CA1194236A - Multiple microcomputer system with comonitoring/back- up for an automotive vehicle - Google Patents
Multiple microcomputer system with comonitoring/back- up for an automotive vehicleInfo
- Publication number
- CA1194236A CA1194236A CA000407048A CA407048A CA1194236A CA 1194236 A CA1194236 A CA 1194236A CA 000407048 A CA000407048 A CA 000407048A CA 407048 A CA407048 A CA 407048A CA 1194236 A CA1194236 A CA 1194236A
- Authority
- CA
- Canada
- Prior art keywords
- microcomputer
- microcomputers
- signal
- control
- malfunctioning
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired
Links
Classifications
-
- G—PHYSICS
- G07—CHECKING-DEVICES
- G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
- G07C5/00—Registering or indicating the working of vehicles
- G07C5/08—Registering or indicating performance data other than driving, working, idle, or waiting time, with or without registering driving, working, idle or waiting time
- G07C5/10—Registering or indicating performance data other than driving, working, idle, or waiting time, with or without registering driving, working, idle or waiting time using counting means or digital clocks
-
- F—MECHANICAL ENGINEERING; LIGHTING; HEATING; WEAPONS; BLASTING
- F02—COMBUSTION ENGINES; HOT-GAS OR COMBUSTION-PRODUCT ENGINE PLANTS
- F02D—CONTROLLING COMBUSTION ENGINES
- F02D41/00—Electrical control of supply of combustible mixture or its constituents
- F02D41/24—Electrical control of supply of combustible mixture or its constituents characterised by the use of digital means
- F02D41/26—Electrical control of supply of combustible mixture or its constituents characterised by the use of digital means using computer, e.g. microprocessor
- F02D41/266—Electrical control of supply of combustible mixture or its constituents characterised by the use of digital means using computer, e.g. microprocessor the computer being backed-up or assisted by another circuit, e.g. analogue
-
- F—MECHANICAL ENGINEERING; LIGHTING; HEATING; WEAPONS; BLASTING
- F02—COMBUSTION ENGINES; HOT-GAS OR COMBUSTION-PRODUCT ENGINE PLANTS
- F02D—CONTROLLING COMBUSTION ENGINES
- F02D43/00—Conjoint electrical control of two or more functions, e.g. ignition, fuel-air mixture, recirculation, supercharging or exhaust-gas treatment
-
- F—MECHANICAL ENGINEERING; LIGHTING; HEATING; WEAPONS; BLASTING
- F02—COMBUSTION ENGINES; HOT-GAS OR COMBUSTION-PRODUCT ENGINE PLANTS
- F02P—IGNITION, OTHER THAN COMPRESSION IGNITION, FOR INTERNAL-COMBUSTION ENGINES; TESTING OF IGNITION TIMING IN COMPRESSION-IGNITION ENGINES
- F02P15/00—Electric spark ignition having characteristics not provided for in, or of interest apart from, groups F02P1/00 - F02P13/00 and combined with layout of ignition circuits
- F02P15/008—Reserve ignition systems; Redundancy of some ignition devices
-
- F—MECHANICAL ENGINEERING; LIGHTING; HEATING; WEAPONS; BLASTING
- F02—COMBUSTION ENGINES; HOT-GAS OR COMBUSTION-PRODUCT ENGINE PLANTS
- F02P—IGNITION, OTHER THAN COMPRESSION IGNITION, FOR INTERNAL-COMBUSTION ENGINES; TESTING OF IGNITION TIMING IN COMPRESSION-IGNITION ENGINES
- F02P5/00—Advancing or retarding ignition; Control therefor
- F02P5/04—Advancing or retarding ignition; Control therefor automatically, as a function of the working conditions of the engine or vehicle or of the atmospheric conditions
- F02P5/145—Advancing or retarding ignition; Control therefor automatically, as a function of the working conditions of the engine or vehicle or of the atmospheric conditions using electrical means
- F02P5/15—Digital data processing
- F02P5/1518—Digital data processing using two or more central computing units, e.g. interpolation
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/08—Error detection or correction by redundancy in data representation, e.g. by using checking codes
- G06F11/085—Error detection or correction by redundancy in data representation, e.g. by using checking codes using codes with inherent redundancy, e.g. n-out-of-m codes
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/16—Error detection or correction of the data by redundancy in hardware
- G06F11/20—Error detection or correction of the data by redundancy in hardware using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements
- G06F11/202—Error detection or correction of the data by redundancy in hardware using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements where processing functionality is redundant
- G06F11/2035—Error detection or correction of the data by redundancy in hardware using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements where processing functionality is redundant without idle spare hardware
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
- G06F11/0751—Error or fault detection not based on redundancy
- G06F11/0754—Error or fault detection not based on redundancy by exceeding limits
- G06F11/0757—Error or fault detection not based on redundancy by exceeding limits by exceeding a time limit, i.e. time-out, e.g. watchdogs
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/16—Error detection or correction of the data by redundancy in hardware
- G06F11/20—Error detection or correction of the data by redundancy in hardware using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements
- G06F11/202—Error detection or correction of the data by redundancy in hardware using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements where processing functionality is redundant
- G06F11/2048—Error detection or correction of the data by redundancy in hardware using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements where processing functionality is redundant where the redundant components share neither address space nor persistent storage
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2201/00—Indexing scheme relating to error detection, to error correction, and to monitoring
- G06F2201/85—Active fault masking without idle spares
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02T—CLIMATE CHANGE MITIGATION TECHNOLOGIES RELATED TO TRANSPORTATION
- Y02T10/00—Road transport of goods or passengers
- Y02T10/10—Internal combustion engine [ICE] based vehicles
- Y02T10/40—Engine management systems
Abstract
ABSTRACT OF THE DISCLOSURE
An electronic control system for an automotive vehicle including an engine control system for controlling the engine operation using a microcomputer and a vehicle driving information system for preparing and displaying various driving information using another microcomputer, wherein a back up program is assembled into each microcomputer for backing up at least the critical jobs of the partner microcomputer when the partner fails so as to ensure continuing, safe operation of the vehicle.
An electronic control system for an automotive vehicle including an engine control system for controlling the engine operation using a microcomputer and a vehicle driving information system for preparing and displaying various driving information using another microcomputer, wherein a back up program is assembled into each microcomputer for backing up at least the critical jobs of the partner microcomputer when the partner fails so as to ensure continuing, safe operation of the vehicle.
Description
The present invention relates to a centralized electronic control system for an automotive vehicle having, for example, an engine control s~tem using a microcomputer which controls engine operation and a vehicle driving con-dition information system using another microcomputer whichinforms a vehicle occupant of the changing conditions of various appliances of the vehicle, wherein one microcomputer system monitors the other microcomputer system to check whether or not the partner s~stem is operating normally, and backs up the partner system when the partner system is not operating normally. Both microcomputers are provided with auxiliary control sections, in addition to their normal con-trol programs, in order to perform at least some of the functions of the partner system in case of malfunction thereof.
More particularl~, according to the present inven-tion, there is provided a method of ensuring the operation of an electronic control system for an automotive vehicle in which two microcomputers perform separate vehicle control and/or monitoring functions, comprising the following steps (a) and (b) executed concurrently by each microcomputer;
(a) outputting a first signal indicative of whether the microcomputer is malfunctioning; and (b) monitoring the first signal of the other of said two microcomputers and recognizing whether this other microcomputer is malfunctioning;
the said method also comprisinc3 the step of (c) performing at least a part of the functions of a first of said two microcomputers through the second of said two microcomputers when the first microcomputer is recognized to be malfunctioning by the second microcomputer.
According to a preferred characteristic of the method of the present invention, whenever one of said two microcomputers is recognized to be malfunctioning in the 3~
step ~b), the step (c) comprises assuming through the other of said two microcomputers those functions of the malfunctiGning microcomputer which are essential for a continued, safe operation of the vehicle.
According to the p~esent invention, there is also provided an electronic data processing system mounted in an automotive vehicle, comprising:
(a) a first microcomputer for performing primary control over primary engine functions including fuel injec-tion start and duration, ignition timing, and fuel pump energization, and for performing control over ~econdary engine functions;
(b) a second microcomputer for primarily performing control over primary indications including speedometer and odometer indications and ~or performing control over second-ary vehicle driving indicatiGns;
(c) first means provided within each of said first and second microcomputers for delivering a signal indicating whether the microcomputer is operating properly;
(d) second means provided within each of said first and second microcomputers and responsive to the signal from said first means of the other of said first and second microcomputers for determining whether this other micro-computer is functioning properly; and (e) third means provided within each of said first and second microcomputers and responsive to the determina-tion of said second means of the corresponding microcomputer that the other of said first and second microcomputers is malfunctioning for performing the primary function or ~,o indication control of the other microcomputer which is determined to he malfunctioning together with the own duties of said corresponding microcomputer.
The features and advantages of the present invention will be appreciated from the following non-~\
3~;
restrictive description of a preferred embodiment thereof, made in conjunction with the attached drawings in which the like reference numerals designate corresponding elements and in which:
Fig. 1 is a simplified block diagram of the control system mounted in the automotive vehicle including two microcomputers performing separate functions according to the present invention;
Figs. 2(A~ and (B~ show the overall system configuration of an engine control system associated with the engine shown in Fig. l;
Figs. 3(A), 3IB) and 3(C) form a simplified block diagram of the internal configuration of a control unit shown in Fig. 2(B);
Fig. 4 is a simplified block diagram of an internal configuration of a vehicle driving information indicating system shown in Fig. l;
Figs. 5(A) and 5(B) show examples of program flowcharts for executing fuel injection control in I re~ f /
/
/
/
/
/
/
/
/
/
/
,/
~"
/
/
/
/
/
/
/
/
/
"~
/
/~
"
- 2a -..~, 23~;
the engine control system shown in Figs. 1, 2(B), or 3(A), 3(B), and 3~C) in the case when the enyine control system fails; and Fig. 6 is an internal circuit diagram of an actuating circuit shown in Fig. l.
~ eference will be made hereinafter to the attached drawings.
First, Fig. 1 shows a simplified block diagram of a dual microcomputer system with comonitoring and back-up facility for an automotive vehicle according to the present invention.
In Fig. l, numeral 1000 denotes a control system for an internal combustion enqine (hereinafter abbreviated as E/C), wherein settings for ignition timing, fuel injection, and exhaust gas recirculation are controlled by a microcomputer in a time-sharing mode in response to various conditions of the engine sensed- during its operation, thereby maximizing energy conversion ef~iciency, fuel economy, and torque and minimizing the emission of noxious pollutants from the engine. Numeral 2500 denotes an information indication system (hereinafter abbreviated as D/C) for~indicating various vehicle driving conditions on a display in the instrument panel. In addition, there may be many other systems using microc-omputers, e.g., an automatic temperature control system for an air conditioner of the vehicle, a control system for
More particularl~, according to the present inven-tion, there is provided a method of ensuring the operation of an electronic control system for an automotive vehicle in which two microcomputers perform separate vehicle control and/or monitoring functions, comprising the following steps (a) and (b) executed concurrently by each microcomputer;
(a) outputting a first signal indicative of whether the microcomputer is malfunctioning; and (b) monitoring the first signal of the other of said two microcomputers and recognizing whether this other microcomputer is malfunctioning;
the said method also comprisinc3 the step of (c) performing at least a part of the functions of a first of said two microcomputers through the second of said two microcomputers when the first microcomputer is recognized to be malfunctioning by the second microcomputer.
