Electronic control unit

This application is based on and incorporates herein by reference Japanese Patent Application No. 2007-65625 filed on Mar. 14, 2007.

The present invention relates to an electronic control unit that includes a microcomputer and an integrated circuit monitoring the operation of the microcomputer.

Conventional electronic control units for vehicles are provided with functions of monitoring the operation of a microcomputer mounted therein as disclosed in JP 1998-507805A (U.S. Pat. No. 5,880,568) and JP 1999-505587A (U.S. Pat. No. 6,125,322). These electronic control units include a monitoring integrated circuit (IC) in addition to the microcomputer so that queries are transmitted from the monitor IC to the microcomputer. The microcomputer runs a test corresponding to a query from the monitor IC and transmits the result of the test to the monitor IC as a reply. The monitor IC compares the reply from the microcomputer with an expected value within the monitor IC to monitor the operation of the microcomputer.

The monitor IC is constructed to select a query to the microcomputer (that is, a test to be run in the microcomputer) and compare a reply from the microcomputer for the query with an expected value. As a result, the monitor IC needs to have a function to process replies from the microcomputer and a function to select a query, with the result that the construction of the monitor IC is complicated.

Furthermore, since the monitor IC separate from the microcomputer selects a query, it is difficult to achieve an attempt to run a test suitable for a current control mode in the microcomputer, for example. Since the monitor IC cannot recognize control modes of the microcomputer, it is impossible to select a query so that a test suitable for a current control mode is run.

The present invention therefore has an object to provide an electronic control unit that can simplify the function of a monitor IC to monitor the operation of a microcomputer, and readily select tests suitable for control modes.

According to one aspect of the present invention, an electronic control unit comprises a microcomputer and an integrated circuit (IC). The microcomputer performs processing for controlling a control target, and the IC monitors operation of the microcomputer. The microcomputer is programmed to select a test to verify functions of the microcomputer, run the selected test and transmit a test reply as a test result indicating a result of the test to the IC. The IC checks whether the test result transmitted from the microcomputer is correct or incorrect, thus monitoring the microcomputer operation.

The above and other objects, features and advantages of the present invention will become more apparent from the following detailed description made with reference to the accompanying drawings. In the drawings:

FIG. 1 is a block diagram showing an ECU of a first embodiment of the present invention;

FIG. 2 is a schematic diagram illustrating an example of a control function of an MPU;

FIG. 3 is a flowchart showing processing of a verification result check and test selection unit in the MPU of the first embodiment;

FIG. 4 is a flowchart showing test ID selection processing in FIG. 3 ;

FIG. 5 is a flowchart showing test ID selection processing for normal mode in FIG. 4 ;

FIG. 6 is a flowchart showing test ID selection processing for fail-safe mode in FIG. 4 ;

FIG. 7 is a flowchart showing processing of analyzing test result verification results in FIG. 3 ;

FIG. 8 is a flowchart indicating processing of a test result management unit in the MPU of the first embodiment;

FIGS. 9A and 9B are tables showing the rules of creating a test result in an MPU;

FIG. 10 is a flowchart showing processing performed by a test result verification unit of a monitor IC;

FIG. 11 is a flowchart showing test result analysis processing in FIG. 10 ;

FIG. 12 is a table showing the rules of setting an expected value for determining correctness or incorrectness in the monitor IC;

FIG. 13 is a first time chart showing the operation of the ECU of the first embodiment;

FIG. 14 is a second time chart showing the operation of the ECU of the first embodiment;

FIG. 15 is a third time chart showing the operation of the ECU of the first embodiment;

FIG. 16 is a flowchart showing processing of a verification result check and test selection unit in an MPU of a second embodiment of the present invention;

FIG. 17 is a flowchart showing test ID selection processing in FIG. 16 ;

FIG. 18 is a flowchart showing the processing of analyzing a history verification result in FIG. 16 ;

FIG. 19 is a block diagram showing the construction of an ECU of a third embodiment;

FIG. 20 is a flowchart showing the processing of analyzing test result verification results of the third embodiment;

FIG. 21 is a flowchart showing test ID selection processing for normal mode of the third embodiment;

FIG. 22 is a flowchart showing test ID selection processing for fail-safe mode of the third embodiment;

FIG. 23 is a flowchart showing processing of a test result management unit in an MPU of the third embodiment; and

FIG. 24 is a drawing for explaining the rules of creating a test result in the MPU of the third embodiment and the rules of setting an expected value for determining correctness or incorrectness in a monitor IC.

First Embodiment

As shown in FIG. 1 , an electronic control unit (ECU) 1 includes a micro-processing unit (MPU) 3 as a microcomputer that performs various processing programmed for controlling an engine of a vehicle, and a monitor IC 5 that monitors the operation of MPU 3 .

The MPU 3 , for example, determines the control amount of an actuator for actuating the engine based on input information from various sensors and the like, and performs control processing for achieving such various control functions. Programs for achieving control functions of such control processing are pre-stored in a ROM (not shown).

For example, as one of control functions, an actuator control amount computation function as shown in FIG. 2 is available. This actuator control amount computation function performs an operation “V 1 × constant A+constant B” for a voltage V 1 inputted from the main signal input system, when the main of main and sub signal input systems (not shown) provided in the ECU 1 is normal and the MPU 3 controls the engine in a normal mode. This operation result is defined as a control amount for the actuator. When the main signal input system becomes abnormal and the MPU 3 controls the engine in a fail-safe mode, the actuator control amount computation function performs an operation “V 2 ×constant C+constant D” for a voltage V 2 inputted from the sub signal input system. This operation result is defined as the control amount. That is, in the normal mode, the processing of a path indicated by the dotted line in FIG. 2 is performed. In the fail-safe mode, the processing of a path indicated by the alternate long and short dash line in FIG. 2 is performed.

In the ECU 1 , to run a test for verifying the functions of the MPU 3 , the MPU 3 includes a verification result check and test selection unit (section or function) 3 a and a test result management unit (section or function) 3 b , and the monitor IC 5 includes a test result verification unit (section or function) 5 a . Furthermore, the MPU 3 and the monitor IC 5 communicate at a specific period interval (e.g., every 8 ms). The verification result check and test selection unit 3 a of the MPU 3 refers to information from the monitor IC 5 to select a test to be run this time, and specifically selects the test ID of a test to be run. The test ID is identification information of the test.

The MPU 3 performs tests of contents corresponding to test IDs selected in the verification result check and test selection unit 3 a for each of plural control functions # 1 , # 2 , and so forth. The test result management unit 3 b of the MPU 3 generates a test result indicating the result of running a test, and transmits the test result and the test ID to the monitor IC 5 . The test ID transmitted to the monitor IC 5 by the test result management unit 3 b is the test ID of the test run this time in the MPU 3 . The respective functions of the verification result check and test selection unit 3 a and the test result management unit 3 b of the MPU 3 are achieved by the MPU 3 executing programs in the ROM.

On the other hand, the test result verification unit 5 a of the monitor IC 5 checks the correctness of the test result transmitted from the MPU 3 , and transmits a right or error determination result (a test result verification result or simply as a verification result) to the MPU 3 along with the test ID of the test corresponding to it. The test ID transmitted to the MPU 3 by the test result verification unit 5 a is the test ID transmitted along with the test result from the MPU 3 . The test result verification unit 5 a counts up an error count ECic 2 (value of an error counter) each time it determines that a test result from the MPU 3 is “error,” and transmits the error count ECic 2 to the MPU 3 along with the test result verification result and the test ID.

