Electronic control unit

An ECU that controls an engine of a vehicle includes a MPU and an IC that monitors the operation of the MPU. The MPU is programmed to execute a verification result check and test selection function for selecting a test for verifying the function of the MPU. The MPU runs the selected test, and transmits a test result indicating the result of the test to the IC. The IC checks whether the test result from the MPU is correct or incorrect, and transmits a verification result to the MPU.

CROSS REFERENCE TO RELATED APPLICATION

This application is based on and incorporates herein by reference Japanese Patent Application No. 2007-65625 filed on Mar. 14, 2007.

FIELD OF THE INVENTION

The present invention relates to an electronic control unit that includes a microcomputer and an integrated circuit monitoring the operation of the microcomputer.

BACKGROUND OF THE INVENTION

Conventional electronic control units for vehicles are provided with functions of monitoring the operation of a microcomputer mounted therein as disclosed in JP 1998-507805A (U.S. Pat. No. 5,880,568) and JP 1999-505587A (U.S. Pat. No. 6,125,322). These electronic control units include a monitoring integrated circuit (IC) in addition to the microcomputer so that queries are transmitted from the monitor IC to the microcomputer. The microcomputer runs a test corresponding to a query from the monitor IC and transmits the result of the test to the monitor IC as a reply. The monitor IC compares the reply from the microcomputer with an expected value within the monitor IC to monitor the operation of the microcomputer.

The monitor IC is constructed to select a query to the microcomputer (that is, a test to be run in the microcomputer) and compare a reply from the microcomputer for the query with an expected value. As a result, the monitor IC needs to have a function to process replies from the microcomputer and a function to select a query, with the result that the construction of the monitor IC is complicated.

Furthermore, since the monitor IC separate from the microcomputer selects a query, it is difficult to achieve an attempt to run a test suitable for a current control mode in the microcomputer, for example. Since the monitor IC cannot recognize control modes of the microcomputer, it is impossible to select a query so that a test suitable for a current control mode is run.

SUMMARY OF THE INVENTION

The present invention therefore has an object to provide an electronic control unit that can simplify the function of a monitor IC to monitor the operation of a microcomputer, and readily select tests suitable for control modes.

According to one aspect of the present invention, an electronic control unit comprises a microcomputer and an integrated circuit (IC). The microcomputer performs processing for controlling a control target, and the IC monitors operation of the microcomputer. The microcomputer is programmed to select a test to verify functions of the microcomputer, run the selected test and transmit a test reply as a test result indicating a result of the test to the IC. The IC checks whether the test result transmitted from the microcomputer is correct or incorrect, thus monitoring the microcomputer operation.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

First Embodiment

As shown inFIG. 1, an electronic control unit (ECU)1includes a micro-processing unit (MPU)3as a microcomputer that performs various processing programmed for controlling an engine of a vehicle, and a monitor IC5that monitors the operation of MPU3.

The MPU3, for example, determines the control amount of an actuator for actuating the engine based on input information from various sensors and the like, and performs control processing for achieving such various control functions. Programs for achieving control functions of such control processing are pre-stored in a ROM (not shown).

For example, as one of control functions, an actuator control amount computation function as shown inFIG. 2is available. This actuator control amount computation function performs an operation “V1× constant A+constant B” for a voltage V1inputted from the main signal input system, when the main of main and sub signal input systems (not shown) provided in the ECU1is normal and the MPU3controls the engine in a normal mode. This operation result is defined as a control amount for the actuator. When the main signal input system becomes abnormal and the MPU3controls the engine in a fail-safe mode, the actuator control amount computation function performs an operation “V2×constant C+constant D” for a voltage V2inputted from the sub signal input system. This operation result is defined as the control amount. That is, in the normal mode, the processing of a path indicated by the dotted line inFIG. 2is performed. In the fail-safe mode, the processing of a path indicated by the alternate long and short dash line inFIG. 2is performed.