According to a preferred characteristic of the method of the present invention, whenever one of said two microcomputers is recognized to be malfunctioning in the 3~
step ~b), the step (c) comprises assuming through the other of said two microcomputers those functions of the malfunctiGning microcomputer which are essential for a continued, safe operation of the vehicle.
According to the p~esent invention, there is also provided an electronic data processing system mounted in an automotive vehicle, comprising:
(a) a first microcomputer for performing primary control over primary engine functions including fuel injec-tion start and duration, ignition timing, and fuel pump energization, and for performing control over ~econdary engine functions;
(b) a second microcomputer for primarily performing control over primary indications including speedometer and odometer indications and ~or performing control over second-ary vehicle driving indicatiGns;
(c) first means provided within each of said first and second microcomputers for delivering a signal indicating whether the microcomputer is operating properly;
(d) second means provided within each of said first and second microcomputers and responsive to the signal from said first means of the other of said first and second microcomputers for determining whether this other micro-computer is functioning properly; and (e) third means provided within each of said first and second microcomputers and responsive to the determina-tion of said second means of the corresponding microcomputer that the other of said first and second microcomputers is malfunctioning for performing the primary function or ~,o indication control of the other microcomputer which is determined to he malfunctioning together with the own duties of said corresponding microcomputer.
The features and advantages of the present invention will be appreciated from the following non-~\
3~;
restrictive description of a preferred embodiment thereof, made in conjunction with the attached drawings in which the like reference numerals designate corresponding elements and in which:
Fig. 1 is a simplified block diagram of the control system mounted in the automotive vehicle including two microcomputers performing separate functions according to the present invention;
Figs. 2(A~ and (B~ show the overall system configuration of an engine control system associated with the engine shown in Fig. l;
Figs. 3(A), 3IB) and 3(C) form a simplified block diagram of the internal configuration of a control unit shown in Fig. 2(B);
Fig. 4 is a simplified block diagram of an internal configuration of a vehicle driving information indicating system shown in Fig. l;
Figs. 5(A) and 5(B) show examples of program flowcharts for executing fuel injection control in I re~ f /
/
/
/
/
/
/
/
/
/
/
,/
~"
/
/
/
/
/
/
/
/
/
"~
/
/~
"
- 2a -..~, 23~;
the engine control system shown in Figs. 1, 2(B), or 3(A), 3(B), and 3~C) in the case when the enyine control system fails; and Fig. 6 is an internal circuit diagram of an actuating circuit shown in Fig. l.
~ eference will be made hereinafter to the attached drawings.
First, Fig. 1 shows a simplified block diagram of a dual microcomputer system with comonitoring and back-up facility for an automotive vehicle according to the present invention.
In Fig. l, numeral 1000 denotes a control system for an internal combustion enqine (hereinafter abbreviated as E/C), wherein settings for ignition timing, fuel injection, and exhaust gas recirculation are controlled by a microcomputer in a time-sharing mode in response to various conditions of the engine sensed- during its operation, thereby maximizing energy conversion ef~iciency, fuel economy, and torque and minimizing the emission of noxious pollutants from the engine. Numeral 2500 denotes an information indication system (hereinafter abbreviated as D/C) for~indicating various vehicle driving conditions on a display in the instrument panel. In addition, there may be many other systems using microc-omputers, e.g., an automatic temperature control system for an air conditioner of the vehicle, a control system for
2~
tuning and selecting waves Erom broadcasting stations,-and various (vocal) warning systems (not shown in Fig. 1).
These systems will be used with increasing frequency in automotive vehicles in the near fu~ure.
The D/C system 2500 receives various input signals 2531, 2532, 2533, and 2534 indicative of vehicle conditions to be described in more detail later. Some of the input signals, e.g., the vehicle speed signal 2534, are also inputted to the E/C system 1000. On the other hand, the E/C 1000 receives various input signals 201, 211, 231, 261, and 271 and some of these input signals, e.g., engine speed signal (REF) 201, coolant water temperature signal (Tw) 231, etc.~ are also inputted into the D/C system 2500.
Numeral 2527 denotes the speed meter (S/M) in a display unit 2510. Numeral 2528 denotes the odometer (O~M) in a display unit 2510. Numerals 2523, and 2524 denote actuating circuits for the speed meter 5/M 2527, and odometer ~O/M) 2528, respectively. Numeral 110 denotes fuel injection control circuitry (EGI) associated with fuel injection valves and numeral 120 denotes ignition control circuitry (IGN) associated with an ignition coil. Numerals 1625 and 1626 denote respective actuating circuits for the fuel injection control and ignition control circuitry 110 and 120. Numerals 2542 through 2545, 1511, 1512, 1548, and 1549 denote actuation signals for S/M 2527, O/M 2528, EGI
110, and IGN 120.
The E/C 1000 and D/C 2500 have substantially the 23~;
same configuration, i.e., an I/O interface, central processing unit (CPU), read-only memory (ROM), and random-access memory (RP~1). The reason that the E/C and DC
1000 and 2500 do not use a single microcomputer for a general purpose of control and display over the vehicle but rather use two separate microcomputers for the individual purposes is that if the systems were integrated, the scale of the circuitry would be enlarged due to the greater range of calculation and processing capabilities that would be required. Therefore, the cost performance, mountability and reliability of the integrated microcomputer system would be reduced. The reason is described hereinafter in more detail.
(1~ If all the functions were centralized, the number of input/output signal lines would be increased. In this case, the increase in connector cable size would cause an increase in the force applied to the I/O connectors of the microcomputer and might result in deformation and defective contact of the I/O connectors with the microcomputer. Furthermore, noise is transmitted between the I/O signal lines so that an erroneous operation thereof would be more likely to occur.
(2) If the number of circuit components is increased, the failure rate is increased accordingly. If the s~stems were integrated within a single microcomputer, the failure of a single circuit component would effect the other circuit components, resulting in the failure of the entire integrated microcomputer. In the case when the systems use separate microcomputers, such a failure would result in the failure of only one of the microcomputer systems.
tuning and selecting waves Erom broadcasting stations,-and various (vocal) warning systems (not shown in Fig. 1).
These systems will be used with increasing frequency in automotive vehicles in the near fu~ure.
The D/C system 2500 receives various input signals 2531, 2532, 2533, and 2534 indicative of vehicle conditions to be described in more detail later. Some of the input signals, e.g., the vehicle speed signal 2534, are also inputted to the E/C system 1000. On the other hand, the E/C 1000 receives various input signals 201, 211, 231, 261, and 271 and some of these input signals, e.g., engine speed signal (REF) 201, coolant water temperature signal (Tw) 231, etc.~ are also inputted into the D/C system 2500.
Numeral 2527 denotes the speed meter (S/M) in a display unit 2510. Numeral 2528 denotes the odometer (O~M) in a display unit 2510. Numerals 2523, and 2524 denote actuating circuits for the speed meter 5/M 2527, and odometer ~O/M) 2528, respectively. Numeral 110 denotes fuel injection control circuitry (EGI) associated with fuel injection valves and numeral 120 denotes ignition control circuitry (IGN) associated with an ignition coil. Numerals 1625 and 1626 denote respective actuating circuits for the fuel injection control and ignition control circuitry 110 and 120. Numerals 2542 through 2545, 1511, 1512, 1548, and 1549 denote actuation signals for S/M 2527, O/M 2528, EGI
110, and IGN 120.
The E/C 1000 and D/C 2500 have substantially the 23~;
same configuration, i.e., an I/O interface, central processing unit (CPU), read-only memory (ROM), and random-access memory (RP~1). The reason that the E/C and DC
1000 and 2500 do not use a single microcomputer for a general purpose of control and display over the vehicle but rather use two separate microcomputers for the individual purposes is that if the systems were integrated, the scale of the circuitry would be enlarged due to the greater range of calculation and processing capabilities that would be required. Therefore, the cost performance, mountability and reliability of the integrated microcomputer system would be reduced. The reason is described hereinafter in more detail.
(1~ If all the functions were centralized, the number of input/output signal lines would be increased. In this case, the increase in connector cable size would cause an increase in the force applied to the I/O connectors of the microcomputer and might result in deformation and defective contact of the I/O connectors with the microcomputer. Furthermore, noise is transmitted between the I/O signal lines so that an erroneous operation thereof would be more likely to occur.
(2) If the number of circuit components is increased, the failure rate is increased accordingly. If the s~stems were integrated within a single microcomputer, the failure of a single circuit component would effect the other circuit components, resulting in the failure of the entire integrated microcomputer. In the case when the systems use separate microcomputers, such a failure would result in the failure of only one of the microcomputer systems.
(3) Since the number of pins in each I/O
connector would be increased, the entire system would take up more space. This would be disadvantageous in terms of installation of the microcomputer at the most efficient position in accordance with the system functions.
Therefore, the mountability would be reduced.
connector would be increased, the entire system would take up more space. This would be disadvantageous in terms of installation of the microcomputer at the most efficient position in accordance with the system functions.
Therefore, the mountability would be reduced.
(4) Although centrali~ed system would be generally less expensive than its delocalized counterpart, centralization (or integration) becomes technically difficult when the degree of centralization exceeds a certain limit and special manufacturing techniques would be required for the manufacture of the IC7s. Therefore, the yield would be degraded and consequently the manufacturing cost would rapidly increase.
(5) Although the microcomputer handles a plurality of jobs (functions) in time-sharing mode, the average interval of execution time from one routine to a subsequent routine becomes shorter as the number of jobs increases. If the interval of time is shorter than that required to perform a particular job, the system needs either to ~e (a) distributed or (b) ~o increase the processing speed. The latter case is technically more difficult because of the inherent characteristics of the hàrdware and will be expensive even if it can be realized.
(6) The specification of the ~/C and D/C vary depending on the kind of automotive vehicle and internal combustion engine. Both systems may change simultaneously or may change independently of each other because of the complete separation of function. For example, if the E/C
has three specifications and the D/C has four specifications, the centralized system will have twelve specifications (3x4=12). It is generally cost effective in terms of hardware to construct a single integral system.
However, it is more expensive in terms of software to construct an integrated system since the logical requirements are . multiplied. Therefore, it is disadvantageous due to the need to facilitate specification modifications to centralize the E/C and D/C systems. Thus, the E/C and D/C system~ use separate microcomputers so as to operate independently of each other.
Fig. 1 will be discussed in greater detail later.
The system configuration of the E/C system 1000 is illustrated in Fig. 2(A), and 2(B).
The E/C system is applied to a four-cycle, six-cylinder engine. The engine operating parameter controlsignal include:
(1) a fuel injection rate control signal 110 for controlling an opening interval and start timing for whlch injection valves 10 in each engine cylinder are opened in order to inject fuel into the engine;
(2) an ignition control signal 1~0 (IGN) for controlling the intermittent current flow through a primary winding 21 of the ignition coil 20;
(3) an exhaust gas recirculation control signal 130 (EGR) for controlling the position of an EGR
valve 30 by means of a regulated vacuum pressure via a vacuum control modulation (VCM) valve 40; and (4) an engine idling rotational speed control signal 150 (ISC) for controlling the position of an A~C
valve (Auxlliary Air Control Valve) 50 by means of a regulated vacuum pressure via a vacuum control modulation (VCM) valve 40 so as to regulate the air flow through an auxiliary passage bypassing a throttle valve 510.
(5) an on-and-off control signal 160 (F/P) for controlling a fuel pump 530 via a fuel pump relay 60;
(6) an output 170 ~FCM) representing fuel consumption data for a fuel consumption gage 70;
has three specifications and the D/C has four specifications, the centralized system will have twelve specifications (3x4=12). It is generally cost effective in terms of hardware to construct a single integral system.