The verification result check and the test selection unit 3 a of the MPU 3 refers to the test result verification result, the test ID, and the error count ECic 2 from the monitor IC 5 to select the test ID of the test to be run this time. Therefore, signals flow in the order of < 1 >, < 2 >, < 3 >, and < 4 > in FIG. 1 . Furthermore, the test result verification unit 5 a of the monitor IC 5 stores the test ID transmitted from the MPU 3 , and at the same time, each time a specific period The elapses, checks whether the test IDs of all types have been transmitted from the MPU 3 for the duration of the elapsed specific period (whether tests of all types have been run). If the test IDs of all types have not been transmitted, it determines that the MPU 3 is abnormal. The test result verification unit 5 a , when having performed determination by the above all test run verification function, transmits a history verification result being a determination result of the all test run verification function to the MPU 3 along with the test result verification result, the test ID, and the error count ECic 2 .

The verification result check and test selection unit 3 a of the MPU 3 executes its processing as shown in FIGS. 3 to 7 .

When electric power is applied to the ECU 1 , the MPU 3 performs processing of the verification result check and test selection unit 3 a shown in FIG. 3 every specific period (8 ms) which is a communication interval with the monitor IC 5 . When the ECU 1 has been activated, each counter described later and the value of test ID in the MPU 3 are initialized to zero, and a flag described later is initialized to OFF.

As shown in FIG. 3 , in the processing of the verification result check and test selection unit 3 a , in S 110 , it checks whether the processing is the first execution immediately after activation. If so (S 110 :YES), it proceeds to S 115 to execute test ID selection processing of FIG. 4 . In this embodiment, there are one to five test IDs to be used. The test ID selection processing selects the test ID of a test to be run from among 1 to 5; its detailed contents will be described later.

On termination of the test ID selection processing in S 115 , the verification result check and test selection unit 3 a proceeds to S 120 to initialize the error count ECmpu 2 to zero, and then the processing of the verification result check and test selection unit 3 a terminates. On the other hand, in S 110 , on determining that the processing is not the first execution immediately after activation (second time or later), it proceeds to S 122 to check whether it has received the history verification result, along with the test result verification result, the test ID, and the error count ECic 2 from the previous execution until this execution. If it does not receive the history verification result, it proceeds to S 145 ; if it receives a history verification result, it proceeds to S 125 .

In S 125 , it checks whether the history verification result from the monitor IC 5 is “OK” indicating “normal,” and, if so, proceeds to S 130 to initialize the error count ECmpu 1 to zero, and then proceeds to S 145 . If it is determined in S 125 that the history verification result from the monitor IC 5 is not “OK,” it proceeds to increment the error count ECmpu 1 , and in the next S 140 , checks whether the error count ECmpu 1 has become equal to or greater than a prescribed reference value R 1 for determining error determination. Otherwise, it proceeds to S 145 .

In S 145 , it performs analysis of test result verification results shown in FIG. 7 , and then proceeds to S 150 . The analysis of test result verification results, which will be detailed later, analyzes the test result verification result received from the monitor IC 5 and the error count ECic 2 to determine final test results, which are the overall inspection results that includes the MPU 3 and the monitor IC 5 .

In S 150 , it checks whether the final test result determined this time in S 145 is “OK” indicating “normal.” If so, it proceeds to S 115 . Therefore, also in this case, the test ID selection processing of FIG. 4 is performed, and the error count ECmpu 2 is initialized to zero. If the final test result is not “OK” (S 150 : NO), it proceeds to S 155 to select the same test ID as selected previously as the test ID of the test to be currently run. Specifically, it sets the test ID sent from the monitor IC 5 along with the test result verification result as the test ID of the test to be currently run. By the processing of S 155 , the same test as the last test is run again. In the next S 160 , it increments the error count ECmpu 2 , and in S 165 , checks whether the error count ECmpu 2 has become equal to or greater than a prescribed value Em 2 for determining error determination. Otherwise, the processing of the verification result check and test selection unit 3 a terminates.

On determining in S 140 that the error count ECmpu 1 has become equal to or greater than the prescribed value Em 1 , or on determining in S 165 that the error count ECmpu 2 has become equal to or greater than the prescribed value Em 2 , it proceeds to S 170 to execute predetermined fail-safe processing. Then the processing of the verification result check and test selection unit 3 a terminates.

Since control proceeds to S 170 because some error may occur in the MPU 3 or the monitor IC 5 , conceivable fail-safe processing performed in S 170 is, for example, to reduce throttle opening to decrease the output of the engine. The prescribed values Em 1 and Em 2 for error determination used in the respective determinations of S 140 and S 165 may be the same value or different values.

Next, as shown in FIG. 4 , when the test ID selection processing is started in S 115 of FIG. 3 , S 210 checks whether a current control mode is a normal mode. If so, S 220 executes test ID selection processing for a normal mode shown in FIG. 5 . If a current control mode is not a normal mode but a fail-safe mode (S 210 : NO), control proceeds to S 230 to execute test ID selection processing for the fail-safe mode shown in FIG. 6 . When the processing of S 220 or S 230 terminates, the test ID selection processing in S 115 in the FIG. 3 terminates.

As shown in FIG. 5 , in the test ID selection processing for normal mode executed in S 220 of FIG. 4 , S 310 initializes a second count (the value of a second counter) Cnt 2 used by the test ID selection processing for fail-safe mode described later to zero. S 315 checks whether the first count Cnt 1 is three or less, and if so, control proceeds to S 320 . S 320 checks whether the current test ID is one, and otherwise, control proceeds to S 325 to set the current test ID to one. Then, control proceeds to increment the first count Cnt 1 , and then the test ID selection processing for normal mode terminates. When S 320 determines that the current test ID is one, control proceeds to S 330 to set the current test ID to two, and then proceeds to S 335 .

On the other hand, when S 315 determines that the first count Cnt 1 is not three or less, control proceeds to S 340 to check whether the first count Cnt 1 is five or less, and if so, proceeds to S 345 . S 345 checks whether the current test ID is three, and otherwise, control proceeds to S 350 to set the current test ID to three, and then proceeds to S 335 . When S 345 determines the current test ID is three, control proceeds to S 355 to set the current test ID to four, and then proceeds to S 335 .

On the other hand, when S 340 determines that the first count Cnt 1 is not five or less, control proceeds to S 360 to check whether the first count Cnt 1 is six or less, and if so, proceeds to S 365 . S 365 sets the current test ID to five, and S 370 turns on an IC test run flag before proceeding to S 335 . The IC test run flag is a flag indicating an IC test period during which a test result (test result for verifying NG determination described later) to be determined intentionally as “error” is transmitted to the monitor IC 5 , and a test result verification result for it from the monitor IC 5 is verified to be “error.” When the test ID is set to five, and the IC test run flag is turned on, by processing ( FIG. 8 ) of the test result management unit 3 b described later, the test result to be determined intentionally as “error” is transmitted to the monitor IC 5 . Accordingly, when the IC test run flag is ON, it is normal that a test result verification result from the monitor IC 5 to the MPU 3 is “NG” indicating “error.” When S 360 determines that the first count Cnt 1 is not six or less, control proceeds to S 375 to return the first count Cnt 1 to zero. S 380 turns off the IC test run flag, and then the test ID selection processing for normal mode terminates.

In the test ID selection processing for normal mode, as shown in FIG. 13 , the first count Cnt 1 laps around between zero and seven.

When the first count Cnt 1 is zero to three, the test ID is alternately set between 1 and 2 (S 315 to S 330 ). When the first count Cnt 1 is four, the test ID is set to three. When the first count Cnt 1 is five, the test ID is set to four (S 340 to S 355 ). When the first count Cnt 1 is six, the test ID is set to five, and the IC test run flag is turned on (S 360 to S 370 ). When the first count Cnt 1 is seven, with the test ID set to five, the IC test run flag is turned off (S 380 ). Test IDs of one and two (ID=1, 2) indicate tests of logics (processing executed during the normal mode) used during normal mode. Test IDs of 3 and 4 indicate tests of logics (processing executed during the fail-safe mode) used during fail-safe mode. In the test ID selection processing for normal mode, ID=1, 2 is selected more frequently than ID=3, 4. Test ID of 5 (ID=5) indicates a test of the monitor IC 5 .

