet reached a threshold starting value. ### Claim 20 (depends on 17) The method as recited in claim 17, wherein the monitoring unit and the function unit exchange the first data with one another in that the monitoring unit transmits questions to the function unit and the function unit thereupon transmits answers to the monitoring unit ### Claim 21 (depends on 20) The method as recited in claim 20, wherein at least one of: (i) the exchange of the first data is incorrect if the function unit at least one of: transmits incorrect answers, and transmits answers at incorrect points in time, and (b) the exchange of the first data is correct if the function unit transmits correct answers at correct points in time. ### Claim 22 (depends on 17) The method as recited in claim 17, wherein the monitoring unit and the function unit exchange the second data with one another in that the monitoring unit transmits questions to the function unit and the function unit thereupon transmits answers to the monitoring unit. ### Claim 23 (depends on 22) The method as recited in claim 22, wherein the exchange of the second data is incorrect if the function unit transmits one of incorrect answers, and answers at incorrect points in time. ### Claim 24 (depends on 17) The method as recited in claim 17, wherein at least one of the error counter and the threshold value are decremented by one or multiple decrements, in the course of the positive change. ### Claim 25 (depends on 16) The method as recited in claim 16, wherein at least one of the error counter and the threshold value are incremented by one or multiple increments in the course of the negative change. ### Claim 26 (depends on 17) The method as recited in claim 17, wherein the function unit determines when first data are exchanged and when second data are exchanged. ### Claim 27 (depends on 17) The method as recited in claim 17, wherein the monitoring unit specifies a fixed time window, using which points in time of the received data are checked for plausibility. ### Claim 28 (depends on 17) The method as recited in claim 17, wherein the function unit provides information to the monitoring unit of whether the negative change of the threshold value has to be carried out. ### Claim 29 (depends on 17) The method as recited in claim 17, wherein the function unit specifies a specific threshold value to the monitoring unit. ### Claim 30 A processing unit, which is configured to operate a control unit of a motor vehicle including a function unit and a monitoring unit, which have a communication connection to one another, the processing unit configured to: in a first check, check the function unit for errors, an error of the function unit is inferred if an error counter reaches a threshold value, and in the first check, the monitoring unit and the function unit exchange first data with one another, wherein in the event of a correct exchange of the first data, a positive change of the error counter is carried out, and in the event of an incorrect exchange of the first data, a negative change of the error counter is carried out; and in a second check, the monitoring unit and the function unit exchange second data with one another, wherein in the event of an incorrect exchange of the second data, the negative change of the error counter and a negative change of the threshold value are carried out. ### Claim 31 A non-transitory machine-readable storage on which is stored a computer program for operating a control unit of a motor vehicle including a function unit and a monitoring unit, which have a communication connection to one another, the computer program, when executed by a processor, causing the processor to perform: in a first check, checking the function unit for errors, an error of the function unit is inferred if an error counter reaches a threshold value, and in the first check, the monitoring unit and the function unit exchanging first data with one another, wherein in the event of a correct exchange of the first data, a positive change of the error counter is carried out, and in the event of an incorrect exchange of the first data, a negative change of the error counter is carried out; and in a second check, the monitoring unit and the function unit exchanging second data with one another, wherein in the event of an incorrect exchange of the second data, the negative change of the error counter and a negative change of the threshold value are carried out.