However, it is more expensive in terms of software to construct an integrated system since the logical requirements are . multiplied. Therefore, it is disadvantageous due to the need to facilitate specification modifications to centralize the E/C and D/C systems. Thus, the E/C and D/C system~ use separate microcomputers so as to operate independently of each other.
Fig. 1 will be discussed in greater detail later.
The system configuration of the E/C system 1000 is illustrated in Fig. 2(A), and 2(B).
The E/C system is applied to a four-cycle, six-cylinder engine. The engine operating parameter controlsignal include:
(1) a fuel injection rate control signal 110 for controlling an opening interval and start timing for whlch injection valves 10 in each engine cylinder are opened in order to inject fuel into the engine;
(2) an ignition control signal 1~0 (IGN) for controlling the intermittent current flow through a primary winding 21 of the ignition coil 20;
(3) an exhaust gas recirculation control signal 130 (EGR) for controlling the position of an EGR
valve 30 by means of a regulated vacuum pressure via a vacuum control modulation (VCM) valve 40; and (4) an engine idling rotational speed control signal 150 (ISC) for controlling the position of an A~C
valve (Auxlliary Air Control Valve) 50 by means of a regulated vacuum pressure via a vacuum control modulation (VCM) valve 40 so as to regulate the air flow through an auxiliary passage bypassing a throttle valve 510.
(5) an on-and-off control signal 160 (F/P) for controlling a fuel pump 530 via a fuel pump relay 60;
(6) an output 170 ~FCM) representing fuel consumption data for a fuel consumption gage 70;
(7) self-diagnosis of the E/C system and data exchange (CHECK) with a checker 2000 and vehicle driving information system, i.e., D/C 2500, respectively;
(8) an output 180 ~ALARM) to alarm lamp 80 according to the results of self-diagnosis;
(9) a display signal (see Fig. 3(C)) (MONITOR) o the diagnostic result on a display 1900;
The input data of the E/C system 1000 listed hereinbelow are received from various portions of the vehicle as follows:
~g~236 (l) a REF signal 201 which goes high whenever the engine rotates through a 120 and is produced by a crank angle sensor 200, e.g., in~talled within a distributor 520 which detects the rotation of the crankshaft of the engine;
(2) A POS signal 202 which has a pulsewidth corresponding to a 1 of the crankshaft rotation;
(3) an intake airflow rate sensor (AFM) signal 211 from an air flow meter 210 which detects the rate of air flow Qa into the engine (the air flow rate Qa is inversely proportional to the voltage level of the ~FM
signal);
(4) an oxygen concentration (2) signal 221 generated by an oxygen sensor 220, which varies depending on the oxygen concentration within the exhaust gas;
(5). a voltage signal (Tw) 231 representing the temperature of the engine from a water temperature sensor - 230;
(6) DC supply voltage 242 to be supplied to both control systems from a vehicle battery 240;
(7) a battery voltage signal 241 (VB) via relay 540 which reflects varia~ions in battery supply voltage for use in correcting fuel injection rate (it should be noted that since the ON terminal of the ignition switch 260 also receives the battery voltage when the ignition switch is in the START position, the battery voltage supply 241 is supplied to the control unit 1000 during engine cranking);
_ 9 _ (8) a vehicle speed signal (VsP) 251 having a period in proportion to the vehicle speed;
(9) an engine start signal (START) 261 which informs the control unit 1000 of engine cranking when the ignition switch 260 is turned to the START position so as to start the engine, (lO) An on/of (IDLE) signal 271 which detects the closing~opening of a throttle valve switch 270 adjacent to the throttle valve 510;
(ll) an air conditioner power-on signal (A/C) 281 which informs the control unit 1000 that the air conditioner is in operation; and (12) a neutral switch signal (NEUT) 291 from a neutral swltch 290 which is closed when a gear lever of a transmission in a neutral position or parking posit~on.
Figs. 3(A), 3(B), and 9(C) show the internal circuit configuration of the control unit (E/C) lO00.
In Fig. 3(A~, numeral llO0 denotes a signal shaping circuit which receives various input signals rom the engine and from various vehicle elements and shapes these input signal waveforms so as to attenua~e noise components and damp surges in these input signals, thereby protecting the control unit lO00 from erroneous operation and destruction and to amplify and convert various input signals for correct operation of an input interface circuit 1200. The input interface circuit 1200 converts various input signals shaped by the signal shaping circuit llO0 ~4Z3~;
into digital bit signals and counts the number of pulses thereof or a predetermined period of time so that bit-coded signals (bit-parallel, byte-serial) are produced and temporarily stored within one of the registers provided therewithin. The CPU 1300 operates in synchronization with a clock signal based on an oscillation signal 1311 from a quartz oscillator 1310 and is connected to the other circuit blocks via a common Bus 1320. The program stored within a mask ROM 1410 and programmable ROM 1420 of a memor~ unit 1400 is executed so as to read input data from each register, perform specified arithmetic operations on the basis of the input data, and send out the output data at a specified timing. The memory unit 1400 is used for storing the data comprising the mask ROM 1410, programmable ROM 1420, random access memory RAM 1430, and auxiliary memory 1440. The mask ROM 1410 is manufactured with a series of program steps assembled thereinto to be executed by the CPU 1300 and permanent data to be used when the CPU
1300 executes the program. Programs and data similar to that stored in the mask ROM 1410 are held in the programmable ROM 1420 which is easier to modify according to the kind of vehicle and engine. The RAM 1430 is a memory device which can temporarily hold intermediate data from the CPU 1300 during arithmetic operations or result data to be sent out at an output interface circuit 1500. The contents of the RAM 1430 is volatile and erased when the ignition switch 260 is turned off and the main power supply 241 is interrupted. The contents of auxiliary memory unit 1440 is nonvolatile and not erased even when the ignition switch 260 is turned off, i.e., the engine is not operating.
Numeral 1350 denotes an arithmetic timer circuit which reinforces the function of the CPU 1300 having a multiplying circuit for high-speed arithmetic processing, an interval timer which sends an interrupt signal to the CPU 1300 to interrupt the program being executed whenever a predetermined interval of time has passed, and a free-running counter for indicating to the CPU 1300 the elapsed time from a predetermined event to a subsequent event and af the time of occurrence of an event. The output interface circuit 1500 receives the ou~put data from the CPU 1300 at one of the output registers provided therewithin, produces a pulse signal having a predetermined frequency and duty cycle in response to the output value from the CPU 1300, and sends a command signal to an actuating circuitry 1600 in a form of a binar~ switching signal. The actuating circuit 1600 comprises a power amplifier which amplifies voltage or current upon receipt of the output interface circuit 1500, drives various actuators and displays, diagnoses the control unit 1000 via the connector 2010, and sends an output signal to the checker 2000 for displaying the diagnostic result.
Numeral 1800 denotes a power supply circuit which supplies a constant voltage (Vcc) of five volts to the 3~i input interface circuit 1200, central processing unit 1300, memory unit 1400, output interface circuit 1500, and arithmetic timer circuit 1350. The power supply circuit 1800 also distributes an ignition switch on/off (IGNSW) signal 1830 into the input interface circuit 1200, reset signal (RESET) 1840 into the Bus 1320, halt signal (HALT) 1850 which stops the operation of the CPU 1300, a constant eight-volt (AVcc) signal 1860 for A/D conversion, and a constant voltage ~VADD) 1870 for the signal shaping circuit 1100 and actuating circuitry 1600. The power supply circuit 1800 also supplies a constant five-volt voltage (VDM) 1880 to the auxiliary memory unit 1440.
Next, Fig. 4 is a system block diagram of the D/C
system 2500.
The D/C system 2500 inputs a plurality of vehicle driving data from various sensors installed separately within the vehicle, arithmetically calculates such basic vehicle data to obtain necessary vehicle driving information, displays the measured result on a display unit 2550 having a switchable display and an e~clusive display.
The D/C system 2500 also performs a radio automatic selection of a broadcasting station, alarm control using an alarm function.
In Fig. 4, numeral 2520 denotes an input unit through which an operator can input additional inormation about the particular vehicle into the D/C 2500, comprising~
e.g., a keyboard. The input unit 2520 can also be 3~i connected to the E/C 1000 or other devices.
The D/C 2500 shown by Fig. 5 has the following functions:
(1) Radio broadcasting program scheduling...
the input unit 2520 inputs a desired time and broadcasting station into the D/C 2500, the D/C 2500 compares the contents of stored time with the present time (inputted from a clock) and outputs a control command signal to the radio (including the POWER ON signal) so as to turn on the radio and select the desired station when the two times match. The display unit 2550 has a clock display which displays stored time and broadcasting station in units~of hour and minutes and in unit of kHz.
(2) Alarm...with the desired time stored in the same form as described in (1), a buzzing sound is produced when the time is up, i.e., when the present time agrees with the stored time. The display unit 2550 can display the stored time of the alarm in response to a command by the CPU to the D/C system 2500.
(3) Trip meter.... The distance that the vehicle has travelled totally is measured on the basis of the output of a vehicle running distance sensor~ The display unit 2550 can be switched to display the distance of a single current trip. The measurement of the trip distance ; 25 is started when a clear switch of the keyboard 2520 is pushed.
(4) Navigation meter...When average vehicle 23~
speed Vs is entered through the keyboard 2520, the distance of travel D from the trip meter and elapsed time T over the current trip are measured so that an actual average vehicle speed (~/T), the difference between the estimated elapsed time based on estimate Vs and the elapsed time T of the current trip (D/Vs-T), the difference between the actual distance o the current trip D from the estimated distance of travel (D-Vs/T) are distinguishably displayed through the display unit 2550.
- (S) Fuel consumption...... Fuel quantity consumed during the current trip is displayed on the screen. The measurement of the fuel consumption is started when the clear switch on the keyboard is pushed.
t6) A fuel consumption rate meteringO..A fuel efficiency value indicating the fuel consumption with respect to the trip distance is periodically calculated and displayed.
(7) SpePdometer...The vehicle speed is measured and displayed periodically on an exclusive display within the display unit 2550.
t8) Odometer...The total distance the vehicle has travelled is measured and displayed on an exclusive display which is standard, original equipment in all automotive vehicles. The measured result cannot be reset.
(9) Vehicle range.... The remaining fuel in the fuel tank is measured and multiplied by the fuel consumption rate described in (6) to pruduce an estimate of Z3~i the distance the vehicle could travel on the remaining fuel,
The input data of the E/C system 1000 listed hereinbelow are received from various portions of the vehicle as follows:
~g~236 (l) a REF signal 201 which goes high whenever the engine rotates through a 120 and is produced by a crank angle sensor 200, e.g., in~talled within a distributor 520 which detects the rotation of the crankshaft of the engine;
(2) A POS signal 202 which has a pulsewidth corresponding to a 1 of the crankshaft rotation;
(3) an intake airflow rate sensor (AFM) signal 211 from an air flow meter 210 which detects the rate of air flow Qa into the engine (the air flow rate Qa is inversely proportional to the voltage level of the ~FM
signal);
(4) an oxygen concentration (2) signal 221 generated by an oxygen sensor 220, which varies depending on the oxygen concentration within the exhaust gas;
(5). a voltage signal (Tw) 231 representing the temperature of the engine from a water temperature sensor - 230;
(6) DC supply voltage 242 to be supplied to both control systems from a vehicle battery 240;
(7) a battery voltage signal 241 (VB) via relay 540 which reflects varia~ions in battery supply voltage for use in correcting fuel injection rate (it should be noted that since the ON terminal of the ignition switch 260 also receives the battery voltage when the ignition switch is in the START position, the battery voltage supply 241 is supplied to the control unit 1000 during engine cranking);
_ 9 _ (8) a vehicle speed signal (VsP) 251 having a period in proportion to the vehicle speed;
(9) an engine start signal (START) 261 which informs the control unit 1000 of engine cranking when the ignition switch 260 is turned to the START position so as to start the engine, (lO) An on/of (IDLE) signal 271 which detects the closing~opening of a throttle valve switch 270 adjacent to the throttle valve 510;
(ll) an air conditioner power-on signal (A/C) 281 which informs the control unit 1000 that the air conditioner is in operation; and (12) a neutral switch signal (NEUT) 291 from a neutral swltch 290 which is closed when a gear lever of a transmission in a neutral position or parking posit~on.