In the ECU1, to run a test for verifying the functions of the MPU3, the MPU3includes a verification result check and test selection unit (section or function)3aand a test result management unit (section or function)3b, and the monitor IC5includes a test result verification unit (section or function)5a. Furthermore, the MPU3and the monitor IC5communicate at a specific period interval (e.g., every 8 ms). The verification result check and test selection unit3aof the MPU3refers to information from the monitor IC5to select a test to be run this time, and specifically selects the test ID of a test to be run. The test ID is identification information of the test.

The MPU3performs tests of contents corresponding to test IDs selected in the verification result check and test selection unit3afor each of plural control functions #1, #2, and so forth. The test result management unit3bof the MPU3generates a test result indicating the result of running a test, and transmits the test result and the test ID to the monitor IC5. The test ID transmitted to the monitor IC5by the test result management unit3bis the test ID of the test run this time in the MPU3. The respective functions of the verification result check and test selection unit3aand the test result management unit3bof the MPU3are achieved by the MPU3executing programs in the ROM.

On the other hand, the test result verification unit5aof the monitor IC5checks the correctness of the test result transmitted from the MPU3, and transmits a right or error determination result (a test result verification result or simply as a verification result) to the MPU3along with the test ID of the test corresponding to it. The test ID transmitted to the MPU3by the test result verification unit5ais the test ID transmitted along with the test result from the MPU3. The test result verification unit5acounts up an error count ECic2(value of an error counter) each time it determines that a test result from the MPU3is “error,” and transmits the error count ECic2to the MPU3along with the test result verification result and the test ID.

The verification result check and the test selection unit3aof the MPU3refers to the test result verification result, the test ID, and the error count ECic2from the monitor IC5to select the test ID of the test to be run this time. Therefore, signals flow in the order of <1>, <2>, <3>, and <4> inFIG. 1. Furthermore, the test result verification unit5aof the monitor IC5stores the test ID transmitted from the MPU3, and at the same time, each time a specific period The elapses, checks whether the test IDs of all types have been transmitted from the MPU3for the duration of the elapsed specific period (whether tests of all types have been run). If the test IDs of all types have not been transmitted, it determines that the MPU3is abnormal. The test result verification unit5a, when having performed determination by the above all test run verification function, transmits a history verification result being a determination result of the all test run verification function to the MPU3along with the test result verification result, the test ID, and the error count ECic2.

The verification result check and test selection unit3aof the MPU3executes its processing as shown inFIGS. 3 to 7.

When electric power is applied to the ECU1, the MPU3performs processing of the verification result check and test selection unit3ashown inFIG. 3every specific period (8 ms) which is a communication interval with the monitor IC5. When the ECU1has been activated, each counter described later and the value of test ID in the MPU3are initialized to zero, and a flag described later is initialized to OFF.

As shown inFIG. 3, in the processing of the verification result check and test selection unit3a, in S110, it checks whether the processing is the first execution immediately after activation. If so (S110:YES), it proceeds to S115to execute test ID selection processing ofFIG. 4. In this embodiment, there are one to five test IDs to be used. The test ID selection processing selects the test ID of a test to be run from among 1 to 5; its detailed contents will be described later.

On termination of the test ID selection processing in S115, the verification result check and test selection unit3aproceeds to S120to initialize the error count ECmpu2to zero, and then the processing of the verification result check and test selection unit3aterminates. On the other hand, in S110, on determining that the processing is not the first execution immediately after activation (second time or later), it proceeds to S122to check whether it has received the history verification result, along with the test result verification result, the test ID, and the error count ECic2from the previous execution until this execution. If it does not receive the history verification result, it proceeds to S145; if it receives a history verification result, it proceeds to S125.

In S125, it checks whether the history verification result from the monitor IC5is “OK” indicating “normal,” and, if so, proceeds to S130to initialize the error count ECmpu1to zero, and then proceeds to S145. If it is determined in S125that the history verification result from the monitor IC5is not “OK,” it proceeds to increment the error count ECmpu1, and in the next S140, checks whether the error count ECmpu1has become equal to or greater than a prescribed reference value R1for determining error determination. Otherwise, it proceeds to S145.

In S145, it performs analysis of test result verification results shown in FIG.7, and then proceeds to S150. The analysis of test result verification results, which will be detailed later, analyzes the test result verification result received from the monitor IC5and the error count ECic2to determine final test results, which are the overall inspection results that includes the MPU3and the monitor IC5.