Next, as shown in FIG. 6 , in the test ID selection processing for fail-safe mode executed in S 230 of FIG. 4 , S 310 initializes the first count Cnt 1 used in the test ID selection processing for the normal mode described previously to zero. The next S 415 checks whether the second count Cnt 2 is three or less, and if so, control proceeds to S 420 . S 420 checks whether the current test ID is three, and otherwise, control proceeds to S 425 to set the current test ID to three. Control proceeds to S 435 to increment the second count Cnt 2 , and then the test ID selection processing for fail-safe mode terminates. When S 420 determines that the current test ID is three, control proceeds to S 430 to set the current test ID to four, and then proceeds to S 435 .

On the other hand, when S 415 determines that the second count Cnt 2 is not three or less, control proceeds to S 440 to check whether the second count Cnt 2 is five or less, and if so, proceeds to S 445 . S 445 checks whether the current test ID is one, and otherwise, control proceeds to S 450 to set the current test ID to one, and then proceeds to S 435 . When S 445 determines that the current test ID is one, control proceeds to S 455 to set the current test ID to two, and then proceeds to S 435 .

On the other hand, when S 440 determines that the second count Cnt 2 is not five or less, control proceeds to S 460 to check whether the second count Cnt 2 is six or less. If so, control proceeds to S 465 and sets the current test ID to five, S 470 turns on IC test run flag, and then control proceeds to S 435 . When S 460 determines that the second count Cnt 2 is not six or less, control proceeds to S 475 t 6 return the second count Cnt 2 to zero. S 480 turns off the IC test run flag, and then the test ID selection processing for fail-safe mode terminates.

In the test ID selection processing for fail-safe mode, as shown in FIG. 13 , the second count Cnt 2 laps around between zero and seven. When the second count Cnt 2 is zero to three, the test ID is alternately set to three and four (S 415 to S 430 ). When the second count Cnt 2 is four, the test ID is set to one. When the second count Cnt 2 is five, the test ID is set to two (S 440 to S 455 ). When the second count Cnt 2 is six, the test ID is set to five and the IC test run flag is turned on (S 460 to S 470 ). When the second count Cnt 2 is seven, with the test ID set to five, the IC test run flag is turned off (S 480 ). Therefore, in the test ID selection processing for fail-safe mode, contrary to the test ID selection processing for normal mode, ID=3, 4 is selected more frequently than ID=1, 2.

Next, as shown in FIG. 7 , in the analysis of test result verification results executed in S 145 of FIG. 3 , S 510 checks whether the test result verification result received from the monitor IC 5 is “OK” indicating “normal.” If so, control proceeds to S 515 to check whether the IC test run flag is ON. Otherwise, control proceeds to S 520 to check whether the error count ECic 2 received from the monitor IC 5 is zero. If so, control proceeds to S 525 . S 525 sets final test results being the overall inspection results that include the MPU 3 and the monitor IC 5 to “OK” indicating “normal,” and then the analysis of test result verification results terminates.

When S 510 determines that the test result verification result received from the monitor IC 5 is not “OK,” control proceeds to S 530 to check whether the IC test run flag is ON. If so, control proceeds to S 535 to check whether the error count ECic 2 received from the monitor IC 5 is one. If so, control proceeds to S 525 . Therefore, also in this case, a final test result is set to “OK.” On the other hand, when S 530 determines that the IC test run flag is not ON, this means that although the test result to be determined intentionally as “error” is not transmitted to the monitor IC 5 , the test result verification result from the monitor IC 5 is not “OK” (that is, “NG”). Since the test result transmitted from MPU 3 to the monitor IC 5 is considered to be really an error, control proceeds to S 540 to set the final test result to “NG” indicating “error.” Then, the analysis of test result verification results terminates.

When S 535 determines that the error count ECic 2 is not one, it is determined that a count-up function (processing of S 745 of FIG. 10 described later) of the error count ECic 2 in the monitor IC 5 malfunctions, control proceeds to S 540 to set the final test result to “NG.”

When S 515 determines that the IC test-execution flag is ON, this means that although the test result to be determined intentionally as “error” is transmitted to the monitor IC 5 , the test result verification result from the monitor IC 5 is “OK.” Therefore, it is determined that the function (test result verification unit 5 a ) of the monitor IC 5 to determine a test result malfunction, and control proceeds to S 540 to set the final test result to “NG.” When S 520 determines that the error count ECic 2 is not zero, it is determined that the function (processing of FIG. 10 described later) to reset the error count ECic 2 in the monitor IC 5 malfunctions, and control proceeds to S 540 to set the final test result to “NG.” The final test result set to “OK” or “NG” in S 525 or S 540 of FIG. 7 is referred to in S 150 of FIG. 3 .

The MPU 3 , when the processing of FIG. 3 terminates, runs a test of contents corresponding to a test ID selected in S 115 or S 155 at that time for each of plural control functions # 1 , # 2 , and so forth. The following describes the contents of tests run in the MPU 3 .

The MPU 3 is put in the normal mode when the main of the main and sub signal input systems described previously, and in the fail-safe mode when the main signal input system is abnormal. In this embodiment, there are sixteen control functions # 1 to # 16 to be tested. Each of these control functions # 1 to # 16 performs during the normal mode, as shown in FIG. 2 , a predetermined operation on the voltage V 1 inputted from the main signal input system to obtain the control amount and the like of the actuator corresponding to the control function. During the fail-safe mode, it performs a predetermined operation on the voltage V 2 inputted from the sub-signal input system to obtain the control amount and the like of the actuator corresponding to the control function.

In the test of test ID=1, for a path (processing path) during normal mode in the control functions # 1 to # 16 , a first dummy input value is afforded, and the result of an operation on the dummy input value is determined as a test result. In the test of test ID=2, for a path during normal mode in the control functions # 1 to # 16 , a second dummy input value different from the first dummy input value is afforded, and the result of an operation on the input value is determined as a test result. On the other hand, in the test of test ID=3, for a path during fail-safe mode in the control functions # 1 to # 16 , a third dummy input value is afforded, and the result of an operation on the input value is determined as a test result. In the test of test ID=4, for a path during fail-safe mode in the control functions # 1 to # 16 , a fourth dummy input value different from the third dummy input value is afforded, and the result of an operation on the input value is determined as a test result.

The first dummy input value may be a different value for each of the control functions # 1 to # 16 . The same is also true for the second to fourth dummy input values. For test ID=5, tests of the control functions # 1 to # 16 are not run. By processing FIG. 8 described later, the test replies for IC test (test replies for verifying NG determination for verifying the functions of the monitor IC 5 and the test replies for verifying OK determination) are only created.

The test ID is set to any of one to four in the processing of FIG. 3 , and the MPU 3 runs a test having contents corresponding to the test ID for each of the control functions # 1 to # 16 . Alternatively, when the test ID is set to five in the processing of FIG. 3 , the processing of the test result management unit 3 b is run as shown in FIG. 8 .

As shown in FIG. 8 , in the processing of the test result management unit 3 b , S 610 checks whether the current test ID is five, and otherwise (that is, any one of one to four), control proceeds to S 615 . S 615 checks whether the result of the test run this time for each of the control functions # 1 to # 16 is correct. Specifically, in the MPU 3 , for each of the control functions # 1 to # 16 , a correct operation result when the first dummy input value described previously is afforded to a path during normal mode in the control function is stored as the expected value for the normal mode test. Moreover, in the MPU 3 , for each of the control functions # 1 to # 16 , a correct operation result when the third dummy input value described previously is afforded to a path during the fail-safe mode in the control function is stored as an expected value for fail-safe mode test.