Figs. 3(A), 3(B), and 9(C) show the internal circuit configuration of the control unit (E/C) lO00.
In Fig. 3(A~, numeral llO0 denotes a signal shaping circuit which receives various input signals rom the engine and from various vehicle elements and shapes these input signal waveforms so as to attenua~e noise components and damp surges in these input signals, thereby protecting the control unit lO00 from erroneous operation and destruction and to amplify and convert various input signals for correct operation of an input interface circuit 1200. The input interface circuit 1200 converts various input signals shaped by the signal shaping circuit llO0 ~4Z3~;
into digital bit signals and counts the number of pulses thereof or a predetermined period of time so that bit-coded signals (bit-parallel, byte-serial) are produced and temporarily stored within one of the registers provided therewithin. The CPU 1300 operates in synchronization with a clock signal based on an oscillation signal 1311 from a quartz oscillator 1310 and is connected to the other circuit blocks via a common Bus 1320. The program stored within a mask ROM 1410 and programmable ROM 1420 of a memor~ unit 1400 is executed so as to read input data from each register, perform specified arithmetic operations on the basis of the input data, and send out the output data at a specified timing. The memory unit 1400 is used for storing the data comprising the mask ROM 1410, programmable ROM 1420, random access memory RAM 1430, and auxiliary memory 1440. The mask ROM 1410 is manufactured with a series of program steps assembled thereinto to be executed by the CPU 1300 and permanent data to be used when the CPU
1300 executes the program. Programs and data similar to that stored in the mask ROM 1410 are held in the programmable ROM 1420 which is easier to modify according to the kind of vehicle and engine. The RAM 1430 is a memory device which can temporarily hold intermediate data from the CPU 1300 during arithmetic operations or result data to be sent out at an output interface circuit 1500. The contents of the RAM 1430 is volatile and erased when the ignition switch 260 is turned off and the main power supply 241 is interrupted. The contents of auxiliary memory unit 1440 is nonvolatile and not erased even when the ignition switch 260 is turned off, i.e., the engine is not operating.
Numeral 1350 denotes an arithmetic timer circuit which reinforces the function of the CPU 1300 having a multiplying circuit for high-speed arithmetic processing, an interval timer which sends an interrupt signal to the CPU 1300 to interrupt the program being executed whenever a predetermined interval of time has passed, and a free-running counter for indicating to the CPU 1300 the elapsed time from a predetermined event to a subsequent event and af the time of occurrence of an event. The output interface circuit 1500 receives the ou~put data from the CPU 1300 at one of the output registers provided therewithin, produces a pulse signal having a predetermined frequency and duty cycle in response to the output value from the CPU 1300, and sends a command signal to an actuating circuitry 1600 in a form of a binar~ switching signal. The actuating circuit 1600 comprises a power amplifier which amplifies voltage or current upon receipt of the output interface circuit 1500, drives various actuators and displays, diagnoses the control unit 1000 via the connector 2010, and sends an output signal to the checker 2000 for displaying the diagnostic result.
Numeral 1800 denotes a power supply circuit which supplies a constant voltage (Vcc) of five volts to the 3~i input interface circuit 1200, central processing unit 1300, memory unit 1400, output interface circuit 1500, and arithmetic timer circuit 1350. The power supply circuit 1800 also distributes an ignition switch on/off (IGNSW) signal 1830 into the input interface circuit 1200, reset signal (RESET) 1840 into the Bus 1320, halt signal (HALT) 1850 which stops the operation of the CPU 1300, a constant eight-volt (AVcc) signal 1860 for A/D conversion, and a constant voltage ~VADD) 1870 for the signal shaping circuit 1100 and actuating circuitry 1600. The power supply circuit 1800 also supplies a constant five-volt voltage (VDM) 1880 to the auxiliary memory unit 1440.
Next, Fig. 4 is a system block diagram of the D/C
system 2500.
The D/C system 2500 inputs a plurality of vehicle driving data from various sensors installed separately within the vehicle, arithmetically calculates such basic vehicle data to obtain necessary vehicle driving information, displays the measured result on a display unit 2550 having a switchable display and an e~clusive display.
The D/C system 2500 also performs a radio automatic selection of a broadcasting station, alarm control using an alarm function.
In Fig. 4, numeral 2520 denotes an input unit through which an operator can input additional inormation about the particular vehicle into the D/C 2500, comprising~
e.g., a keyboard. The input unit 2520 can also be 3~i connected to the E/C 1000 or other devices.
The D/C 2500 shown by Fig. 5 has the following functions:
(1) Radio broadcasting program scheduling...
the input unit 2520 inputs a desired time and broadcasting station into the D/C 2500, the D/C 2500 compares the contents of stored time with the present time (inputted from a clock) and outputs a control command signal to the radio (including the POWER ON signal) so as to turn on the radio and select the desired station when the two times match. The display unit 2550 has a clock display which displays stored time and broadcasting station in units~of hour and minutes and in unit of kHz.
(2) Alarm...with the desired time stored in the same form as described in (1), a buzzing sound is produced when the time is up, i.e., when the present time agrees with the stored time. The display unit 2550 can display the stored time of the alarm in response to a command by the CPU to the D/C system 2500.
(3) Trip meter.... The distance that the vehicle has travelled totally is measured on the basis of the output of a vehicle running distance sensor~ The display unit 2550 can be switched to display the distance of a single current trip. The measurement of the trip distance ; 25 is started when a clear switch of the keyboard 2520 is pushed.
(4) Navigation meter...When average vehicle 23~
speed Vs is entered through the keyboard 2520, the distance of travel D from the trip meter and elapsed time T over the current trip are measured so that an actual average vehicle speed (~/T), the difference between the estimated elapsed time based on estimate Vs and the elapsed time T of the current trip (D/Vs-T), the difference between the actual distance o the current trip D from the estimated distance of travel (D-Vs/T) are distinguishably displayed through the display unit 2550.
- (S) Fuel consumption...... Fuel quantity consumed during the current trip is displayed on the screen. The measurement of the fuel consumption is started when the clear switch on the keyboard is pushed.
t6) A fuel consumption rate meteringO..A fuel efficiency value indicating the fuel consumption with respect to the trip distance is periodically calculated and displayed.
(7) SpePdometer...The vehicle speed is measured and displayed periodically on an exclusive display within the display unit 2550.
t8) Odometer...The total distance the vehicle has travelled is measured and displayed on an exclusive display which is standard, original equipment in all automotive vehicles. The measured result cannot be reset.
(9) Vehicle range.... The remaining fuel in the fuel tank is measured and multiplied by the fuel consumption rate described in (6) to pruduce an estimate of Z3~i the distance the vehicle could travel on the remaining fuel,
(10) Tachometer...The number of engine revolutions per unit of time is measured and displayed on the display unit 2550.
(11) Others...Arbitrary numbers can be stored and displayed on a memo pad and addition, subtraction, multiplicationJ and division can be performed as electronic calculator.
- Various auxiliary and input devices of D~C system 2500 are listed hereinbelow.
(1) Clock...A source of clock signals which also outputs current time data in a serial pulse train.
(2) Distance Sensor...A sensor which outputs one pulse whenever the vehicle travels a predetermined distance. The pulse is obtained by an electromagnet which rotates according to the rotation of a drive shaft.
(3) Fuel consumption sensor...The fuel consumption sensor outputs a pulse whenever a predetermined amount of fuel is consumed in the engine. In other words, a ~ulse is outputted whenever the total amount of injected fuel obtained by summing the injection time of the fuel injection valves in the EGI control section of the É/C
system 1000 arrives at a predetermined value.
(4) Radio equipment (Electronic tuner type).... A
radio system wherein a power switch, an AM/FM switch, and an automatic tuning circuit are enabled by means of external electrical signals.
(5) Alarm Buzzer...Standard equipment.
~6) Remaining fuel amount sensor.... An ordinary fuel gage (described hereinafter).
(7) Engine revolution sensor........ The engine revolutions per time can be detected through ignition pulses or a crankshaft rotation sensors.
(8) Display unit 2550...The vehicle speed meter is a three-digit digital display for e~clusively exhibiting the current vehicle speed, having three 7-segment display elements of dynamic drive type. The odometer is a seven-digit di~ital display for exclusively exhibiting the total distance of travel, having seven 7-segment display elements of dynamic drive type. The switchable display can exhibit lS various current data (1) through (6), (9), and (10) listed hereinabove with different unit display elements, e.g., hour, Km, etc.
(9) Keyboard (input unit) 2520...A push~button pads with keys for both display commands and data input.
The main feature of the present invention is that within a digital multiple microcomputer system for an automotive vehicle a normally operating system, i.e., either the E/C
or D/C system, backs up a partner system when the latter malfunctions, i.e., the normal system executes a main control operation in place thereof to enable the vehicle to run safely for at least some minimal distance sufficient to obtain service.
3~
Since such E/C and D/C systems are usually manuEactured with an empty memory space provided in order to cope with later functional extensions or simply due to mass production considerations. Therefore, there will usually be some extra unused memory area which can be used to store an interrupt program. Although neither the E/C
nor D/C system can fully back the other system up, it is possible to alternatively execute the crucial functions of the other system at a reduced cost.
Although both systems perform complicated control jobs, relatively few functions are required to enable the vehicle to continue to a service station or repairing factory. In this case, other control capabilities may be reduced. Control functions necessary for maintaining the vehicle in the running state include, e.g., in the case of the E/C system 1000, fuel injection, ignition, and fuel pump actuation and in the case of the D/C system 2500, the speedometer (S/M) for indicating the vehicle speed and the odometer for indicating the history of vehicle travel.
The detailed description of the present invention is made hereinafter with reference to Fig. 1.
A signal denoted by 1041 is a pulse signal outputted when the E/C system 1000 operates normally and has a frequency (period) within a predetermined range. The pulse signal 1041 is outputted from the E/C s~stem 1000 via the output interface thereof by an interrup~ routine executed at predetermined intervals. The pulse signal 1041 is outputted from the E/C system 1000 ~ia the output inter-face thereof after confirming the end of execution of the interrupt routine. A read or write signal outputted from the CPU 1300 into the Bus 1320 can also be used as -the pulse signal 1041. Such a pulse signal 1041 described above is incorporated in United Kingdom patent application GB 2,035,633A
published on June 1~, 1980, and having as named inventors, Toshimi Abo and Akio Hosaka. The D1C 2500 checks to see iE
the E/C system 1000 is operating normally on the basis of reception of the pulse signal 1041. Similarly, the E/C
system 1000 checks to see if the D/C sys~em is operating normally on the basis of reception of another pulse signal denoted by 2540 which has the same ~unction as described above (1041).
The D/C system 2500 normally receives various input signals, per~orms various arithmetic and logic operations according to various series of instructions stored therewithin, and outputs various command signals according to the arithmetic and logic operation results. At the same time, the D/C system 2500 accepts the pulse signal 1041 from the E/C system 1000 to detect whether the frequency or period of the pulse signal 1041 is within the predetermined range so as to check the operation of the E/C system 1000.