In S150, it checks whether the final test result determined this time in S145is “OK” indicating “normal.” If so, it proceeds to S115. Therefore, also in this case, the test ID selection processing ofFIG. 4is performed, and the error count ECmpu2is initialized to zero. If the final test result is not “OK” (S150: NO), it proceeds to S155to select the same test ID as selected previously as the test ID of the test to be currently run. Specifically, it sets the test ID sent from the monitor IC5along with the test result verification result as the test ID of the test to be currently run. By the processing of S155, the same test as the last test is run again. In the next S160, it increments the error count ECmpu2, and in S165, checks whether the error count ECmpu2has become equal to or greater than a prescribed value Em2for determining error determination. Otherwise, the processing of the verification result check and test selection unit3aterminates.

On determining in S140that the error count ECmpu1has become equal to or greater than the prescribed value Em1, or on determining in S165that the error count ECmpu2has become equal to or greater than the prescribed value Em2, it proceeds to S170to execute predetermined fail-safe processing. Then the processing of the verification result check and test selection unit3aterminates.

Since control proceeds to S170because some error may occur in the MPU3or the monitor IC5, conceivable fail-safe processing performed in S170is, for example, to reduce throttle opening to decrease the output of the engine. The prescribed values Em1and Em2for error determination used in the respective determinations of S140and S165may be the same value or different values.

Next, as shown inFIG. 4, when the test ID selection processing is started in S115ofFIG. 3, S210checks whether a current control mode is a normal mode. If so, S220executes test ID selection processing for a normal mode shown inFIG. 5. If a current control mode is not a normal mode but a fail-safe mode (S210: NO), control proceeds to S230to execute test ID selection processing for the fail-safe mode shown inFIG. 6. When the processing of S220or S230terminates, the test ID selection processing in S115in theFIG. 3terminates.

As shown inFIG. 5, in the test ID selection processing for normal mode executed in S220ofFIG. 4, S310initializes a second count (the value of a second counter) Cnt2used by the test ID selection processing for fail-safe mode described later to zero. S315checks whether the first count Cnt1is three or less, and if so, control proceeds to S320. S320checks whether the current test ID is one, and otherwise, control proceeds to S325to set the current test ID to one. Then, control proceeds to increment the first count Cnt1, and then the test ID selection processing for normal mode terminates. When S320determines that the current test ID is one, control proceeds to S330to set the current test ID to two, and then proceeds to S335.

On the other hand, when S315determines that the first count Cnt1is not three or less, control proceeds to S340to check whether the first count Cnt1is five or less, and if so, proceeds to S345. S345checks whether the current test ID is three, and otherwise, control proceeds to S350to set the current test ID to three, and then proceeds to S335. When S345determines the current test ID is three, control proceeds to S355to set the current test ID to four, and then proceeds to S335.

On the other hand, when S340determines that the first count Cnt1is not five or less, control proceeds to S360to check whether the first count Cnt1is six or less, and if so, proceeds to S365. S365sets the current test ID to five, and S370turns on an IC test run flag before proceeding to S335. The IC test run flag is a flag indicating an IC test period during which a test result (test result for verifying NG determination described later) to be determined intentionally as “error” is transmitted to the monitor IC5, and a test result verification result for it from the monitor IC5is verified to be “error.” When the test ID is set to five, and the IC test run flag is turned on, by processing (FIG. 8) of the test result management unit3bdescribed later, the test result to be determined intentionally as “error” is transmitted to the monitor IC5. Accordingly, when the IC test run flag is ON, it is normal that a test result verification result from the monitor IC5to the MPU3is “NG” indicating “error.” When S360determines that the first count Cnt1is not six or less, control proceeds to S375to return the first count Cnt1to zero. S380turns off the IC test run flag, and then the test ID selection processing for normal mode terminates.

In the test ID selection processing for normal mode, as shown inFIG. 13, the first count Cnt1laps around between zero and seven.