If the current test ID is one or two, S 615 compares the test result with the expected value for normal mode test for each of the control functions # 1 to # 16 . If the compared two match, it determines that the test result is correct. Moreover, if the current test ID is three or four, S 615 compares the test result with the expected value for fail-safe mode test for each of the control functions # 1 to # 16 . if the compared two match, it determines that the test result is correct.

Therefore, when the test ID is one or three, if the test of a certain control function and the determination of S 615 are normally performed, S 615 determines that “Test result is correct.” When the test ID is two or four, if the test of a certain control function and the determination of S 615 are normally performed, S 615 determines that “Test result is not correct.” Tests of ID=1,3 are tests (tests expected as OK) expected that it is determined in S 615 that “Test result is correct.” Tests of ID-2 and 4 are tests (tests expected as NG) expected that it is determined in S 615 that “Test result is not correct.” Thus, the reason that not only tests expected as OK but also tests expected as NG are provided is to enable verification that determination in S 615 is not adhered to any of “YES” and “NO.”

For such a control function that it is determined in S 615 that test result is correct, S 620 creates a test replay indicating “OK” as a test result. For such a control function that it is determined in S 615 that test result is not correct, S 625 creates a test replay indicating “NG” as a test result.

Specifically, the test result is created according to rules shown in FIG. 9A . That is, when the test ID is one or two, if S 615 determines that the test result of a certain control function #n (n is any of 1 to 16) is correct, of numeric values described in a column of “ID=1” in FIG. 9A , a numeric value corresponding to “#n” is designated as a test result indicating “OK” for the control function #n. When the test ID is one or two, if S 615 determines that the test result of a certain control function #n is not correct, of numeric values described in a column of “ID=2” in FIG. 9A , a numeric value corresponding to “#n” is designated as a test result indicating “NG” for the control function #n.

Therefore, for example, when the test ID is one or two, if S 615 determines that the test result of a control function # 1 is correct, {01} is a test result indicating “OK” for the control function # 1 . When the test ID is one or two, if S 615 determines that the test result of a control function # 1 is not correct, { 11 } is a test result indicating “NG” for the control function # 1 . Numeric values described in FIG. 9 and numeric values within { } are represented in hexadecimal.

Likewise, when the test ID is three or four, if S 615 determines that a test result of a certain control function #n is correct, of numeric values described in a column of “ID=3” in FIG. 9A , a numeric value corresponding to “#n” is designated as a test result indicating “OK” for the control function #n. When the test ID is three or four, if S 615 determines that the test result of a certain control function #n is not correct, of numeric values described in a column of “ID=4” in FIG. 9A , the numeric value corresponding to “#n” is designated as a test result indicating “NG” for the control function #n.

Therefore, for example, when the test ID is three or four, if S 615 determines that a test result of a control function # 1 is correct, { 21 } is a test result indicating “OK” for the control function # 1 . when the test ID is three or four, if S 615 determines that the test result of a control function # 1 is not correct, { 31 } is a test result indicating “NG” for the control function # 1 .

As described above, since tests of test ID=2, 4 are tests expected as NG that are to be determined in S 615 as “Test result is not correct,” if the MPU 3 is normal, when the test ID is m (m is any of one to four), numeric values described in a column of “ID=m” in FIG. 9A are test replies for control functions # 1 to # 16 .

When S 610 determines that the current test ID is five, control proceeds to S 630 to check whether the IC test run flag is ON. If so (S 630 : YES), control proceeds to S 635 to create a test result for verifying NG determination to be determined as “error” in the monitor IC 5 as the test result for the control functions # 1 to # 16 . If the IC test run flag is OFF, (S 630 : NO), control proceeds to S 640 to create a test result for verifying OK determination to be determined as “correct” in the monitor IC 5 as the test result for control functions # 1 to # 16 .

Specifically, the test result is created according to rules shown in FIG. 9B . That is, S 635 designates a numeric value corresponding to “#n” of numeric values described in the left column of FIG. 9B as a test result for a control function #n. S 640 designates a numeric value corresponding to “#n” of numeric values described in a right column of FIG. 9B as a test result for a control function #n. Therefore, when the test ID is five, and the IC test run flag is ON, test replies of the control functions # 1 to # 16 all are “FF.” When the test ID is five, and the IC test run flag is off, for example, the test result of control function # 1 is { 41 }, and the test result of control function # 2 is { 42 }. When the test result is created for each control function # 1 to # 16 by the above processing of S 610 to S 640 , S 645 transmits a test result for the each control function # 1 to # 16 and the current test ID (that is, the test ID of the test selected and run this time in the MPU 3 ) to the monitor IC 5 , and the processing of the test result management unit 3 b terminates.

The test result verification unit 5 a in the monitor IC 5 executes the contents of processing shown in FIGS. 10 and 11 . Each time the test result verification unit 5 a of the monitor IC 5 receives the test result and the test ID transmitted from the MPU 3 , it starts the processing of FIG. 10 . The value of each counter in the monitor IC 5 is initialized to zero when the ECU 1 is started. S 710 performs test result analysis processing shown in FIG. 11 .

As shown in FIG. 11 , in the test result analysis processing S 710 , S 810 stores the test ID received this time from the MPU 3 as a test history in the history storage area in a memory provided in the monitor IC 5 . S 815 increments a history verification time count. Next, S 820 checks whether history verification time arrives at an interval of the specific period Thc described previously by determining whether the history verification time count reaches a threshold value corresponding to the specific period Thc. On determining that the history verification time count does not reach the threshold value, and the history verification time does not arrive (S 820 : NO), control proceeds to S 855 . On determining that the history verification time has arrived (S 820 : YES), control proceeds to S 825 . S 825 clears the history verification time count to zero, and S 830 checks whether the test IDs of all types from one to five are stored as the test history in the history storage area (that is, whether test IDs of all types have been transmitted this time for the duration of the elapsed specific period Thc, i.e., whether tests of all types have been run).

If there are test IDs of all types in the history storage area (S 830 : YES), S 840 sets a history verification result to “OK” indicating “normal,” and S 850 clears the test history (test ID) within the history storage area, and then proceeds to S 855 . If there are not test IDs of all types in the history storage area (S 830 : NO), S 845 sets the history verification result to “NG” indicating “error,” and S 850 clears the test history (test ID) within the history storage area, and then proceeds to S 855 .

By the above-described processing of S 810 to S 850 , the above all test run verification function has been achieved. In this embodiment, the specific interval Thc being an arrival interval of history verification time is, for example, 96 ms as shown in FIG. 13 .

S 855 checks whether the test result verification result transmitted previously to the MPU 3 is “NG” corresponding to “error.” If the previous test result verification result is not “NG,” (S 855 : NO), control proceeds to S 865 . Otherwise (S 855 : YES), control proceeds to S 860 . S 860 checks whether the test ID received this time from MPU 3 is the same as the test ID received previously, and if so, control proceeds to S 865 . S 865 selects an expected value for determining correctness or incorrectness. The expected value for determining correctness or incorrectness is for checking whether the test result received from the MPU 3 is correct. Specifically, the monitor IC 5 , as shown in FIG. 12 , stores the above rules stored in the MPU 3 that are exactly the same as those in the right side of FIGS. 9A and 9B . S 865 , when the test ID received this time from the MPU 3 is M (M is any of one to five), selects a numeric value described in the column of “ID=M” in FIG. 12 as an expected value for determining correctness or incorrectness for the test result for each control function # 1 to # 16 .

