Method for error processing in electronic controllers

Abstract

A method for error processing in electronic controllers particularly, in motor vehicles, is provided whereby errors determined on each vehicle start are permanently written in an error memory. On repeated recognition of similar errors, an error counter, provided for the error, is increased. In the case where it is determined that the error counter has reached a pre-determined state on a renewed vehicle start, a special “poor maintenance” program is launched, which only permits the start of the monitored function when further tests are carried out and completed.

Description

The invention relates to a method, according to the preamble of claim 1, for treating errors in electronic control units, especially in motor vehicles.

The electronic devices contained in modern motor vehicles, such as electronic engine controllers, anti brake-lock systems, stability controls, etc., relate for the most part to applications that are critical to safety. This means that the vehicle can be exposed to dangerous situations in the event of a malfunction of the control unit or of the components associated therewith.

The control units must therefore function extremely reliably and must be continuously monitored for fault-free operation. Such monitoring must cover both the control unit itself and the associated peripherals, or in other words connected sensors, actuators and solenoid valves as well as the cabling thereof.

In modern electronics equipped with microcontrollers, such monitoring is largely ensured by self-tests.

In the case of anti brake-lock systems (ABS), for example, simple tests known as static tests are performed for cable breaks and short circuits as soon as the ignition is turned on. When the vehicle starts to move, all wheel-speed sensors are then checked for functional capability and compliance with limit values. During driving, further tests are initiated by the microcontrollers contained in the electronics.

By this self-diagnosis, as it is known, the control units of the various systems installed in the vehicle are capable of recognizing errors and reacting appropriately to them. The detected errors are also stored in memory together with information such as error type, error frequency and boundary conditions, such as the temperature prevailing at the time. Subsequently these data can be retrieved in the shop, using a tester connected to the vehicle bus, thus greatly facilitating error elimination and repair.

Simple errors may also be indicated directly inside the vehicle by means of an error light.

Technical features of self-diagnosis of electronic control units in motor vehicles are explained in greater depth in, for example, the article entitled “Self-diagnosis of electronic control units in motor vehicles” [in German], VDI-Berichte No. 612, 1986, pages 361 to 373.

If an error is detected by the foregoing tests during driving, the control unit may react to it in various ways.

For example, an emergency-operation program that permits limited functioning of the faulty unit may be started.

Critical errors are generally indicated directly to the operator by a warning light. In this way he is prompted to have the error repaired as soon as possible in the shop.

In response to these critical errors, the control unit may even disable part of its own operation as an emergency measure, for example by disconnecting an output stage, in order to prevent incorrect reactions that may be dangerous for the vehicle.

Finally, it is also important to ascertain whether the error is of static or sporadic nature. Static errors can be newly recognized by the electronic check at the start of every trip. In contrast, sporadic errors occur only now and then. They can be caused, for example, by an intermittent contact. Both types of errors are stored in the error memory mentioned hereinabove.

If, after a single occurrence or prolonged sporadic occurrence, an error has no longer been detectable for a relatively long time, the error in question can also be deleted from the error memory. Under these circumstances, it is assumed that, for example, an intermittent contact is no longer present, or that a different error has since been eliminated in the shop but has inadvertently not been deleted from the error memory.

German Patent 4118692 C2 further teaches the use of an error-time counting device in order to store also the respective time interval in which an error is present. Such an error is then permanently input into an error memory when it is present over more test-time intervals than specified for that error.

An existing error is newly recognized by the error test described in the foregoing whenever the vehicle ignition is turned on. Each time, therefore, the electronics assume that the vehicle is error-free. In contrast, no record is kept of whether a static error already present in the error memory will always be newly recognized over a prolonged time period. This is the case if, after an error has occurred or after the error light has turned on, the operator does not seek out a shop to eliminate the error as soon as possible, even though he is actually presumed to have done so, but instead no longer concerns himself with eliminating the error. This is known to happen in countries with too few shops or with poorly equipped shops, such as in East Europe or Africa.

Unfortunately, such irrational behavior of the operator leads to increasing problems. Thus multiple errors, whose effects on the vehicle are difficult to foresee, can develop over time. Furthermore, if the poorly maintained electronics in question fail to function in emergencies, the vehicle manufacturer can be exposed to product liability risks. Under these circumstances, it is then difficult for the vehicle manufacturer to prove that the failure of its electronics to function is merely the consequence of lack of maintenance.

The object of the invention is to provide, for cases of obstinate disregard of an error indication, such as a warning light, a method that precludes incorrect functioning of the electronics in question and serious consequential damage caused thereby.

This object is achieved by the method described in claim 1 of the invention. The dependent claims contain expedient improvements of the method.