When the first count Cnt1is zero to three, the test ID is alternately set between 1 and 2 (S315to S330). When the first count Cnt1is four, the test ID is set to three. When the first count Cnt1is five, the test ID is set to four (S340to S355). When the first count Cnt1is six, the test ID is set to five, and the IC test run flag is turned on (S360to S370). When the first count Cnt1is seven, with the test ID set to five, the IC test run flag is turned off (S380). Test IDs of one and two (ID=1, 2) indicate tests of logics (processing executed during the normal mode) used during normal mode. Test IDs of 3 and 4 indicate tests of logics (processing executed during the fail-safe mode) used during fail-safe mode. In the test ID selection processing for normal mode, ID=1, 2 is selected more frequently than ID=3, 4. Test ID of 5 (ID=5) indicates a test of the monitor IC5.

Next, as shown inFIG. 6, in the test ID selection processing for fail-safe mode executed in S230ofFIG. 4, S310initializes the first count Cnt1used in the test ID selection processing for the normal mode described previously to zero. The next S415checks whether the second count Cnt2is three or less, and if so, control proceeds to S420. S420checks whether the current test ID is three, and otherwise, control proceeds to S425to set the current test ID to three. Control proceeds to S435to increment the second count Cnt2, and then the test ID selection processing for fail-safe mode terminates. When S420determines that the current test ID is three, control proceeds to S430to set the current test ID to four, and then proceeds to S435.

On the other hand, when S415determines that the second count Cnt2is not three or less, control proceeds to S440to check whether the second count Cnt2is five or less, and if so, proceeds to S445. S445checks whether the current test ID is one, and otherwise, control proceeds to S450to set the current test ID to one, and then proceeds to S435. When S445determines that the current test ID is one, control proceeds to S455to set the current test ID to two, and then proceeds to S435.

On the other hand, when S440determines that the second count Cnt2is not five or less, control proceeds to S460to check whether the second count Cnt2is six or less. If so, control proceeds to S465and sets the current test ID to five, S470turns on IC test run flag, and then control proceeds to S435. When S460determines that the second count Cnt2is not six or less, control proceeds to S475t6return the second count Cnt2to zero. S480turns off the IC test run flag, and then the test ID selection processing for fail-safe mode terminates.

In the test ID selection processing for fail-safe mode, as shown inFIG. 13, the second count Cnt2laps around between zero and seven. When the second count Cnt2is zero to three, the test ID is alternately set to three and four (S415to S430). When the second count Cnt2is four, the test ID is set to one. When the second count Cnt2is five, the test ID is set to two (S440to S455). When the second count Cnt2is six, the test ID is set to five and the IC test run flag is turned on (S460to S470). When the second count Cnt2is seven, with the test ID set to five, the IC test run flag is turned off (S480). Therefore, in the test ID selection processing for fail-safe mode, contrary to the test ID selection processing for normal mode, ID=3, 4 is selected more frequently than ID=1, 2.

Next, as shown inFIG. 7, in the analysis of test result verification results executed in S145ofFIG. 3, S510checks whether the test result verification result received from the monitor IC5is “OK” indicating “normal.” If so, control proceeds to S515to check whether the IC test run flag is ON. Otherwise, control proceeds to S520to check whether the error count ECic2received from the monitor IC5is zero. If so, control proceeds to S525. S525sets final test results being the overall inspection results that include the MPU3and the monitor IC5to “OK” indicating “normal,” and then the analysis of test result verification results terminates.

When S510determines that the test result verification result received from the monitor IC5is not “OK,” control proceeds to S530to check whether the IC test run flag is ON. If so, control proceeds to S535to check whether the error count ECic2received from the monitor IC5is one. If so, control proceeds to S525. Therefore, also in this case, a final test result is set to “OK.” On the other hand, when S530determines that the IC test run flag is not ON, this means that although the test result to be determined intentionally as “error” is not transmitted to the monitor IC5, the test result verification result from the monitor IC5is not “OK” (that is, “NG”). Since the test result transmitted from MPU3to the monitor IC5is considered to be really an error, control proceeds to S540to set the final test result to “NG” indicating “error.” Then, the analysis of test result verification results terminates.

