Electronic control system with malfunction monitor

An electronic control apparatus for a vehicle comprising:

• a microcomputer including an actuator controller and a controller monitor, the actuator controller working to control an operation of an actuator mounted in a vehicle in response to an input signal indicating a parameter associated with a preselected operating condition of the vehicle, the controller monitor working to monitor validity of a monitor parameter, associated with an operation of the actuator controller and being obtained thereby with computation by the microcomputer, by comparing the monitor parameter and an expected value of the monitor parameter, said controller monitor working to monitor whether the actuator controller is operating properly or not based on the monitored validity of the monitor parameter, said microcomputer outputting the monitor parameter and the expected value of the monitor parameter;
• and
• a monitor module including a digital circuit which is designed to monitor whether said controller monitor is operating properly or not based on comparison between the monitor parameter and the expected value of the monitor parameter, as inputted from said microcomputer, without the monitor module transmitting a test signal to the controller monitor of the microcomputer for monitoring the controller monitor, and to output a signal indicative thereof to an actuator driver;
• wherein:
• when a period of time in which the monitor parameter and the expected value of the monitor parameter have failed to be received by the monitor module exceeds a preselected time, said monitor module determines that communication with said microcomputer is failing;
• and
• said monitor module is equipped with a communication error counter which counts up in response to input from a plurality of clocks, as used to determine a reference speed at which the digital circuit operates, and is cleared when said monitor module has received the monitor parameter and the expected value of the monitor parameter, and wherein when a count value of the communication error counter exceeds a preselected value, said monitor module determines that the communication with said microcomputer is failing.

An electronic control apparatus for a vehicle comprising:

• a microcomputer including an actuator controller and a controller monitor, the actuator controller working to control an operation of an actuator mounted in a vehicle in response to an input signal indicating a parameter associated with a preselected operating condition of the vehicle, the controller monitor working to monitor validity of a monitor parameter, associated with an operation of the actuator controller and being obtained thereby with computation by the microcomputer, by comparing the monitor parameter and an expected value of the monitor parameter, said controller monitor working to monitor whether the actuator controller is operating properly or not based on the monitored validity of the monitor parameter, said microcomputer outputting the monitor parameter and the expected value of the monitor parameter;
• and
• a monitor module including a digital circuit which is designed to monitor whether said controller monitor is operating properly or not based on comparison between the monitor parameter and the expected value of the monitor parameter, as inputted from said microcomputer, without the monitor module transmitting a test signal to the controller monitor of the microcomputer for monitoring the controller monitor, and to output a signal indicative thereof to an actuator driver;
• wherein said controller monitor also monitors validity of an additional monitor parameter, which ensures validity of the operation of the actuator controller, based on the additional monitor parameter and an expected value thereof, wherein said microcomputer adds an identifier to a combination of each of the monitor parameters and a corresponding one of the expected values of the monitor parameters and transmits the combinations to said monitor module in the form of data signals, wherein said monitor module also includes an additional digital circuit and analyzes the identifiers of the data signals to provide each of the combinations of the computed and expected values to a corresponding one of the digital circuits, and wherein each of the digital circuits compares the monitor parameter with the expected value of the monitor parameter to determine whether said controller monitor is operating properly or not.

An electronic control apparatus for a vehicle comprising:

• a microcomputer including an actuator controller and a controller monitor, the actuator controller working to control an operation of an actuator mounted in a vehicle in response to an input signal indicating a parameter associated with a preselected operating condition of the vehicle, the controller monitor working to monitor validity of a monitor parameter, associated with an operation of the actuator controller and being obtained thereby with computation by the microcomputer, by comparing the monitor parameter and an expected value of the monitor parameter, said controller monitor working to monitor whether the actuator controller is operating properly or not based on the monitored validity of the monitor parameter, said microcomputer outputting the monitor parameter and the expected value of the monitor parameter;
• and
• a monitor module including a digital circuit which is designed to monitor whether said controller monitor is operating properly or not based on comparison between the monitor parameter and the expected value of the monitor parameter, as inputted from said microcomputer, without the monitor module transmitting a test signal to the controller monitor of the microcomputer for monitoring the controller monitor, and to output a signal indicative thereof to an actuator driver;
• wherein said monitor module also includes a first digital circuit that is said digital circuit and a second digital circuit, wherein said controller monitor also monitors validities of additional monitor parameters, which ensure the validities of the operation of the actuator controller, based on the additional monitor parameters and expected values thereof, respectively, wherein said microcomputer breaks down the monitor parameters into a first and a second group according to modes of monitoring of the monitor parameters, at least the first group comprising a plurality of the monitor parameters, said microcomputer also computing a value as a function of the monitor parameters associated with the first group and outputting a combination of the monitor parameters and an expected value thereof in the form of a first data signal with an identifier and a combination of the monitor parameters associated with the second group and the expected value thereof in the form of a second data signal with an identifier, and wherein the monitor parameter carried by one of the first and second data signals is to be determined by one of the first and second digital circuits of said monitor module whether the monitor parameter is coincident with the expected value of the monitor parameter or not to determine whether said controller monitor is operating properly or not, the monitor parameter carried by the other of the first and second data signals being to be determined by the other of the first and second digital circuits of said monitor module whether the monitor parameter is greater than the expected value of the monitor parameter or not to monitor whether said controller monitor is operating properly or not.

