# US 9,677,480 B2 · High diagnosability, quality managed-compliant integrated circuit for implementing ASIL B-compliant automotive safety-related functions

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 9,677,480 B2
- Document ID: US9677480B2
- Status: Granted
- Kind: B2
- Application number: 14/446,466
- Filed: 2014-07-30
- Published: 2015-02-26
- Granted: 2017-06-13
- Earliest claimed: 2013-07-30
- Assignees: Magneti Marelli S.p.A.
- Applicants: Magneti Marelli S.p.A.; Exida Development S.r.l.
- Inventors: Piero Carbonaro; Giovanni Dallara; Alessandro Fusari; Alberto Pezzoli; Francesco Traversi; Loris Lambertini
- Web page: https://patentgrep.com/patent/US9677480B2

## CPC

- F02D 29/02: peculiar to engines driving vehicles; peculiar to engines driving variable pitch propellers
- B60W 50/02: Ensuring safety in case of control system failures, e.g. by diagnosing, circumventing or fixing failures
- F02D 41/22: Safety or indicating devices for abnormal conditions {(in air/fuel ratio feedback systems F02D41/1495, in electric control linkage F02D11/107, in purge control systems F02M25/0809)}
- F02D 41/26: using computer, e.g. microprocessor
- G07C 5/0808: {Diagnosing performance data (testing of vehicles G01M17/00; testing of electrical installation on vehicles G01R31/005)}
- B60W 2050/021: {Means for detecting failure or malfunction}
- B60W 2050/0292: {Fail-safe or redundant systems, e.g. limp-home or backup systems}
- B60W 2050/041: {Built in Test Equipment [BITE]}
- G05B 2219/24021: Separate processor for monitoring system
- G05B 2219/24044: Second controller monitors diagnostics system of first controller
- G05B 2219/24199: Recover from fault, malfunction, go to safe state, correct and set new sequence
- G05B 2219/2637: Vehicle, car, auto, wheelchair
- G05B 2219/33104: Tasks, functions are distributed over different cpu
- G05B 2219/33273: DCS distributed, decentralised controlsystem, multiprocessor
- F02D: CONTROLLING COMBUSTION ENGINES (vehicle fittings, acting on a single sub-unit only, for automatically controlling vehicle speed B60K31/00; conjoint control of vehicle sub-units of different type or different function, road vehicle drive control systems for purposes other than the control of a single sub-unit B60W)
- B60W: CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
- G07C: TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
- G05B: CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS (systems for controlling or regulating non-electric variables G05D; systems for regulating electric or magnetic variables G05F; control devices or systems insofar as characterised by mechanical features only G05G)

## Abstract

An automotive internal combustion engine electronic control unit for performing safety-related functions with a predetermined automotive safety integrity level, including: a microcontroller and an integrated circuit distinct from and communicating with the microcontroller. The microcontroller performs one or more safety-related functions with the same automotive safety integrity level as required to the automotive engine electronic control unit. The integrated circuit performs one or more safety-related functions with an automotive safety integrity level that is lower than that of the microcontroller. The integrated circuit performs, for each performed safety-related function, a corresponding diagnosis function for detecting failures in the performance of the safety-related function. The microcontroller performs, for each performed diagnosis function, a corresponding monitoring function for monitoring performance of the corresponding diagnosis function by the integrated circuit to detect failures that may compromise the diagnostic capability of the diagnosis function.

## Claims

### Claim 1

An automotive internal combustion engine electronic control unit for performing safety-related functions with a predetermined automotive safety integrity level, the electronic control unit comprising: a microcontroller and an integrated circuit distinct from and communicating with the microcontroller; wherein the microcontroller is designed to perform one or more safety-related functions with an automotive safety integrity level that is the same as is required to the automotive electronic control unit; wherein the integrated circuit is designed to perform one or more safety-related functions with an automotive safety integrity level that is lower than that of the microcontroller; wherein the integrated circuit is further designed to perform, for each performed safety-related function, a corresponding diagnosis function designed to detect failures in the performance of the safety-related function; and wherein the microcontroller is designed to perform, for each performed diagnosis function, a corresponding monitoring function designed to monitor the performance of the corresponding diagnosis function by the integrated circuit to detect failures that may compromise the diagnostic capability of the diagnosis function.