When S535determines that the error count ECic2is not one, it is determined that a count-up function (processing of S745ofFIG. 10described later) of the error count ECic2in the monitor IC5malfunctions, control proceeds to S540to set the final test result to “NG.”

When S515determines that the IC test-execution flag is ON, this means that although the test result to be determined intentionally as “error” is transmitted to the monitor IC5, the test result verification result from the monitor IC5is “OK.” Therefore, it is determined that the function (test result verification unit5a) of the monitor IC5to determine a test result malfunction, and control proceeds to S540to set the final test result to “NG.” When S520determines that the error count ECic2is not zero, it is determined that the function (processing ofFIG. 10described later) to reset the error count ECic2in the monitor IC5malfunctions, and control proceeds to S540to set the final test result to “NG.” The final test result set to “OK” or “NG” in S525or S540ofFIG. 7is referred to in S150ofFIG. 3.

The MPU3, when the processing ofFIG. 3terminates, runs a test of contents corresponding to a test ID selected in S115or S155at that time for each of plural control functions #1, #2, and so forth. The following describes the contents of tests run in the MPU3.

The MPU3is put in the normal mode when the main of the main and sub signal input systems described previously, and in the fail-safe mode when the main signal input system is abnormal. In this embodiment, there are sixteen control functions #1to #16to be tested. Each of these control functions #1to #16performs during the normal mode, as shown inFIG. 2, a predetermined operation on the voltage V1inputted from the main signal input system to obtain the control amount and the like of the actuator corresponding to the control function. During the fail-safe mode, it performs a predetermined operation on the voltage V2inputted from the sub-signal input system to obtain the control amount and the like of the actuator corresponding to the control function.

In the test of test ID=1, for a path (processing path) during normal mode in the control functions #1to #16, a first dummy input value is afforded, and the result of an operation on the dummy input value is determined as a test result. In the test of test ID=2, for a path during normal mode in the control functions #1to #16, a second dummy input value different from the first dummy input value is afforded, and the result of an operation on the input value is determined as a test result. On the other hand, in the test of test ID=3, for a path during fail-safe mode in the control functions #1to #16, a third dummy input value is afforded, and the result of an operation on the input value is determined as a test result. In the test of test ID=4, for a path during fail-safe mode in the control functions #1to #16, a fourth dummy input value different from the third dummy input value is afforded, and the result of an operation on the input value is determined as a test result.

The first dummy input value may be a different value for each of the control functions #1to #16. The same is also true for the second to fourth dummy input values. For test ID=5, tests of the control functions #1to #16are not run. By processingFIG. 8described later, the test replies for IC test (test replies for verifying NG determination for verifying the functions of the monitor IC5and the test replies for verifying OK determination) are only created.

The test ID is set to any of one to four in the processing ofFIG. 3, and the MPU3runs a test having contents corresponding to the test ID for each of the control functions #1to #16. Alternatively, when the test ID is set to five in the processing ofFIG. 3, the processing of the test result management unit3bis run as shown inFIG. 8.

As shown inFIG. 8, in the processing of the test result management unit3b, S610checks whether the current test ID is five, and otherwise (that is, any one of one to four), control proceeds to S615. S615checks whether the result of the test run this time for each of the control functions #1to #16is correct. Specifically, in the MPU3, for each of the control functions #1to #16, a correct operation result when the first dummy input value described previously is afforded to a path during normal mode in the control function is stored as the expected value for the normal mode test. Moreover, in the MPU3, for each of the control functions #1to #16, a correct operation result when the third dummy input value described previously is afforded to a path during the fail-safe mode in the control function is stored as an expected value for fail-safe mode test.

If the current test ID is one or two, S615compares the test result with the expected value for normal mode test for each of the control functions #1to #16. If the compared two match, it determines that the test result is correct. Moreover, if the current test ID is three or four, S615compares the test result with the expected value for fail-safe mode test for each of the control functions #1to #16. if the compared two match, it determines that the test result is correct.