If the frequency falls within the predetermined range, the D/C system 2500 confirms that the E/C system is operatiny normally. Upon confirmation, the D/C system 2500 does not back up the E/C system 1000 but outputs the usual --~
_~
~
-3&i actuation signals 2542 and 2543 to respective actuating circui.try 2523 and 2524 or the S/M 2527 and 0/M 25280 The D/C system 2500, at this time outputs an "0" signal or ;'1"
signal as normal operation flags to the actuating circuitry 1625 and 1626, in place of the actuation signals 2544 and 2545 for indicating that the D/C system is not performing its back-up functions. Similarly, the E/C system 1000 accepts the pulse signal 2540 from the D/C system 1000 to detect whether the frequency or period of the pulse signal 2540 falls within the predetermined range to monitor the operation of the D/C system 2500.
If the frequency (period) falls within the predetermined ranye, the E/C system 1000 confirms that the D/C system is operating normally. In this cace, the E/C
system 1000 also does not back up the D~C system 2500 but outputs the usual actuation signals 1511 and 1512. The E/C
system 1000 similarly outputs an "0" signal or "1l' signal to the actuating circuits 2523 and 2524 in place of the actuation signals 1548 and 1549.
If either of the pulse signals 1041 or 2540 does not fall within its predetermined range, the appropriate E/C or D~C system initiates marginal control functions necessary for safe operation of the vehicle, in addition to the usual control functions that the system provides or with the part of the usual control functions not necessary for safe operation of the vehicle halted.
The operation of the D/C system 2500 while ~9~ 3~i performing EGI control when the E/C system 1000 fails will be described with reference to Figs. 51A) and 5(B).
The program based on the flowchart shown in Fig. 5(A) is executed whenever the engine crankshaft has rotated through a predetermine~ angle (in the case of the six-cylinder engine, the predetermined crankshaft rotational angle is 120).
In step 401, the D/C system 2500 checks to see whether the E/C system 1000 is malfunctioning as indicated by signal 1041 as described hereinabove. If the DfC system 2500 ascertains that the E/C system 1000 is operating normally, the D/C system 2500 goes to step 402 to disable the output of the actuating signal 2544 and finishes the special routine shown in Fig. 6(A). If the D/C system 2500 determines that the E/C system 1000 is malfunctioning, the D/C system 2500 goes to step 403, wherein the D/C system 2500 increments the value ECYL representing the rotational position of the crankshaft~ In step 404 the E/C system 1000 checks to see if the contents of da~a ECYL is greater than or equal to 3 (ECYL>3). If less than 3, the D/C system 2500 finishes the special routine. If more than 3, program control goes to step 405, wherein the signal 2544 is set to "1" and sent to the actuating circuit 1625 to start the fuel injection through the EGI circuîtry 110.
Su~s~quently, the D/C system 2500 resets the value of ECYL
to "0". In other words, the ECYL is incremented by one whenever the engine has rotated through 120 and the ECYL
3~;
is returned to zero whenever (ECYL)=3 (corresponding to one engine revolution)O Therefore, the signal 2544 is outputted whenever the engine rotates through 360~ Next, in step 40~ the value of TEGI is reset to zero, TEGI being used to count the interval of opening of fuel injection valves 10. In step 408, water temperature data are used to calculate the value TEGIR corresponding to the desired injection duration are via a conventional table loop up~
The program shown in Fig. 5(B) is repeatedly executed at a fixed time interval (e.g., 1 ms). In step 451, the D/C system 2500 checks whether the E/C system 1000 is operating normally. If not, in step 452, the D/C 5y5 tem 2500 checks whether the driving output of EGI 2544 is "1".
If the output 2544 is "0", the l-ms interrupt routine ends since the EGI drive has previously been completed.
On the other hand, if the output 2544 is "1", the D/C system 2500 continues the routines of Fig. 5(B) because fuel injection is in progress. First, in step 453, TEGI is incremented by one. The value of T~GI is reset whenever the fuel injection is started as described hereinbefore and incremented every interrupt period (e g., 1 ms). In step 454, the data of TEGI is compared with the data of TEGIR.
If TEGI>TEGIR, the driving output 2544 is reset to "0" and the D/C system 2500 ends the fuel injection routine. If 2~ TEGI<TEGIR, the fuel injection routine ends directly.
As described hereinabove, if the E/C system 1000 fails, a fuel injection pulse having a period of 1 ms and a 3~
. width corresponding to the engine cooling water temperature is outputted whenever the engine rotates through 360.
Fig. ~ shows a circuit configuration of the actuating circuit 1625.
In Fig. 6, the driving output signal 2544 from the D/C system 2500 is fed into a first capacitor Cl, first resistor Rl, and first diode Dl which togethex constitute a positive-triggered pulse generator which fires at the leading edge of the driving output signal 2544 to turn on an inj-ection valve actuating transistor Tlo On the other hand, the driving output signal 1511 from the E/C system 1000 is fed to a second capacitor C2, second resistor R2, and second diode D2, which together constitute another positive-tr1ggered pulse generator which fires at the leading edge of the driving output signal 1511 to turn on an injection valve actuating transistor Tl.
If the D/C system 2500 outputs a constant driving output 2544, the transistor Tl is actuated only by the driving output 1511 from the E/C system 1000, If the E/C
system 1000 outputs a constant driving output lSll, the transistor Tl is in this case actuated only by the driving output 2544 from the D/C system 2500.
If the E/C system 1000 is operating normally, the driving output signal 1511 from the E/C system 1000 is normally fed to the actuating circuit 1625, with the driving output signal 2544 remaining at either "0" or "1", so as to actuate the transistor Tl. ~uel injection begins 3~
.almost immediately after activation of the transistor T1.
It can be appreciated from the drawing that the EGI output portion 11 having a plurality of fuel injection valves is connected to the collector of the transistor Tl. If the E/C system 1000 fails and thus the driving output signal 1511 is disabled, the driving output signal 2544 from the D/C system 2500 will control the actuating circuit 1625 in place of the driving output signal 1511.
It should be understood that the E/C system 1000 backs up other control and display functions of the defective D/C system 2500 and that the D/C system 2500 backs up other necessary control functions as previously described.
For example, in the ignition control (IGI) lS section, power supply to the ignition coil 200 is interrupted so as to energize one of the plugs whenever the engine rotates through 120. For the speed meter S/M and odometer O/M, the display actuation can be carried out by the E/C system 1000 in place of the defective D/C system 2500. Since the value of speedometer 2527 is calculated on the basis of the period or frequency of the vehicle speed signal 2534 and the value of the odometer i5 also calculated on a basis of the total pulse count of the vehicle speed signal 2534, the back-up programs for the speedometer 2527 and odometer 2528 can be initiated similarly to those shown in Figs. 5(A~ and 5(~). The circuit configuration of the actuating circuits 1626, 2523, ~9~L23~;
and 2524 will be similar to that shown in Fig. 6. If the signals such as intake air Elow quantity signal 21, start switch signal 251, idle switch on signal 271, and so on are also inputted into the D/C system 2500, more precise control of fuel injection can be achieved.
It is understandable that such back-up control can be executed by using extra, vacant memory. Since such back-up control programs perform only critical functions of vehicle operation, such back-up control may be performed with control functions not necessarily required for safe vehicle operation being halted temporarily. Such control functions include functions (3), (4), and (6) through (9) of the control functions of the E/C system 2500.
Non-critical control functions of the D/C system 1000 include (1) through (6), (10), and (11). Either or both of the control systems 1000 and 2500 may interrupt non-critical normal functions in favor of critical back-up functions in accordance with the time requirements of the back-up functions in addition to normal critical functions.
An alternative method of checking to see whether the partner system (either E/C or D/C system) is operating normally is to detect whether one of the output signals from the partner system is normal. For example, the presence or absence of the EGI driving output 1511 from the E/C system 1000 may be determined from its period or frequency in order to monitor the operation of the E/C
system 1000.
- ~5 -3q~;
As described hereinabove, since multiple micro-computer systems with back-up facility for an automotive vehicle according to the present invention back up main functions of the partner system when the latter fails, special backup circuits are not needed and thus the manufacturing cost can be reduced. The contents of bac~ up program can be determined arbitrary so that the-flexibility of back up control is enhanced~
It will fully be understood by those skilled in the art that the foregoing de~cription is in terms of preferred embodiment of the present invention wherein various changes and modifications may be made without departing from the spirits and scope of the present invention, which is to be defined by the appended claims.
- Various auxiliary and input devices of D~C system 2500 are listed hereinbelow.
(1) Clock...A source of clock signals which also outputs current time data in a serial pulse train.
(2) Distance Sensor...A sensor which outputs one pulse whenever the vehicle travels a predetermined distance. The pulse is obtained by an electromagnet which rotates according to the rotation of a drive shaft.
(3) Fuel consumption sensor...The fuel consumption sensor outputs a pulse whenever a predetermined amount of fuel is consumed in the engine. In other words, a ~ulse is outputted whenever the total amount of injected fuel obtained by summing the injection time of the fuel injection valves in the EGI control section of the É/C
system 1000 arrives at a predetermined value.
(4) Radio equipment (Electronic tuner type).... A
radio system wherein a power switch, an AM/FM switch, and an automatic tuning circuit are enabled by means of external electrical signals.
(5) Alarm Buzzer...Standard equipment.
~6) Remaining fuel amount sensor.... An ordinary fuel gage (described hereinafter).
(7) Engine revolution sensor........ The engine revolutions per time can be detected through ignition pulses or a crankshaft rotation sensors.
(8) Display unit 2550...The vehicle speed meter is a three-digit digital display for e~clusively exhibiting the current vehicle speed, having three 7-segment display elements of dynamic drive type. The odometer is a seven-digit di~ital display for exclusively exhibiting the total distance of travel, having seven 7-segment display elements of dynamic drive type. The switchable display can exhibit lS various current data (1) through (6), (9), and (10) listed hereinabove with different unit display elements, e.g., hour, Km, etc.
(9) Keyboard (input unit) 2520...A push~button pads with keys for both display commands and data input.
The main feature of the present invention is that within a digital multiple microcomputer system for an automotive vehicle a normally operating system, i.e., either the E/C
or D/C system, backs up a partner system when the latter malfunctions, i.e., the normal system executes a main control operation in place thereof to enable the vehicle to run safely for at least some minimal distance sufficient to obtain service.
3~
Since such E/C and D/C systems are usually manuEactured with an empty memory space provided in order to cope with later functional extensions or simply due to mass production considerations. Therefore, there will usually be some extra unused memory area which can be used to store an interrupt program. Although neither the E/C
nor D/C system can fully back the other system up, it is possible to alternatively execute the crucial functions of the other system at a reduced cost.
Although both systems perform complicated control jobs, relatively few functions are required to enable the vehicle to continue to a service station or repairing factory. In this case, other control capabilities may be reduced. Control functions necessary for maintaining the vehicle in the running state include, e.g., in the case of the E/C system 1000, fuel injection, ignition, and fuel pump actuation and in the case of the D/C system 2500, the speedometer (S/M) for indicating the vehicle speed and the odometer for indicating the history of vehicle travel.
The detailed description of the present invention is made hereinafter with reference to Fig. 1.