### Claim 2 (depends on 1)

The automotive internal combustion engine electronic control unit as set forth in claim 1, wherein the monitoring function is designed to re-perform tests performed by the diagnosis function to check proper performance of both the safety-related function and the diagnosis function; and wherein the monitoring function is further designed to trigger a safe reaction when either a test failure of the safety-related function or a mismatch between a test result reported by the diagnosis function and a test result reported by the monitoring function is detected.

### Claim 3 (depends on 2)

The automotive internal combustion engine electronic control unit as set forth in claim 2, wherein the safe reaction triggered by the monitoring function includes de-energizing automotive safety-related loads.

### Claim 4 (depends on 1)

The automotive internal combustion engine electronic control unit as set forth in claim 1, wherein the automotive safety integrity level of performance of safety-related functions required to the automotive electronic control unit is ASIL B, while the automotive safety integrity level of performance of safety-related functions required to the integrated circuit is ASIL QM.

### Claim 5 (depends on 1)

The automotive internal combustion engine electronic control unit as set forth in claim 1, wherein the safety-related functions include one or more of:
intelligent functions including
smart crank management,
intelligent watchdog,
flying wheel interface,
wake-up and power enable logic;
power supplies including
ECU power supplies
sensor power supplies;
communication interfaces including
MSC (Micro Second Channel) interface,
LIN (Local Interconnect Network) transceiver,
CAN (Controller Area Network) transceiver; or
load driving channels.

### Claim 6 (depends on 1)

The automotive internal combustion engine electronic control unit as set forth in claim 1, wherein the integrated circuit includes:
a Test Controller designed to enable and synchronize the performance of the diagnosis function;
a Circuit Under Test which implements the safety-related function to be tested;
a Test Pattern Generator designed to test correct operation of the Circuit Under Test;
an Output Response Analyzer designed to compare an output of the Circuit Under Test with an expected output and provide an indication of test success or test failure;
an Input Isolation Circuit designed to connect an input of the Circuit Under Test to the Test Pattern Generator when the diagnosis function must be performed; and
an Output Isolation Circuit designed to connect an output of the Circuit Under Test to the Output Response Analyzer after the diagnosis function has been performed.

### Claim 7 (depends on 1)

The automotive internal combustion engine electronic control unit as set forth in claim 1, wherein the integrated circuit further includes embedded safety-related load drivers through which the integrated circuit drives safety-related loads; wherein the microcontroller lacks embedded safety-related load drivers; wherein the automotive internal combustion engine electronic control unit further includes external safety-related load drivers separated from and controlled by the microcontroller through which the microcontroller drives different safety-related loads; and wherein the external safety-related load drivers include respective embedded Over/Under Voltage Monitors designed to detect overvoltage propagating from the microcontroller towards the respective safety-related loads and to responsively generate a de-energization command for the associated safety-related loads.

### Claim 8 (depends on 1)

The automotive internal combustion engine electronic control unit as set forth in claim 1, wherein the integrated circuit further includes an electric power supply unit for powering the integrated circuit, the microcontroller, and the external safety-related load drivers.

### Claim 9

An automotive internal combustion engine electronic control unit comprising: a microcontroller; an integrated circuit distinct from and communicating with the microcontroller including embedded safety-related load drivers through which the integrated circuit drives safety-related loads; and external safety-related load drivers separate from and controlled by the microcontroller through which the microcontroller drives different safety-related loads; and wherein the external safety-related load drivers include respective embedded Over/Under Voltage Monitors designed to detect overvoltage propagating from the microcontroller towards the respective safety-related loads and to responsively generate a de-energization command for the associated safety-related loads.

### Claim 10 (depends on 9)

The automotive internal combustion engine electronic control unit as set forth in claim 9, wherein the integrated circuit further includes a power supply unit to power the integrated circuit, the microcontroller, and the external safety-related load drivers.

### Claim 11 (depends on 1)

A motor vehicle including the automotive internal combustion engine electronic control unit as set forth in claim 1.