Next, control proceeds to S 870 to check whether the test result received this time from the MPU 3 matches the expected value for determining correctness or incorrectness selected in S 865 , for the control functions # 1 to # 16 . For all control functions # 1 to # 16 , if the test result and the expected value for determining correctness or incorrectness match (S 870 : YES), control proceeds to S 875 to set a test result verification result “OK” corresponding to “correct,” and then the test result analysis processing terminates. For one or more of the control functions # 1 to # 16 , if the test result and the expected value for determining correctness or incorrectness do not match (S 870 : NO), control proceeds to S 880 to set the test result verification result to “NG” corresponding to “error,” and then the test result analysis processing terminates. When S 860 determines that the current test ID is not the same as the previous test ID, control proceeds to S 880 to set the test result verification result to “NG,” and then the test result analysis processing terminates.

Referring back to FIG. 10 , when the test result analysis processing terminates in S 710 , S 712 checks whether this time is the history verification time (that is, the S 820 checks whether the history verification time has arrived). If this time is not the history verification time, control proceeds immediately to S 735 . Otherwise, control proceeds to S 715 .

S 715 checks whether the history verification result set in S 840 or S 845 of the latest test result analysis processing is “OK.” If so, control proceeds to S 720 to initialize the error count ECic 1 to zero, and then proceeds to S 735 . If S 715 determines that the history verification result is not “OK,” control proceeds to S 725 to increment the error count ECic 1 . The next S 730 checks whether the error count ECic 1 has become equal to or greater than a prescribed value Ei 1 for error determination. If not so, control proceeds to S 735 .

S 735 checks whether the test result verification result set in S 875 or S 880 of the latest test result analysis processing is “OK.” If so, control proceeds to S 740 to initialize the value of error count ECic 2 to zero, and then proceeds to S 755 . If S 735 determines that the test result verification result is not “OK,” control proceeds to S 745 to increment the error count ECic 2 . The next S 750 checks whether the error count ECic 2 has become equal to or greater than a prescribed value Ei 2 for error determination. Otherwise, control proceeds to S 755 .

On the other hand, on determining in S 730 that the error count ECic 1 has become equal to or greater than the prescribed value Ei 1 , or on determining in S 750 that the error count ECic 2 has become equal to or greater than the prescribed value Ei 2 , it proceeds to S 760 to execute predetermined fail-safe processing, and then proceeds to S 755 . Since control proceeds to S 760 because some error may occur in the MPU 3 , conceivable fail-safe processing performed in S 760 is to output a fail-safe signal to reduce the output of the engine in precedence over output from the MPU 3 . The prescribed value for determining error determination used in the respective determinations of S 730 and S 750 may be the same value or different values.

S 755 transmits information to the MPU 3 . Specifically, if this time is the history verification time at an interval of the specific period Thc, it transmits to the MPU 3 the test result verification result and the history verification result set in the latest test result analysis processing, the error count ECic 2 , and the test ID received from the MPU 3 along with the test result. If this time is not the history verification time, it transmits to the MPU 3 the test result verification result set in the latest test result analysis processing, the error count ECic 2 , and the test ID received from the MPU 3 along with the test result. After the processing of S 755 is performed, the processing of FIG. 10 terminates.

The following describes the operation of the monitor IC 5 by processing of FIGS. 10 and 11 .

If the MPU 3 is normal, as shown in FIG. 13 , only when the test ID from the MPU 3 has become five from other than five (that is, when the IC test run flag has been turned on in the MPU 3 ), the test result verification result becomes “NG” (S 880 ). In other cases, the test result verification result becomes “OK” (S 875 ). When the test ID from the MPU 3 has become five from other than five MPU 3 , the test replies for the control functions # 1 to # 16 transmitted from the MPU 3 to the monitor IC 5 all become {FF}, while expected values for determining correctness or incorrectness used in S 870 of FIG. 11 in the monitor IC 5 are { 41 }, { 42 }, { 43 }, . . . { 50 } as shown in the rightmost column of FIG. 12 .

When the MPU 3 is normal and the test ID to the monitor IC 5 has become from other than five to five, in the monitor IC 5 , since the test result verification result becomes “NG” and the error count ECic 2 is counted up by S 745 of FIG. 10 , “NG” is transmitted as the test result verification result from the monitor IC 5 to the MPU 3 , and one is transmitted as the error count ECic 2 . However, in this case, since the processing of FIG. 7 in the MPU 3 proceeds in the order of S 510 :NO S 530 :YES S 535 :YES S 525 , the final test result becomes “OK” instead of “NG.”

On the other hand, when an error occurs in the MPU 3 and, for example, as shown in FIG. 14 , it is assumed that the result of running a test of ID=1 becomes a value different from the expected value used for determination in S 615 of FIG. 8 , the test result from the MPU 3 to the monitor IC 5 is different from numerical values {01}, {02}, . . . {10} described in the column of “ID=1” in FIG. 9A . Therefore, the monitor IC 5 determines in S 870 of FIG. 11 that the test result from the MPU 3 and the expected value for determining correctness or incorrectness do not match, sets the test result verification result to “NG” (S 880 ), and counts up the error count ECic 2 (S 745 ). When the test result verification result from the monitor IC 5 to the MPU 3 becomes “NG,” since the IC test run flag is not turned on in the MPU 3 , in the processing of FIG. 7 , determination is made as S 510 :NO S 530 :NO. The final test result is set to “NG” (S 540 ). The processing of S 155 and S 160 in FIG. 3 is performed, the test of the same test ID=1 as the last time is run again in the MPU 3 , and the same test ID (=1) as the last time is transmitted from the MPU 3 to the monitor IC 5 .

As shown in FIG. 14 , when the test of ID=1 is not normally run for a long time in the MPU 3 , the error count ECic 2 is counted up in the monitor IC 5 (S 745 ). When the error count ECic 2 reaches the prescribed value EI 2 , the determination in S 750 of FIG. 10 is made as “YES” and the fail-safe processing (S 760 ) is performed. The error count ECmpu 2 is counted up also in the MPU 3 (S 160 ). When the error count ECmpu 2 reaches the prescribed value Em 2 , the determination in S 165 of FIG. 3 is made as “YES” and the fail-safe processing (S 170 ) is performed.

In the MPU 3 , for example, when a test result cannot be normally created in the processing of FIG. 8 , in the monitor IC 5 , since S 870 of FIG. 11 determines that the test result from MPU 3 and the expected value for determining correctness or incorrectness do not match, and error is detected.

As shown in FIG. 15 , when, for example, test ID=3 is not selected for the specific period Thc (96 ms) or longer because of an error in the MPU 3 , in the monitor IC 5 , the history verification result is set to “NG” by the processing of S 810 -S 850 in FIG. 11 .” At the same time, the error count ECic 1 is counted up by the processing S 715 and S 725 of FIG. 10 . When that state lasts and the error count ECic 1 reaches the prescribed value Ei 1 , the determination in S 730 of FIG. 10 is made as “YES” and the fail-safe processing (S 760 ) is performed. Furthermore, the history verification result at the interval of the specific period Thc by the monitor IC 5 is transmitted to the MPU 3 . When the history verification result becomes “NG,” in the MPU 3 , the error count ECmpu 1 is counted up by the processing of S 125 and S 135 of FIG. 3 . Also in the MPU 3 , when the error count ECmpu 1 reaches the prescribed value Em 1 , the determination in S 140 of FIG. 3 is made as “YES” and the fail-safe processing (S 170 ) is performed.