A signal denoted by 1041 is a pulse signal outputted when the E/C system 1000 operates normally and has a frequency (period) within a predetermined range. The pulse signal 1041 is outputted from the E/C s~stem 1000 via the output interface thereof by an interrup~ routine executed at predetermined intervals. The pulse signal 1041 is outputted from the E/C system 1000 ~ia the output inter-face thereof after confirming the end of execution of the interrupt routine. A read or write signal outputted from the CPU 1300 into the Bus 1320 can also be used as -the pulse signal 1041. Such a pulse signal 1041 described above is incorporated in United Kingdom patent application GB 2,035,633A
published on June 1~, 1980, and having as named inventors, Toshimi Abo and Akio Hosaka. The D1C 2500 checks to see iE
the E/C system 1000 is operating normally on the basis of reception of the pulse signal 1041. Similarly, the E/C
system 1000 checks to see if the D/C sys~em is operating normally on the basis of reception of another pulse signal denoted by 2540 which has the same ~unction as described above (1041).
The D/C system 2500 normally receives various input signals, per~orms various arithmetic and logic operations according to various series of instructions stored therewithin, and outputs various command signals according to the arithmetic and logic operation results. At the same time, the D/C system 2500 accepts the pulse signal 1041 from the E/C system 1000 to detect whether the frequency or period of the pulse signal 1041 is within the predetermined range so as to check the operation of the E/C system 1000.
If the frequency falls within the predetermined range, the D/C system 2500 confirms that the E/C system is operatiny normally. Upon confirmation, the D/C system 2500 does not back up the E/C system 1000 but outputs the usual --~
_~
~
-3&i actuation signals 2542 and 2543 to respective actuating circui.try 2523 and 2524 or the S/M 2527 and 0/M 25280 The D/C system 2500, at this time outputs an "0" signal or ;'1"
signal as normal operation flags to the actuating circuitry 1625 and 1626, in place of the actuation signals 2544 and 2545 for indicating that the D/C system is not performing its back-up functions. Similarly, the E/C system 1000 accepts the pulse signal 2540 from the D/C system 1000 to detect whether the frequency or period of the pulse signal 2540 falls within the predetermined range to monitor the operation of the D/C system 2500.
If the frequency (period) falls within the predetermined ranye, the E/C system 1000 confirms that the D/C system is operating normally. In this cace, the E/C
system 1000 also does not back up the D~C system 2500 but outputs the usual actuation signals 1511 and 1512. The E/C
system 1000 similarly outputs an "0" signal or "1l' signal to the actuating circuits 2523 and 2524 in place of the actuation signals 1548 and 1549.
If either of the pulse signals 1041 or 2540 does not fall within its predetermined range, the appropriate E/C or D~C system initiates marginal control functions necessary for safe operation of the vehicle, in addition to the usual control functions that the system provides or with the part of the usual control functions not necessary for safe operation of the vehicle halted.
The operation of the D/C system 2500 while ~9~ 3~i performing EGI control when the E/C system 1000 fails will be described with reference to Figs. 51A) and 5(B).
The program based on the flowchart shown in Fig. 5(A) is executed whenever the engine crankshaft has rotated through a predetermine~ angle (in the case of the six-cylinder engine, the predetermined crankshaft rotational angle is 120).
In step 401, the D/C system 2500 checks to see whether the E/C system 1000 is malfunctioning as indicated by signal 1041 as described hereinabove. If the DfC system 2500 ascertains that the E/C system 1000 is operating normally, the D/C system 2500 goes to step 402 to disable the output of the actuating signal 2544 and finishes the special routine shown in Fig. 6(A). If the D/C system 2500 determines that the E/C system 1000 is malfunctioning, the D/C system 2500 goes to step 403, wherein the D/C system 2500 increments the value ECYL representing the rotational position of the crankshaft~ In step 404 the E/C system 1000 checks to see if the contents of da~a ECYL is greater than or equal to 3 (ECYL>3). If less than 3, the D/C system 2500 finishes the special routine. If more than 3, program control goes to step 405, wherein the signal 2544 is set to "1" and sent to the actuating circuit 1625 to start the fuel injection through the EGI circuîtry 110.
Su~s~quently, the D/C system 2500 resets the value of ECYL
to "0". In other words, the ECYL is incremented by one whenever the engine has rotated through 120 and the ECYL
3~;
is returned to zero whenever (ECYL)=3 (corresponding to one engine revolution)O Therefore, the signal 2544 is outputted whenever the engine rotates through 360~ Next, in step 40~ the value of TEGI is reset to zero, TEGI being used to count the interval of opening of fuel injection valves 10. In step 408, water temperature data are used to calculate the value TEGIR corresponding to the desired injection duration are via a conventional table loop up~
The program shown in Fig. 5(B) is repeatedly executed at a fixed time interval (e.g., 1 ms). In step 451, the D/C system 2500 checks whether the E/C system 1000 is operating normally. If not, in step 452, the D/C 5y5 tem 2500 checks whether the driving output of EGI 2544 is "1".
If the output 2544 is "0", the l-ms interrupt routine ends since the EGI drive has previously been completed.
On the other hand, if the output 2544 is "1", the D/C system 2500 continues the routines of Fig. 5(B) because fuel injection is in progress. First, in step 453, TEGI is incremented by one. The value of T~GI is reset whenever the fuel injection is started as described hereinbefore and incremented every interrupt period (e g., 1 ms). In step 454, the data of TEGI is compared with the data of TEGIR.
If TEGI>TEGIR, the driving output 2544 is reset to "0" and the D/C system 2500 ends the fuel injection routine. If 2~ TEGI<TEGIR, the fuel injection routine ends directly.
As described hereinabove, if the E/C system 1000 fails, a fuel injection pulse having a period of 1 ms and a 3~
. width corresponding to the engine cooling water temperature is outputted whenever the engine rotates through 360.
Fig. ~ shows a circuit configuration of the actuating circuit 1625.
In Fig. 6, the driving output signal 2544 from the D/C system 2500 is fed into a first capacitor Cl, first resistor Rl, and first diode Dl which togethex constitute a positive-triggered pulse generator which fires at the leading edge of the driving output signal 2544 to turn on an inj-ection valve actuating transistor Tlo On the other hand, the driving output signal 1511 from the E/C system 1000 is fed to a second capacitor C2, second resistor R2, and second diode D2, which together constitute another positive-tr1ggered pulse generator which fires at the leading edge of the driving output signal 1511 to turn on an injection valve actuating transistor Tl.
If the D/C system 2500 outputs a constant driving output 2544, the transistor Tl is actuated only by the driving output 1511 from the E/C system 1000, If the E/C
system 1000 outputs a constant driving output lSll, the transistor Tl is in this case actuated only by the driving output 2544 from the D/C system 2500.
If the E/C system 1000 is operating normally, the driving output signal 1511 from the E/C system 1000 is normally fed to the actuating circuit 1625, with the driving output signal 2544 remaining at either "0" or "1", so as to actuate the transistor Tl. ~uel injection begins 3~
.almost immediately after activation of the transistor T1.
It can be appreciated from the drawing that the EGI output portion 11 having a plurality of fuel injection valves is connected to the collector of the transistor Tl. If the E/C system 1000 fails and thus the driving output signal 1511 is disabled, the driving output signal 2544 from the D/C system 2500 will control the actuating circuit 1625 in place of the driving output signal 1511.
It should be understood that the E/C system 1000 backs up other control and display functions of the defective D/C system 2500 and that the D/C system 2500 backs up other necessary control functions as previously described.
For example, in the ignition control (IGI) lS section, power supply to the ignition coil 200 is interrupted so as to energize one of the plugs whenever the engine rotates through 120. For the speed meter S/M and odometer O/M, the display actuation can be carried out by the E/C system 1000 in place of the defective D/C system 2500. Since the value of speedometer 2527 is calculated on the basis of the period or frequency of the vehicle speed signal 2534 and the value of the odometer i5 also calculated on a basis of the total pulse count of the vehicle speed signal 2534, the back-up programs for the speedometer 2527 and odometer 2528 can be initiated similarly to those shown in Figs. 5(A~ and 5(~). The circuit configuration of the actuating circuits 1626, 2523, ~9~L23~;
and 2524 will be similar to that shown in Fig. 6. If the signals such as intake air Elow quantity signal 21, start switch signal 251, idle switch on signal 271, and so on are also inputted into the D/C system 2500, more precise control of fuel injection can be achieved.
It is understandable that such back-up control can be executed by using extra, vacant memory. Since such back-up control programs perform only critical functions of vehicle operation, such back-up control may be performed with control functions not necessarily required for safe vehicle operation being halted temporarily. Such control functions include functions (3), (4), and (6) through (9) of the control functions of the E/C system 2500.
Non-critical control functions of the D/C system 1000 include (1) through (6), (10), and (11). Either or both of the control systems 1000 and 2500 may interrupt non-critical normal functions in favor of critical back-up functions in accordance with the time requirements of the back-up functions in addition to normal critical functions.
An alternative method of checking to see whether the partner system (either E/C or D/C system) is operating normally is to detect whether one of the output signals from the partner system is normal. For example, the presence or absence of the EGI driving output 1511 from the E/C system 1000 may be determined from its period or frequency in order to monitor the operation of the E/C
system 1000.
- ~5 -3q~;
As described hereinabove, since multiple micro-computer systems with back-up facility for an automotive vehicle according to the present invention back up main functions of the partner system when the latter fails, special backup circuits are not needed and thus the manufacturing cost can be reduced. The contents of bac~ up program can be determined arbitrary so that the-flexibility of back up control is enhanced~
It will fully be understood by those skilled in the art that the foregoing de~cription is in terms of preferred embodiment of the present invention wherein various changes and modifications may be made without departing from the spirits and scope of the present invention, which is to be defined by the appended claims.
Claims (5)
1. An electronic data processing system mounted in an automotive vehicle, comprising:
(a) a first microcomputer for performing primary control over primary engine functions including fuel injection start and duration, ignition timing, and fuel pump energization, and for performing control over secondary engine functions;
(b) a second microcomputer for primarily performing control over primary indications including speedometer and odometer indications and for performing control over secondary vehicle driving indications;
(c) first means provided within each of said first and second microcomputers for delivering a signal indicating whether the microcomputer is operating properly;
(d) second means provided within each of said first and second microcomputers and responsive to the signal from said first means of the other of said first and second microcomputers for determining whether this other micro-computer is functioning properly; and (e) third means provided within each of said first and second microcomputers and responsive to the determination of said second means of the corresponding microcomputer that the other of said first and second micro-computers is malfunctioning for performing the primary function or indication control of the other microcomputer which is determined to be malfunctioning together with the own duties of said corresponding microcomputer.
(a) a first microcomputer for performing primary control over primary engine functions including fuel injection start and duration, ignition timing, and fuel pump energization, and for performing control over secondary engine functions;
(b) a second microcomputer for primarily performing control over primary indications including speedometer and odometer indications and for performing control over secondary vehicle driving indications;
(c) first means provided within each of said first and second microcomputers for delivering a signal indicating whether the microcomputer is operating properly;
(d) second means provided within each of said first and second microcomputers and responsive to the signal from said first means of the other of said first and second microcomputers for determining whether this other micro-computer is functioning properly; and (e) third means provided within each of said first and second microcomputers and responsive to the determination of said second means of the corresponding microcomputer that the other of said first and second micro-computers is malfunctioning for performing the primary function or indication control of the other microcomputer which is determined to be malfunctioning together with the own duties of said corresponding microcomputer.
2. The system of claim 1, wherein said third means of each of said first and second microcomputers comprise means for executing the primary function or indi-cation control of the other malfunctioning microcomputer while interrupting the secondary function or indication control.