The inventive method will be explained in more detail hereinafter on the basis of a drawing. The (single) FIG. 1 shows a schematic diagram of an electronic control unit of a motor vehicle, which unit is connected to sensors and actuators.

Control unit (6) schematically illustrated in FIG. 1 comprises a microcontroller (7) with analog-to-digital (A/D) converter (8), an error memory (12) in the form of an EEPROM connected to microcontroller (7) and containing an error counter (18), a watchdog (9) for checking the run time of microcontroller (7), a driver stage (10) for activating the connected actuators and a feedback stage (11) for communicating feedback data from the actuators.

In the present case, a positioning motor (13), a solenoid valve (14) and a vacuum pump (15) are connected as actuators to control unit (6). Examples of feedback data include the position of positioning motor (13), the position of solenoid valve (14) and the initial pressure of vacuum pump (15). An error indicator (16) to signal errors to the operator is also connected to microcontroller (7). Moreover, microcontroller (7) is connected to a serial interface (17), via which error data and other data can be read out to a shop by using a special tester. Furthermore, a vehicle data bus can be connected to interface (17) in order to link control unit (6) with the electronics of another vehicle, in order to communicate therewith and, for example, to exchange data used in common.

A voltage supply (5) and sensors (1) to (4) are connected to the input side of control unit (6). Sensors (1) and (2) transmit digital values directly to microcontroller (7), whereas sensors (3) and (4) have analog output signals, which are converted to digital values via analog-to-digital converter (8).

If microcontroller (7) in control unit (6) detects a permanent error when the vehicle starts to move, this error will be written into error memory (12). If the same error recurs when the vehicle next starts to move, the count of an error counter (18) allocated to this error in error memory (12) is incremented in each case. The increment may have a value of 1, but a higher value such as 10 may also be applied in each case.

If, when the vehicle once again starts to move at a later time, it is found that the count of error counter (18) has reached a predetermined value for a particular error, a “Poor maintenance” special program takes over within microcontroller (7).

The “Poor maintenance” special program then disables starting of the function being checked, such as an anti brake-lock system (ABS), until expanded tests have been performed and passed. Examples of such tests are a dynamic check of all wheel-speed sensors during driving, a dynamic test of the connected solenoid valves or other types of exhaustive tests.

Other kinds of reactions may also be initiated by the “Poor maintenance” special program, such as an intensive warning or signal to the driver.

If the full scale of error counter (18) ranges from a count of zero to a count of 250, for example, the “Poor maintenance” special program may take over when the count reaches 100.

After the vehicle has been driven for a predetermined time without errors or for a predetermined distance without errors, all or part of the count of error counter (18) is automatically deleted once again.

In the case of partial deletion, the error counter is not reset to zero directly, but instead the count is decremented only by a predetermined fixed value, such as 50. The normal error tests explained initially, or in other words simple tests for cable break, will be reactivated only if the count ultimately reaches zero after the vehicle has started to move several further times without errors.

Generally speaking, the inventive method comprises inferring the state of maintenance of the vehicle from the error count of the vehicle electronics. In the process, if it is determined on the basis of an abnormally high error count that the vehicle has demonstrably been poorly maintained, then intensified tests are required. If these intensified tests and expanded tests are not passed, then for safety reasons the function being checked, such as an anti brake-lock system (ABS), is completely disconnected. The disconnection will be reported to the operator by a warning light, so that from that time on he can adapt his driving technique accordingly.

Although the inventive method has been explained with reference to motor vehicle electronics, it can also be applied to any other type of electronics provided with error recognition and storage.

Claims

1. A method for treating errors in an electronic control unit of a vehicle, the electronic control unit being programmed with an error-recognition program and including an error memory for storage of permanent and sporadic errors and an error indicator, the method comprising the steps of: writing into the error memory at least one error detected when the vehicle starts to move; when the at least one error recurs, incrementing the count of an error counter allocated to the at least one error in the error memory by a preselected amount; if, when the vehicle starts to move on a subsequent occasion, the count of the error counter reaches a preselected value for the at least one error, launching a poor maintenance program; and using the poor maintenance program, disabling the start of a vehicle function associated with the at least one error until expanded tests have been performed and passed.

2. The method according to claim 1, further comprising the step of deleting at least one of all and part of the count of the error counter when the vehicle has been driven for at least one of a preselected time and a preselected distance without errors.

3. The method according to claim 2, further comprising the step of decrementing the count of the error counter by a preselected amount when a part of the count of the error counter is deleted.

4. The method according to claim 1, further comprising the step of reactivating a vehicle test program using the poor maintenance program when the count of the error counter reaches zero.