Although the test result verification result previously transmitted to the MPU 3 is “NG” (that is, the previous test result from the MPU 3 is determined as “error”), when the same test ID as the previous one is not transmitted from the MPU 3 (S 855 :YES S 860 :NO in FIG. 8 ), the monitor IC 5 determines that the MPU 3 is abnormal, and sets the test result verification result to “NG.” Therefore, the abnormality (that is, abnormality of re-test run function) that the processing of S 150 and S 155 of FIG. 3 is not normally performed in the MPU 3 can be detected.

When the MPU 3 is normal but the test ID changes from five to other than five, the test result for verifying NG determination to be determined intentionally as “error” is transmitted from the MPU 3 to the monitor IC 5 . The test result verification result becomes “NG” in the monitor IC 5 . On receiving the test result verification result, since the IC test run flag is ON, the MPU 3 performs processing as S 510 :NO S 530 :YES S 535 :YES S 525 in FIG. 7 , and the final test result becomes “OK.” Therefore, in this case, even if the test result verification result from the monitor IC 5 to the MPU 3 is “NG,” the processing of S 150 and S 155 in FIG. 3 is not performed in the MPU 3 . However, in this case, by the processing of FIG. 5 or 6 performed in S 115 of FIG. 3 , the test ID remains set to five, which is the same as that in the last time. That is, test ID=5 is originally transmitted repeatedly twice from the MPU 3 to the monitor IC 5 . Accordingly, when the test ID from the MPU 3 becomes from other than five to five, even if the test result verification result becomes “NG,” the next time also receive the same test ID=5 as the last time, so that an incorrect determination is not made as abnormality without the determination in S 860 of FIG. 11 being made as “NO.”

The ECU 1 includes in the MPU 3 the verification result check and test selection unit 3 a that selects a test for function verification. The MPU 3 runs a test selected by the verification result check and test selection unit 3 a , and transmits the test result showing the execution result to the monitor IC 5 . The monitor IC 5 determines the correctness or incorrectness of the test result from the MPU 3 . Therefore, the monitor IC 5 does not need to have a function to select a test, so that the functions of the monitor IC 5 can be simplified. Still, since the MPU 3 itself selects a test, tests suited for control mode are very easily selected. Since the MPU 3 has all parameters concerning control states of the engine, such test selection is enabled.

Accordingly, in this embodiment, the verification result check and test selection unit 3 a of the MPU 3 , by the processing of FIG. 4 ( FIGS. 4 and 5 ), during normal mode, selects tests (tests of ID=1, 2) of processing performed during the normal mode more frequently than tests (test of ID=3, 4) of processing performed at fail-safe. Conversely, during the fail-safe mode, it selects tests (test of ID=3, 4) of processing executed during the fail-safe mode more frequently than tests (test of ID=1, 2) of processing performed during the normal mode. That is, tests of processing performed during the current control mode are selected more frequently than tests of processing performed during other control modes. Such test selection corresponding to control modes enables quick detection of abnormality related to the current control mode.

Since the monitor IC 5 transmits the test result verification result being the result of determining the correctness or incorrectness of the test result from the MPU 3 to the MPU 3 , the MPU 3 can also check whether any abnormality exists, from the test result verification result from the monitor IC 5 .

The verification result check and test selection unit 3 a of the MPU 3 , by the processing of FIG. 7 , basically sets the final test result to “OK” if the test result verification result from the monitor IC 5 is “OK.” It sets the final test result to “NG” if the test result verification result from the monitor IC 5 is “NG.” When the final test result is “NG,” the same test as the previous one is selected (S 155 of FIG. 3 ). Therefore, when the test result of the test is determined as “NG” in the monitor IC 5 (when the determination of S 870 of FIG. 1 is made as “NO”), the test is run again, and an abnormal condition can be verified not once but successively plural times. Furthermore, in comparison with the running of a re-test after a round of all types of tests, there is an advantage in that time until abnormality is determined can be reduced.

The MPU 3 transmits the test ID of the test run this time to the monitor IC 5 along with the test result. The monitor IC 5 sets the expected value of the test result from the MPU 3 based on the test ID from the MPU 3 (S 865 ), and compares the expected value with the test result to determine the correctness or incorrectness of the test result (S 870 ). Therefore, in comparison with, for example, the transmission of the expected value for determining correctness or incorrectness along with the test result from the MPU 3 to the monitor IC 5 , the accuracy of determining correctness/incorrectness by the monitor IC 5 can be increased.

In the above embodiment, the monitor IC 5 selects one corresponding to the test ID from among plural expected values for determining correctness or incorrectness stored in advance. However, expected values for determining correctness or incorrectness may be computed according to predetermined operation rules from the value of test ID.

In the ECU 1 of the embodiment, the monitor IC 5 transmits the test ID to the MPU 3 along with the test result verification result. The verification result check and test selection unit 3 a of the MPU 3 , when selecting the test ID of the same test as the previous one, selects the test ID from the monitor IC 5 as the test ID of the same test as the previous one. Therefore, this makes it possible to prevent the discrepancy between test IDs recognized in the MPU 3 and the monitor IC 5 , assuring re-test of the same test as the previous one, if desired.

When the monitor IC 5 determines that the previous test result from the MPU 3 is “error” but the same test ID as the previous one is not transmitted from the MPU 3 (S 860 : NO), the monitor IC 5 determines that the MPU 3 is abnormal, and sets the test result verification result to “NG.” As a result, abnormality of the function of the MPU 3 to run a re-test can be detected.

Since the monitor IC 5 has an all test run verification function by S 810 to S 850 of FIG. 11 , it can detect a fault of the MPU 3 such as “a specific test is not run.” The all test run verification function can respond to a change in a transmission order of test IDs from the MPU 3 .

Each time a test ID changes from other than five to five, the MPU 3 transmits the test result for verifying NG determination to be determined intentionally as “error” to the monitor IC 5 (S 635 ), and determines by S 510 , S 515 , and S 530 of FIG. 7 whether the test result verification result from the monitor IC 5 to the test result is “NG.” Otherwise, it determines the result as abnormality (S 510 :YES S 515 :YES S 540 ). Therefore, the MPU 3 can check whether the correctness/incorrectness function of the monitor IC 5 that determines correctness or incorrectness of the test result from the MPU 3 is normal.

Furthermore, the monitor IC 5 has a function (S 745 ) to count up the error count ECic 2 each time it determines that the test result from the MPU 3 is “error,” and transmits the error count ECic 2 to the MPU 3 along with the test result verification result. The MPU 3 determines by S 535 of FIG. 7 whether the error count ECic 2 transmitted from the monitor IC 5 along with the test result verification result for the test result for verifying NG determination is normally counted up. Otherwise, it determines as “abnormal” (S 535 :NO S 540 ). Therefore, the MPU 3 can check whether the count-up function of the monitor IC 5 to count up the error count ECic 2 is normal.

In the above embodiment, the verification result check and test selection unit 3 a in the MPU 3 operates as a test selection means. Of processing performed by the MPU 3 , S 635 of FIG. 8 and S 510 , S 515 , and S 530 of FIG. 7 operate as IC determination function test means. Of processing performed by the MPU 3 , S 635 of FIG. 8 and S 535 of FIG. 7 operates as IC count function test means.

Second Embodiment

In a second embodiment, an ECU has the same hardware configuration as the ECU 1 of the first embodiment, and hence the reference numerals of individual units are the same as those in the first embodiment.

In contrast to the ECU 1 of the first embodiment, the MPU 3 runs tests for checking whether the all test run verification function (S 810 to S 850 ) of the monitor IC 5 , the function to reset the error count ECic 1 , and the count-up function (S 715 to S 725 ) are normal. The monitor IC 5 transmits a history verification result to the MPU 3 in S 755 of FIG. 10 along with the error count ECic 1 . Therefore, the MPU 3 executes the processing of a verification result check and test selection unit 3 a shown in FIG. 16 instead of the processing of FIG. 3 . The processing of FIG. 16 is different from the processing of FIG. 3 in the following points (1-1) to (1-3).