3. A method of ensuring the operation of an electronic control system for an automotive vehicle in which two microcomputers perform separate vehicle control and/or monitoring functions, comprising the following steps (a) and (b) executed concurrently by each microcomputer;
(a) outputting a first signal indicative of whether the microcomputer is malfunctioning; and (b) monitoring the first signal of the other of said two microcomputers and recognizing whether this other microcomputer is malfunctioning;
said method also comprising the step of (c) performing at least a part of the functions of a first of said two microcomputers through the second of said two microcomputers when said first microcomputer is recognized to be malfunctioning by said second microcomputer.
(a) outputting a first signal indicative of whether the microcomputer is malfunctioning; and (b) monitoring the first signal of the other of said two microcomputers and recognizing whether this other microcomputer is malfunctioning;
said method also comprising the step of (c) performing at least a part of the functions of a first of said two microcomputers through the second of said two microcomputers when said first microcomputer is recognized to be malfunctioning by said second microcomputer.
4. The method of claim 3, wherein whenever one of said two microcomputers is recognized to be malfunctioning in said step (b), said step (c) comprises assuming through the other of said two microcomputers those functions of the malfunctioning microcomputer which are essential for a con-tinued, safe operation of the vehicle.
5. The method of claim 3 or 4, wherein each microcomputer executes a control program at intervals which fall within a predetermined range, said step (a) comprising outputting said first signal at the end of the control pro-gram each time this program is executed, and said step (b) comprising recognizing a malfunction of one of said two microcomputers through the other of said two microcomputers by monitoring a period of output of said first signal from the malfunctioning microcomputer and detecting that said period of output of the first signal does not fall within said predetermined range.
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
JP56108091A JPS5810246A (en) | 1981-07-13 | 1981-07-13 | Digital controller for vehicle |
JP56-108091 | 1981-07-13 |
Publications (1)
Publication Number | Publication Date |
---|---|
CA1194236A true CA1194236A (en) | 1985-09-24 |
Family
ID=14475637
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CA000407048A Expired CA1194236A (en) | 1981-07-13 | 1982-07-12 | Multiple microcomputer system with comonitoring/back- up for an automotive vehicle |
Country Status (5)
Country | Link |
---|---|
US (1) | US4532594A (en) |
JP (1) | JPS5810246A (en) |
CA (1) | CA1194236A (en) |
DE (1) | DE3226195A1 (en) |
GB (1) | GB2104247B (en) |
Families Citing this family (97)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
DE3322074A1 (en) * | 1982-07-23 | 1984-01-26 | Robert Bosch Gmbh, 7000 Stuttgart | EMERGENCY DEVICE FOR MICROCOMPUTER CONTROLLED SYSTEMS |
DE3242952A1 (en) * | 1982-11-20 | 1984-05-24 | SWF-Spezialfabrik für Autozubehör Gustav Rau GmbH, 7120 Bietigheim-Bissingen | CALCULATOR, ESPECIALLY ON-BOARD CALCULATOR FOR MOTOR VEHICLES |
JPS59116897A (en) * | 1982-12-23 | 1984-07-05 | 株式会社東芝 | Digital controller |
JPS59214953A (en) * | 1983-05-20 | 1984-12-04 | Olympus Optical Co Ltd | Device for preventing microprocessor from malfunction |
US4556943A (en) * | 1983-05-27 | 1985-12-03 | Allied Corporation | Multiprocessing microprocessor based engine control system for an internal combustion engine |
US4558416A (en) * | 1983-05-27 | 1985-12-10 | Allied Corporation | Method for maintaining the integrity of a dual microprocessor multiprocessing computing system |
DE3331135A1 (en) * | 1983-08-30 | 1985-03-07 | Robert Bosch Gmbh, 7000 Stuttgart | CIRCUIT ARRANGEMENT WITH PARALLEL OPERATION OF MICRO COMPUTERS IN ELECTRONIC SYSTEMS FOR CONTROL AND / OR REGULATION FOR THE OPERATION OF INTERNAL COMBUSTION ENGINES |
FR2553595B1 (en) * | 1983-10-18 | 1986-01-24 | Citroen Sa | IMPROVEMENTS IN OR RELATING TO ELECTRICAL POWER DISTRIBUTION DEVICES INCLUDING MICRO-PROCESSORS |
JPS60178948A (en) * | 1984-02-24 | 1985-09-12 | Honda Motor Co Ltd | Abnormality detecting and displaying device in electronic fuel supply control device for internal-combustion engine |
GB2158613B (en) * | 1984-04-19 | 1987-07-15 | Nissan Motor | Fail-safe circuit for a control system |
JPH0811942B2 (en) * | 1984-07-11 | 1996-02-07 | 株式会社日立製作所 | Engine controller |
DE3429352A1 (en) * | 1984-08-09 | 1986-02-20 | Robert Bosch Gmbh, 7000 Stuttgart | DISPLAY DEVICE FOR DATA AND / OR PARAMETER VALUES IN MOTOR VEHICLES |
JPS6149154A (en) * | 1984-08-15 | 1986-03-11 | Japan Electronic Control Syst Co Ltd | Control device for automobile |
US4671397A (en) * | 1984-11-26 | 1987-06-09 | Fujitsu Limited | Automatic clutch control system |
US4791569A (en) * | 1985-03-18 | 1988-12-13 | Honda Giken Kogyo Kabushiki Kaisha | Electronic control system for internal combustion engines |
JPS61212653A (en) * | 1985-03-18 | 1986-09-20 | Honda Motor Co Ltd | Electronic control device of internal-combustion engine |
GB2172722B (en) * | 1985-03-22 | 1989-06-28 | United Technologies Corp | Backup control system (bucs) |
JPS61275543A (en) * | 1985-05-07 | 1986-12-05 | Honda Motor Co Ltd | Signal transfer method for electronic control device of internal combustion engine |
DE3673578D1 (en) * | 1985-05-09 | 1990-09-27 | Voest Alpine Automotive | MICRO COMPUTER SYSTEM. |
ES8706992A1 (en) * | 1985-09-20 | 1987-07-16 | Mecanismos Aux Ind | An improved central control unit for injection engine-powered vehicles and operating system therefor. |
DE3539407A1 (en) * | 1985-11-07 | 1987-05-14 | Bosch Gmbh Robert | COMPUTER SYSTEM WITH TWO PROCESSORS |
JP2511859B2 (en) * | 1985-11-13 | 1996-07-03 | 株式会社日立製作所 | Fuel injection control device for internal combustion engine |
US4736339A (en) * | 1985-12-16 | 1988-04-05 | Gte Communication Systems Corporation | Circuit for simplex I/O terminal control by duplex processors |
US4979108A (en) * | 1985-12-20 | 1990-12-18 | Ag Communication Systems Corporation | Task synchronization arrangement and method for remote duplex processors |
IT1187870B (en) * | 1986-01-23 | 1987-12-23 | Iveco Fiat | DEVELOPMENT SYSTEM FOR DETECTION, CONTROL AND DIAGNOSTIC EXAMINATION OF THE OPERATING CONDITIONS OF THE COMBUSTION ENGINE IN THE TERNA OF A MOTOR VEHICLE, PARTICULARLY OF AN INDUSTRIAL MOTOR VEHICLE |
JPS62191299A (en) * | 1986-02-17 | 1987-08-21 | Tokyo Keiki Co Ltd | Automatic steering device for ship |
JPS62257239A (en) * | 1986-05-01 | 1987-11-09 | Toyota Central Res & Dev Lab Inc | On-vehicle data transmission system |
JPS62299435A (en) * | 1986-06-19 | 1987-12-26 | Isuzu Motors Ltd | Control device for vehicle with malfunction detecting device |
US4943924A (en) * | 1986-06-27 | 1990-07-24 | Nissan Motor Company, Limited | Trouble checking apparatus |
JPH07105801B2 (en) * | 1986-10-02 | 1995-11-13 | 日本電装株式会社 | Vehicle communication control device |
US5128943A (en) * | 1986-10-24 | 1992-07-07 | United Technologies Corporation | Independent backup mode transfer and mechanism for digital control computers |
US4897184A (en) * | 1986-10-31 | 1990-01-30 | Cobe Laboratories, Inc. | Fluid flow apparatus control and monitoring |
DE3637263C2 (en) * | 1986-11-03 | 1993-10-14 | Bayerische Motoren Werke Ag | Composite electronics |
JP2764397B2 (en) * | 1987-06-12 | 1998-06-11 | 株式会社ゼクセル | Automatic transmission |
US4847830A (en) * | 1987-12-02 | 1989-07-11 | Network Equipment Technologies, Inc. | Method and apparatus for automatic loading of a data set in a node of a communication network |
US4890284A (en) * | 1988-02-22 | 1989-12-26 | United Technologies Corporation | Backup control system (BUCS) |
JP2625148B2 (en) * | 1988-04-11 | 1997-07-02 | 富士重工業株式会社 | In-vehicle electronic control unit |
DE3818007A1 (en) * | 1988-05-27 | 1989-12-07 | Renk Ag | ELECTRONIC CONTROL DEVICE FOR A DRIVE SYSTEM |
DE3825280A1 (en) * | 1988-07-26 | 1990-02-01 | Bayerische Motoren Werke Ag | CONTROL SYSTEM FOR ACTUATING DEVICES OF A MOTOR VEHICLE |
US5086499A (en) * | 1989-05-23 | 1992-02-04 | Aeg Westinghouse Transportation Systems, Inc. | Computer network for real time control with automatic fault identification and by-pass |
JPH03189356A (en) * | 1989-12-20 | 1991-08-19 | Japan Electron Control Syst Co Ltd | Fail safe device for control device for automobile |
JP2768791B2 (en) * | 1990-03-09 | 1998-06-25 | 三菱自動車工業株式会社 | Automotive electronic control unit |
JPH03278238A (en) * | 1990-03-28 | 1991-12-09 | Nec Corp | Mutual hot stand-by system |
DE4021840A1 (en) * | 1990-07-09 | 1992-01-23 | Daimler Benz Ag | MULTIPLE COMPUTER SYSTEM FOR CONTROL AND DIAGNOSTIC DEVICES IN A MOTOR VEHICLE |
JP3165430B2 (en) * | 1990-08-10 | 2001-05-14 | マツダ株式会社 | Multiplex transmission equipment for vehicles |
GB2251499A (en) * | 1991-01-05 | 1992-07-08 | Delco Electronics Corp | Electronic control module. |
DE4113959A1 (en) * | 1991-04-29 | 1992-11-05 | Kloeckner Humboldt Deutz Ag | MONITORING DEVICE |
DE4114999C2 (en) * | 1991-05-08 | 2001-04-26 | Bosch Gmbh Robert | System for controlling a motor vehicle |
DE4117393A1 (en) * | 1991-05-28 | 1992-12-03 | Kloeckner Humboldt Deutz Ag | DEVICE FOR CONTROLLING THE FUEL INJECTION OF AN INTERNAL COMBUSTION ENGINE |
JP2505082B2 (en) * | 1991-12-19 | 1996-06-05 | 哲男 冨山 | Mechanical system with functional redundancy |
JP2907614B2 (en) * | 1991-12-19 | 1999-06-21 | 三田工業株式会社 | Image forming apparatus having function redundant system |
FR2694341B1 (en) * | 1992-07-31 | 1994-10-07 | Robin Centre Est Aeronautique | Power control system, in particular for internal combustion engines of light aircraft. |
US5363317A (en) * | 1992-10-29 | 1994-11-08 | United Technologies Corporation | Engine failure monitor for a multi-engine aircraft having partial engine failure and driveshaft failure detection |