An electronic control apparatus for a vehicle comprising:

• a microcomputer including an actuator controller and a controller monitor, the actuator controller working to control an operation of an actuator mounted in a vehicle in response to an input signal indicating a parameter associated with a preselected operating condition of the vehicle, the controller monitor working to monitor validity of a monitor parameter, associated with an operation of the actuator controller and being obtained thereby with computation by the microcomputer, by comparing the monitor parameter and an expected value of the monitor parameter, said controller monitor working to monitor whether the actuator controller is operating properly or not based on the monitored validity of the monitor parameter, said microcomputer outputting the monitor parameter and the expected value of the monitor parameter;
• and
• a monitor module including a digital circuit which is designed to monitor whether said controller monitor is operating properly or not based on comparison between the monitor parameter and the expected value of the monitor parameter, as inputted from said microcomputer, without the monitor module transmitting a test signal to the controller monitor of the microcomputer for monitoring the controller monitor, and to output a signal indicative thereof to an actuator driver;
• wherein said monitor module also includes a higher speed digital circuit that is said digital circuit and a lower speed digital circuit, wherein said controller monitor also monitors validities of additional monitor parameters in cycles, respectively, which ensure the validities of the operation of the actuator controller, based on the additional monitor parameters and expected values thereof, wherein said microcomputer breaks down the monitor parameters into a first and a second group, at least the first group comprising a plurality of the monitor parameters to be monitored in ones of the cycles which are shorter and close to each other, said microcomputer also computing a value as a function of the monitor parameters associated with the first group and outputting a combination of the monitor parameter and an expected value thereof in the form of a first data signal with an identifier and a combination of the monitor parameter associated with the second group and the expected value thereof in the form of a second data signal with an identifier, and said monitor module analyzes the identifiers and dispatches the first and second data signals to the higher speed and lower speed digital circuits, respectively, the higher speed digital circuit working to determine whether the monitor parameter and the expected value carried by the first data signal are coincident with each other or not to determine whether said controller monitor is operating properly or not, the lower speed digital circuit working to determine whether the monitor parameter and the expected value carried by the second data signal are coincident with each other to determine whether said controller monitor is operating properly or not.

An electronic control apparatus for a vehicle comprising:

• a microcomputer including an actuator controller and a controller monitor, the actuator controller working to control an operation of an actuator mounted in a vehicle in response to an input signal indicating a parameter associated with a preselected operating condition of the vehicle, the controller monitor working to monitor validities of monitor parameters associated with an operation of the actuator controller and being obtained thereby with computation by the microcomputer to determine whether the actuator controller is operating properly or not, said microcomputer computing the monitor parameters, respectively, and breaking down the monitor parameters at least into a first and a second group according to modes of monitoring of the monitor parameters, at least the first group comprising a plurality of the monitor parameters, said microcomputer also computing a value as a function of the monitor parameters associated with the validities of the first group of the monitor parameters and outputting a combination of the monitor parameter and an expected value thereof in the form of a first data signal with an identifier and a combination of the monitor parameter associated with the second group and the expected value thereof in the form of a second data signal with an identifier;
• and
• a monitor module analyzing the identifiers of the first and second data signals, as inputted from said microcomputer, and dispatching the first and second data signals to a first and a second digital circuit installed in said monitor module, respectively, to determine whether the controller monitor is operating properly or not based on comparison between the monitor parameters and the expected values of the monitor parameters carried by the first and second data signals without the monitor module transmitting a test signal to the controller monitor of the microcomputer for monitoring the controller monitor.