(1-1): S 115 performs test ID selection processing of FIG. 17 in place of the processing of FIG. 4 .

(1-2): When S 122 determines that the history verification result is received, S 123 performs the processing of analyzing history verification results of FIG. 18 , and then proceeds to S 125 .

Details of the processing of analyzing history verification results will be described later. The processing determines the history verification final result being an inspection result obtained by analyzing the history verification result received from the monitor IC 5 and the error count ECic 1 to comprehensively check whether tests of all types have been run in the MPU 3 , whether the all test run verification function of the monitor IC 5 is normal, and whether the reset function of the error count ECic 1 and the count-up function in the monitor IC 5 are normal.

(1-3): S 125 checks whether the history verification final result determined this time in S 123 instead of the history verification result received from the monitor IC 5 is “OK” indicating “normal.”

The following describes the test ID selection processing of FIG. 17 performed in S 115 of FIG. 16 . The test ID selection processing of FIG. 17 is an addition of the processing of S 240 to S 270 to the test ID selection processing (S 210 to S 230 ) of FIG. 4 .

As shown in FIG. 17 , in the test ID selection processing S 115 , S 240 checks whether the test run flag is ON. The MPU 3 , to check whether the all test run verification function of the monitor IC 5 is normal, intentionally prohibits the transmission of any (five of one to five in this embodiment) of test IDs of all types to the monitor IC 5 . The test run flag indicates the period (that is, a test period of the all test run verification function hereinafter referred to as a specific ID transmission prohibition period) during which the transmission of the test ID=5 is prohibited. The test run flag is turned on in S 255 described later, and turned off in S 940 or S 950 of FIG. 18 described later.

When S 240 determines that the test run flag is not ON, control proceeds to S 245 to check whether a value of a test start time counter (value of a test start time count) is equal to or greater than a time-up value. Otherwise, control proceeds to S 250 to increment the test start time count. Then, control proceeds to S 210 . The test start time count is for measuring elapsed time after the end of the previous specific ID transmission prohibition period. The time-up value is for determining after the end of the previous specific ID transmission prohibition period until the next specific ID transmission prohibition period is started. For example, it is set to a value several times or several tens times the specific time Thc. The processing of S 210 to S 230 is the same as those in FIG. 4 . When the processing of S 220 or S 230 terminates, the test ID selection processing in S 115 in FIG. 16 terminates. On the other hand, when S 245 determines that the test start time count is equal to or greater than the time-up value, control proceeds to S 255 to turn on the test run flag, and then proceeds to S 260 .

When S 240 determines that the test run flag is ON, control proceeds to S 260 . S 260 clears the test start time count to zero, and S 265 initializes the first count Cnt 1 used in processing of S 220 (test ID selection processing for normal mode: FIG. 5 ), and the second count Cnt 2 used in processing of S 230 (test ID selection processing for fail-safe mode: FIG. 6 ) to zero. S 270 performs ID selection processing during the periods of specific ID transmission prohibition. The ID selection processing during the periods of specific ID transmission prohibition sets the latest test ID to two if the current test ID (that is, a test ID transmitted last) is one, sets the latest test ID to three if the current test ID is two, sets the latest test ID to four if the current test ID is three, and sets the latest test ID to one if the current test ID is not any of one to three. When the processing of S 270 terminates, the test ID selection processing in S 115 in FIG. 16 terminates.

That is, in the test ID selection processing of FIG. 17 , although the test ID is selected by the processing of the same S 210 to S 230 as that of the first embodiment until the test start time count reaches the time-up value (S 245 :NO, when the test start time count reaches the time-up value, the test run flag is turned on (S 255 ) along with clearing the test start time count (S 260 ). After that, until the test run flag is turned off in S 940 or S 950 of FIG. 18 , the test ID is changed between one and four except five by the processing of S 270 .

The analysis processing of history verification result is performed in S 123 of FIG. 16 , which is more fully shown in FIG. 18 . In this analysis processing of history verification result, S 910 checks whether the history verification result received from the monitor IC 5 is “OK.” If so, control proceeds to S 915 to check whether the test run flag is ON. Otherwise, control proceeds to S 920 to check whether the error count ECic 1 received from the monitor IC 5 along with the history verification result is zero. If so, control proceeds to S 925 . S 925 sets the history verification final result to “OK” indicating “normal,” and then the analysis processing of history verification result terminates.

When S 915 determines that the test run flag is ON, control proceeds to S 945 to check whether a prescribed time Tov has elapsed after the test run flag is turned on. The prescribed time Tov is longer than the prescribed time Thc (96 ms) described previously. If the transmission of any test ID is prohibited for the time, the history verification result is to be set to “NG” by the all test run verification function of the monitor IC 5 . In this embodiment, this time is set to 112 ms, which is less than twice the specific time Thc.

When S 945 determines that the prescribed time Tov does not elapse, although the transmission of test ID=5 is prohibited for the period, since the all test run verification function of the monitor IC 5 cannot yet be determined to be abnormal, the analysis processing of history verification result terminate immediately. In this case, the history verification final result remains the same as the previous setting value.

On the other hand, when S 945 determines that the prescribed time Tov has elapsed, since the prescribed time Tov has elapsed after the transmission of test ID=5 is stopped, but the history verification result from the monitor IC 5 is “OK” instead of “NG,” it determines that the all test run verification function of the monitor IC 5 is abnormal. Control proceeds to S 950 to turn the test run flag OFF. S 955 sets the history verification final result to “NG” indicating “abnormal,” and then the analysis processing of history verification result terminates.

When S 920 determines that the error count ECic 1 is not zero, it determines that abnormality occurs in the reset function of the error count ECic 1 in the monitor IC 5 (S 720 ), and proceeds to S 950 . Therefore, also in this case, the test run flag is turned off and the history verification final result is set to “NG.”

On the other hand, when S 910 determines that the history verification result from the monitor IC 5 is not “OK,” control proceeds to S 930 to check whether the test run flag is ON. If so, since the transmission of test ID=5 is prohibited in terms of period and the all test run verification function of the monitor IC 5 is normal, it can be determined that the history verification result from the monitor IC 5 is not “OK” (that is, “NG”). Therefore, control proceeds to S 935 to check whether the error count ECic 1 received from the monitor IC 5 is one. If the error count ECic 1 is one, since it can be determined that the count-up function (S 725 ) of the error count ECic 1 in the monitor IC 5 is normal, control proceeds to S 940 to turn the test run flag off, and then proceeds to S 925 . Therefore, in this case, the history verification final result is set to “OK.”

On the other hand, when S 930 determines that the test run flag is not ON, it means that although the transmission of test ID=5 is not prohibited, the history verification result from the monitor IC 5 was “NG.” S 930 determines that tests of all types are not truly run, and proceeds to S 955 . Therefore, in this case, the history verification final result is set to “NG.”

When S 935 determines that the error count ECic 1 is not one, it determines that abnormality occurs in the count-up function (S 725 ) of the error count ECic 1 in the monitor IC 5 , control proceeds to S 950 to turn the test run flag off, and then proceeds to S 955 . Therefore, also in this case, the history verification final result is set to “NG.”

In the second embodiment, the history verification final result set to “OK” or “NG” in the processing of FIG. 18 is referred to in S 125 of FIG. 16 , when the continuous number of times the history verification final result is set to “NG” becomes equal to or greater than a prescribed value, fail-safe processing is performed (S 140 :YES S 170 )

According to the ECU 1 of the second embodiment, the MPU 3 can detect that the all test run verification function of the monitor IC 5 has become abnormal. Furthermore, the MPU 3 can detect that the function to reset the error count ECic 1 in the monitor IC 5 and the function to count it up have become abnormal. The processing of S 240 to S 270 in FIG. 17 and the processing of S 910 , S 915 , S 945 , S 950 and S 955 in FIG. 18 operate as all test run verification function testing means. On the other hand, S 935 of FIG. 18 checks whether the error count ECic 1 is one or greater. If so, control may proceed to S 940 , determining as normal.