GB2272611A (en) * | 1992-11-05 | 1994-05-18 | Integrated Control Platforms L | Control system for machinery and/or plant apparatus |
JP3111752B2 (en) * | 1993-06-22 | 2000-11-27 | 株式会社日立製作所 | Vehicle control method and control system |
GB2290390B (en) * | 1994-06-18 | 1998-07-08 | Smiths Industries Plc | Electrical systems |
GB9412261D0 (en) * | 1994-06-18 | 1994-08-10 | Smiths Industries Plc | Electrical systems |
US8036788B2 (en) * | 1995-06-07 | 2011-10-11 | Automotive Technologies International, Inc. | Vehicle diagnostic or prognostic message transmission systems and methods |
JP3358412B2 (en) * | 1995-12-04 | 2002-12-16 | トヨタ自動車株式会社 | Vehicle electronic control unit |
GB2308902B (en) * | 1996-01-04 | 2000-03-29 | Motorola Inc | Peripheral module and microprocessor system |
DE19635839A1 (en) * | 1996-09-04 | 1998-03-05 | Teves Gmbh Alfred | Method for testing the component of a system in a motor vehicle |
DE19720618A1 (en) | 1997-05-16 | 1998-11-19 | Itt Mfg Enterprises Inc | Microprocessor system for automotive control systems |
US6117164A (en) * | 1997-06-06 | 2000-09-12 | Dj Orthopedics, Llc | Flexible multijoint therapeutic pads |
JPH11294252A (en) * | 1998-04-13 | 1999-10-26 | Denso Corp | Electronic control device |
US6425092B1 (en) | 1998-06-17 | 2002-07-23 | International Business Machines Corporation | Method and apparatus for preventing thermal failure in a semiconductor device through redundancy |
GB2345153A (en) * | 1998-12-23 | 2000-06-28 | Motorola Ltd | Fault-tolerant microcontroller arrangement, eg for a vehicle braking system |
DE19925758A1 (en) * | 1999-06-05 | 2000-12-07 | Wabco Gmbh & Co Ohg | Gear shift for motor vehicles |
FR2796420B1 (en) * | 1999-07-15 | 2005-08-19 | Renault | INJECTION DEVICE FOR INTERNAL COMBUSTION ENGINE |
DE19947252A1 (en) | 1999-09-30 | 2001-05-03 | Bosch Gmbh Robert | Device and method for controlling a drive unit |
GB2360856B (en) * | 2000-03-30 | 2004-06-23 | Llanelli Radiators Ltd | Intelligent control unit |
DE10036391B4 (en) * | 2000-07-26 | 2010-04-15 | Volkswagen Ag | Vehicle monitoring system |
DE10052552A1 (en) * | 2000-10-23 | 2002-04-25 | Bosch Gmbh Robert | System for controlling vehicle-operating processes interlinks first/second control units to exchange information using the second control unit with a register for storing information already exchanged/waiting to be exchanged. |
JP4399987B2 (en) | 2001-01-25 | 2010-01-20 | 株式会社デンソー | Fail-safe system for vehicle integrated control |
JP4094827B2 (en) * | 2001-05-29 | 2008-06-04 | 矢崎総業株式会社 | Drive control device |
US6948008B2 (en) * | 2002-03-12 | 2005-09-20 | Intel Corporation | System with redundant central management controllers |
US7117390B1 (en) * | 2002-05-20 | 2006-10-03 | Sandia Corporation | Practical, redundant, failure-tolerant, self-reconfiguring embedded system architecture |
JP3960260B2 (en) * | 2002-07-09 | 2007-08-15 | 株式会社デンソー | Engine control system |
JP4225025B2 (en) * | 2002-09-30 | 2009-02-18 | 株式会社デンソー | Integrated vehicle control system |
US7539903B2 (en) * | 2003-06-30 | 2009-05-26 | Siemens Aktiengesellschaft | Method for monitoring the execution of a program by comparing a request with a response and introducing a falsification in a response |
KR100518583B1 (en) * | 2003-07-02 | 2005-10-04 | 삼성전자주식회사 | Semiconductor memory device and method for manufacturing the same |
US7600161B2 (en) * | 2004-08-13 | 2009-10-06 | Gm Global Technology Operations, Inc. | Method of verifying integrity of control module arithmetic logic unit (ALU) |
KR20060053263A (en) * | 2004-10-26 | 2006-05-19 | 베르트질레 슈바이츠 악티엔게젤샤프트 | A diesel engine, in particular a large diesel engine with an electronic control system and a method for starting the diesel engine |
US20060200278A1 (en) * | 2005-03-02 | 2006-09-07 | Honeywell International Inc. | Generic software fault mitigation |
US8436410B2 (en) * | 2005-10-31 | 2013-05-07 | Samsung Electronics Co., Ltd. | Semiconductor devices comprising a plurality of gate structures |
KR100784860B1 (en) * | 2005-10-31 | 2007-12-14 | 삼성전자주식회사 | Nonvalitile memory device and method for fabricating the same |
JP4736828B2 (en) * | 2006-02-03 | 2011-07-27 | 株式会社デンソー | Electronic control unit |
JP4753085B2 (en) * | 2006-10-02 | 2011-08-17 | 株式会社デンソー | Control device for internal combustion engine |
US7634350B2 (en) * | 2006-11-30 | 2009-12-15 | Caterpillar Inc. | Automatic configuration for a secondary engine electronic governor |
US20100125850A1 (en) * | 2008-11-20 | 2010-05-20 | Harold Stevenson Hostettler | Method and Systems for Processing Critical Control System Functions |
DE102008054589B3 (en) * | 2008-12-12 | 2010-08-19 | Thielert Aircraft Engines Gmbh | Engine control system for a jet diesel engine |
US20110023920A1 (en) * | 2009-07-10 | 2011-02-03 | Robert Bolton | Digital walker |
DE102011011755A1 (en) | 2011-02-18 | 2012-08-23 | Conti Temic Microelectronic Gmbh | Semiconductor circuit and method in a safety concept for use in a motor vehicle |
JP6036423B2 (en) * | 2013-03-14 | 2016-11-30 | 株式会社デンソー | Display control apparatus and vehicle display system |
JP7113228B2 (en) * | 2016-08-31 | 2022-08-05 | パナソニックIpマネジメント株式会社 | Vehicle power storage device |
FR3055986B1 (en) | 2016-09-13 | 2018-10-12 | Peugeot Citroen Automobiles Sa | DEVICE FOR CONTROLLING THE RESETTING OF A MOTORCYCLE ELECTRONIC CALCULATOR |
CN109563783B (en) * | 2017-03-31 | 2021-10-01 | 本田技研工业株式会社 | Control device for general-purpose engine |
JP2019101515A (en) | 2017-11-29 | 2019-06-24 | ルネサスエレクトロニクス株式会社 | Semiconductor device and power supply monitoring method therefor |
Family Cites Families (15)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
DE1549397B2 (en) * | 1967-06-16 | 1972-09-14 | Chemische Werke Hüls AG, 4370 Mari | PROCEDURE FOR THE AUTOMATIC CONTROL OF CHEMICAL PLANTS |
GB1412246A (en) * | 1971-09-29 | 1975-10-29 | Kent Automation Systems Ltd | Computer control arrangements |
JPS4875144A (en) * | 1972-01-10 | 1973-10-09 | ||
US3803568A (en) * | 1973-04-06 | 1974-04-09 | Gte Automatic Electric Lab Inc | System clock for electronic communication systems |
JPS525233A (en) * | 1975-07-02 | 1977-01-14 | Hitachi Ltd | Duplex computer system |
JPS5831602B2 (en) * | 1976-02-04 | 1983-07-07 | 株式会社日立製作所 | Dual system control device |
US4358823A (en) * | 1977-03-25 | 1982-11-09 | Trw, Inc. | Double redundant processor |
JPS53148936A (en) * | 1977-06-01 | 1978-12-26 | Hitachi Ltd | Electronic control device |
GB2019622B (en) * | 1978-04-14 | 1982-04-07 | Lucas Industries Ltd | Digital computing apparatus |
JPS5557956A (en) * | 1978-10-25 | 1980-04-30 | Nissan Motor Co Ltd | Malfunction prevention unit of microcomputer |
DE2903639A1 (en) * | 1979-01-31 | 1980-08-14 | Bosch Gmbh Robert | COMPUTER SYSTEM FOR CONTROLLING A DEVICE DEPENDING ON CONTROL SIGNALS |
DE2948784A1 (en) * | 1979-03-08 | 1980-09-18 | Sundstrand Corp | TESTING SYSTEM FOR A DYNAMIC MACHINE |
DD145809A1 (en) * | 1979-09-06 | 1981-01-07 | Stefan Lindner | ARRANGEMENT FOR COUPLING UNITS WITH ERROR DISPLAY SYSTEM |
JPS5682955A (en) * | 1979-12-11 | 1981-07-07 | Toshiba Corp | Multiple computer system |
JPS56135250A (en) * | 1980-03-24 | 1981-10-22 | Nissan Motor Co Ltd | Output device of microcomputer |
-
1981
- 1981-07-13 JP JP56108091A patent/JPS5810246A/en active Granted
-
1982
- 1982-07-09 US US06/396,658 patent/US4532594A/en not_active Expired - Fee Related
- 1982-07-12 CA CA000407048A patent/CA1194236A/en not_active Expired
- 1982-07-13 DE DE19823226195 patent/DE3226195A1/en active Granted
- 1982-07-13 GB GB08220269A patent/GB2104247B/en not_active Expired
Also Published As
Publication number | Publication date |
---|---|
DE3226195C2 (en) | 1988-01-28 |
GB2104247B (en) | 1985-06-12 |
GB2104247A (en) | 1983-03-02 |
JPS629934B2 (en) | 1987-03-03 |
JPS5810246A (en) | 1983-01-20 |
DE3226195A1 (en) | 1983-02-10 |
US4532594A (en) | 1985-07-30 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
CA1194236A (en) | Multiple microcomputer system with comonitoring/back- up for an automotive vehicle | |
US5948026A (en) | Automotive data recorder | |
US4414949A (en) | Apparatus for the control of repetitive events dependent on operating parameters of internal combustion engines | |
US5490064A (en) | Control unit for vehicle and total control system therefor | |
US6240340B1 (en) | Control unit for vehicle and total control system therefor | |
US4271402A (en) | Motor vehicle diagnostic and monitoring device having keep alive memory | |
EP0065221B1 (en) | Internal combustion engine control apparatus | |
US4339801A (en) | Automatic control system for method and apparatus for checking devices of an automotive vehicle in use with a microcomputer | |
US4277772A (en) | Motor vehicle diagnostic and monitoring system | |
JP2507550B2 (en) | Fuel control device | |
JPS5813140A (en) | Electronic engine control device with external adjustment function | |
US4623974A (en) | Method and apparatus for self-monitoring of microcomputer-controlled network devices in particular in motor vehicles | |
USRE31582E (en) | Automatic control system for method and apparatus for checking devices of an automotive vehicle in use with a microcomputer | |
GB2125578A (en) | Self monitoring system | |
GB2125577A (en) | Self monitoring system | |
US6025655A (en) | Control system, particularly for a motor vehicle | |
US6845315B2 (en) | Engine air-intake control device and engine air-intake control method | |
US4328547A (en) | Failure system for internal combustion engine | |
JPH04292545A (en) | Electronic control device for automobile | |
JP2775008B2 (en) | In-vehicle control device | |
US7103459B2 (en) | Vehicular abnormality detecting device | |
JPS5928048A (en) | Self-diagnosis starting system in self diagnosing device for automobile engine control device | |
KR100196352B1 (en) | Obstacle-check control method of car speed sensor installed in diesel engine vehicle | |
JPS5825545A (en) | Electronic device for vehicle | |
JPH06100144B2 (en) | Engine state estimation device |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
MKEX | Expiry |