Therefore, when the test ID is one or three, if the test of a certain control function and the determination of S615are normally performed, S615determines that “Test result is correct.” When the test ID is two or four, if the test of a certain control function and the determination of S615are normally performed, S615determines that “Test result is not correct.” Tests of ID=1,3 are tests (tests expected as OK) expected that it is determined in S615that “Test result is correct.” Tests of ID-2 and 4 are tests (tests expected as NG) expected that it is determined in S615that “Test result is not correct.” Thus, the reason that not only tests expected as OK but also tests expected as NG are provided is to enable verification that determination in S615is not adhered to any of “YES” and “NO.”

For such a control function that it is determined in S615that test result is correct, S620creates a test replay indicating “OK” as a test result. For such a control function that it is determined in S615that test result is not correct, S625creates a test replay indicating “NG” as a test result.

Specifically, the test result is created according to rules shown inFIG. 9A. That is, when the test ID is one or two, if S615determines that the test result of a certain control function #n (n is any of 1 to 16) is correct, of numeric values described in a column of “ID=1” inFIG. 9A, a numeric value corresponding to “#n” is designated as a test result indicating “OK” for the control function #n. When the test ID is one or two, if S615determines that the test result of a certain control function #n is not correct, of numeric values described in a column of “ID=2” inFIG. 9A, a numeric value corresponding to “#n” is designated as a test result indicating “NG” for the control function #n.

Therefore, for example, when the test ID is one or two, if S615determines that the test result of a control function #1is correct, {01} is a test result indicating “OK” for the control function #1. When the test ID is one or two, if S615determines that the test result of a control function #1is not correct, {11} is a test result indicating “NG” for the control function #1. Numeric values described inFIG. 9and numeric values within { } are represented in hexadecimal.

Likewise, when the test ID is three or four, if S615determines that a test result of a certain control function #n is correct, of numeric values described in a column of “ID=3” inFIG. 9A, a numeric value corresponding to “#n” is designated as a test result indicating “OK” for the control function #n. When the test ID is three or four, if S615determines that the test result of a certain control function #n is not correct, of numeric values described in a column of “ID=4” inFIG. 9A, the numeric value corresponding to “#n” is designated as a test result indicating “NG” for the control function #n.

Therefore, for example, when the test ID is three or four, if S615determines that a test result of a control function #1is correct, {21} is a test result indicating “OK” for the control function #1. when the test ID is three or four, if S615determines that the test result of a control function #1is not correct, {31} is a test result indicating “NG” for the control function #1.

As described above, since tests of test ID=2, 4 are tests expected as NG that are to be determined in S615as “Test result is not correct,” if the MPU3is normal, when the test ID is m (m is any of one to four), numeric values described in a column of “ID=m” inFIG. 9Aare test replies for control functions #1to #16.

When S610determines that the current test ID is five, control proceeds to S630to check whether the IC test run flag is ON. If so (S630: YES), control proceeds to S635to create a test result for verifying NG determination to be determined as “error” in the monitor IC5as the test result for the control functions #1to #16. If the IC test run flag is OFF, (S630: NO), control proceeds to S640to create a test result for verifying OK determination to be determined as “correct” in the monitor IC5as the test result for control functions #1to #16.

Specifically, the test result is created according to rules shown inFIG. 9B. That is, S635designates a numeric value corresponding to “#n” of numeric values described in the left column ofFIG. 9Bas a test result for a control function #n. S640designates a numeric value corresponding to “#n” of numeric values described in a right column ofFIG. 9Bas a test result for a control function #n. Therefore, when the test ID is five, and the IC test run flag is ON, test replies of the control functions #1to #16all are “FF.” When the test ID is five, and the IC test run flag is off, for example, the test result of control function #1is {41}, and the test result of control function #2is {42}. When the test result is created for each control function #1to #16by the above processing of S610to S640, S645transmits a test result for the each control function #1to #16and the current test ID (that is, the test ID of the test selected and run this time in the MPU3) to the monitor IC5, and the processing of the test result management unit3bterminates.

The test result verification unit5ain the monitor IC5executes the contents of processing shown inFIGS. 10 and 11. Each time the test result verification unit5aof the monitor IC5receives the test result and the test ID transmitted from the MPU3, it starts the processing ofFIG. 10. The value of each counter in the monitor IC5is initialized to zero when the ECU1is started. S710performs test result analysis processing shown inFIG. 11.