Third Embodiment

In a third embodiment shown in FIG. 19 , the ECU 1 is different from the ECU 1 of the first embodiment in the following points (2-1) to (2-5).

(2-1): The monitor IC 5 includes, in addition to the test result verification unit 5 a , a test result verification unit 5 b having the same construction and functions as the test result verification unit 5 a . The two test result verification units 5 a and 5 b operate in parallel.

The fail-safe signal outputted in the processing of S 760 in FIG. 10 by each of the test result verification units 5 a and 5 b is outputted to the outside of the monitor IC 5 via an OR circuit 5 c . In short, if at least one of two test result verification units 5 a and 5 b outputs the fail-safe signal, the signal is outputted from the monitor IC 5 to reduce the output of the engine. An AND circuit may be provided in place of the OR circuit 5 c . The two test result verification units 5 a and 5 b correspond to plural circuit blocks.

(2-2): The MPU 3 performs the processing of analyzing the test result verification results shown in FIG. 20 in S 145 of FIG. 3 in place of the processing of FIG. 7 .

In the processing of FIG. 20 , S 550 checks whether a first test result verification result received from the monitor IC 5 is “OK.” The first test result verification result is one transmitted from the test result verification unit 5 a . If the first test result verification result is “OK,” S 555 checks whether the second test result verification result received from the monitor IC 5 is “OK.” The second test result verification result is one transmitted from the test result verification unit 5 b . If the second test result verification result is “OK,” control proceeds to S 560 to set the final test result to “OK,” and then the processing of analyzing the test result verification result terminates. When S 550 determines that the first test result verification result is “NG” or S 555 determines that the second test result verification result is “NG,” control proceeds to S 565 to set the final test result to “NG,” and then the processing of analyzing a test result verification result terminates.

Thus, in the processing of FIG. 20 , if all test result verification results transmitted from the two test result verification units 5 a and 5 b are “OK,” the final test result is set to “OK,” determining as normal. If any one of the test result verification results is “NG,” the final test result is set to “NG,” determining as abnormal.

Therefore, although in the first embodiment, the MPU 3 transmits the test result for verifying NG determination to the monitor IC 5 to confirm that the test result verification result for the test result is “NG,” according to the third embodiment, without performing such processing, influence by abnormality of the correctness/incorrectness function of the monitor IC 5 can be eliminated. This is because abnormality occurs in any of the two test result verification units 5 a and 5 b in the monitor IC 5 and the test result from the MPU 3 to the monitor IC 5 is truly wrong. However, even if the test result verification result from the faulty test result verification unit to the MPU 3 becomes “OK,” if the test result verification result from another test result verification unit is “NG,” the MPU 3 is not incorrectly determined as normal (that is, the final test result is not “OK.) Therefore, in the third embodiment, test ID=5 does not exist. In the MPU 3 , however, the test ID is set to any of one to four, and the test ID=1 to 4 is transmitted to the monitor IC 5 . Therefore, differences from the first embodiment are summarized as (2-3) to (2-5).

(2-3): The MPU 3 , in S 220 of FIG. 4 , performs the test ID selection processing for normal mode shown in FIG. 21 in place of the processing of FIG. 5 . In S 230 of FIG. 4 , in place of the processing of FIG. 6 , the MPU 3 performs the test ID selection processing for fail-safe mode shown in FIG. 22 .

Processing of FIG. 21 is different from the processing of FIG. 5 in that S 360 to S 370 , and S 380 are not provided. When S 340 determines that the first count Cnt 1 is not five or less, control proceeds to S 375 to return the first count Cnt 1 to zero, and then proceeds to S 325 to set the test ID to one. Therefore, test IDs are selected in the order of “1 2 1 2 3 4 1 2 1 2 3 4 1.”

Processing of FIG. 22 is different from the processing of FIG. 6 in that S 460 to S 470 , and S 480 are not provided. When S 440 determines that the second count Cnt 2 is not five or less, control proceeds to S 475 to return the second count Cnt 2 to zero, and then proceeds to S 425 to set the test ID to three. Therefore, the test IDs are selected in the order of “3 4 3 4 1 2 3 4 3 4 1 2 3.”

(2-4): The MPU 3 performs the processing of FIG. 23 in place of the processing of FIG. 8 as the processing of the test result management unit 3 b.

The processing of FIG. 23 is different from the processing of FIG. 8 in that S 610 and S 630 to 640 are not provided. In the MPU 3 , the rules shown in FIG. 9B are not stored, and only the same rules of FIG. 24 as those of FIG. 9A are stored. S 620 or S 625 of FIG. 23 uses the rules of FIG. 24 to create the test result. Therefore, a procedure for creating the test result in S 620 or S 625 of FIG. 23 , and the contents of the test result created are the same as those in the first embodiment.

(2-5): Each of the test result verification units 5 a and 5 b in the monitor IC 5 stores the same rules of FIG. 24 as those in the MPU 3 in place of the rules of FIG. 12 . In the rules of FIG. 24 , information about test ID=5 is deleted in the rules of FIG. 12 . Each of the test result verification units 5 a and 5 b selects the expected value for determining correctness or incorrectness by using the rules of FIG. 24 in S 865 of FIG. 11 .

As another different point from the first embodiment, the MPU 3 determines in S 125 of FIG. 3 whether the history verification result from one of the two test result verification units 5 a and 5 b (e.g., the test result verification unit 5 a ) in the monitor IC 5 is “OK.” Likewise, the MPU 3 sets in S 155 of FIG. 3 the test ID sent from one of the two test result verification units 5 a and 5 b (e.g., the test result verification unit 5 a ) as the same test ID (that is, rest ID of re-test) as the previous one. In the third embodiment, the test result verification units 5 a and 5 b of the monitor IC 5 may not transmit the error count ECic 2 to the MPU 3 .

According to the ECU 3 of the third embodiment, in comparison with the first embodiment, the processing of the MPU 3 for verifying the operation of the monitor IC 5 can be made simpler. The MPU 3 may be constructed to compare the test result verification results transmitted from the test result verification units 5 a and 5 b of the monitor IC 5 to determine that the monitor IC 5 is faulty unless all of them are the same. In short, if the comparison of information from the test result verification units 5 a and 5 b results in mismatch or disagreement, it can be determined that any of them is abnormal. Therefore, for example, the MPU 3 may be constructed to determine that the monitor IC 5 is abnormal unless all of test IDs transmitted from the test result verification units 5 a and 5 b of the monitor IC 5 are the same after comparing them. Still, the MPU 3 may be constructed to determine that the monitor IC 5 is abnormal unless all of the history verification results transmitted from the test result verification units 5 a and 5 b of the monitor IC 5 are the same after comparing them. By this construction, like the second embodiment, whether the all test run verification function of the monitor IC 5 is normal can be verified in the MPU 3 .

The present invention is not limited to the foregoing embodiments and modifications, but may be implemented in various ways without departing from the purport of the present invention.

For example, in place of two control modes, there may be three control modes or more. Without providing the NG expectation tests, only the OK expectation tests may be run. In this case, the test ID=1, 2 may be integrated to one test ID, and the test ID=3, 4 may be integrated to one test ID. The MPU 3 may transmit the result of the test to the monitor IC 5 as a test result without editing it, while the monitor IC 5 may determine correctness or incorrectness for the test result representative of the test result.