As shown inFIG. 11, in the test result analysis processing S710, S810stores the test ID received this time from the MPU3as a test history in the history storage area in a memory provided in the monitor IC5. S815increments a history verification time count. Next, S820checks whether history verification time arrives at an interval of the specific period Thc described previously by determining whether the history verification time count reaches a threshold value corresponding to the specific period Thc. On determining that the history verification time count does not reach the threshold value, and the history verification time does not arrive (S820: NO), control proceeds to S855. On determining that the history verification time has arrived (S820: YES), control proceeds to S825. S825clears the history verification time count to zero, and S830checks whether the test IDs of all types from one to five are stored as the test history in the history storage area (that is, whether test IDs of all types have been transmitted this time for the duration of the elapsed specific period Thc, i.e., whether tests of all types have been run).

If there are test IDs of all types in the history storage area (S830: YES), S840sets a history verification result to “OK” indicating “normal,” and S850clears the test history (test ID) within the history storage area, and then proceeds to S855. If there are not test IDs of all types in the history storage area (S830: NO), S845sets the history verification result to “NG” indicating “error,” and S850clears the test history (test ID) within the history storage area, and then proceeds to S855.

By the above-described processing of S810to S850, the above all test run verification function has been achieved. In this embodiment, the specific interval Thc being an arrival interval of history verification time is, for example, 96 ms as shown inFIG. 13.

S855checks whether the test result verification result transmitted previously to the MPU3is “NG” corresponding to “error.” If the previous test result verification result is not “NG,” (S855: NO), control proceeds to S865. Otherwise (S855: YES), control proceeds to S860. S860checks whether the test ID received this time from MPU3is the same as the test ID received previously, and if so, control proceeds to S865. S865selects an expected value for determining correctness or incorrectness. The expected value for determining correctness or incorrectness is for checking whether the test result received from the MPU3is correct. Specifically, the monitor IC5, as shown inFIG. 12, stores the above rules stored in the MPU3that are exactly the same as those in the right side ofFIGS. 9A and 9B. S865, when the test ID received this time from the MPU3is M (M is any of one to five), selects a numeric value described in the column of “ID=M” inFIG. 12as an expected value for determining correctness or incorrectness for the test result for each control function #1to #16.

Next, control proceeds to S870to check whether the test result received this time from the MPU3matches the expected value for determining correctness or incorrectness selected in S865, for the control functions #1to #16. For all control functions #1to #16, if the test result and the expected value for determining correctness or incorrectness match (S870: YES), control proceeds to S875to set a test result verification result “OK” corresponding to “correct,” and then the test result analysis processing terminates. For one or more of the control functions #1to #16, if the test result and the expected value for determining correctness or incorrectness do not match (S870: NO), control proceeds to S880to set the test result verification result to “NG” corresponding to “error,” and then the test result analysis processing terminates. When S860determines that the current test ID is not the same as the previous test ID, control proceeds to S880to set the test result verification result to “NG,” and then the test result analysis processing terminates.

Referring back toFIG. 10, when the test result analysis processing terminates in S710, S712checks whether this time is the history verification time (that is, the S820checks whether the history verification time has arrived). If this time is not the history verification time, control proceeds immediately to S735. Otherwise, control proceeds to S715.

S715checks whether the history verification result set in S840or S845of the latest test result analysis processing is “OK.” If so, control proceeds to S720to initialize the error count ECic1to zero, and then proceeds to S735. If S715determines that the history verification result is not “OK,” control proceeds to S725to increment the error count ECic1. The next S730checks whether the error count ECic1has become equal to or greater than a prescribed value Ei1for error determination. If not so, control proceeds to S735.

S735checks whether the test result verification result set in S875or S880of the latest test result analysis processing is “OK.” If so, control proceeds to S740to initialize the value of error count ECic2to zero, and then proceeds to S755. If S735determines that the test result verification result is not “OK,” control proceeds to S745to increment the error count ECic2. The next S750checks whether the error count ECic2has become equal to or greater than a prescribed value Ei2for error determination. Otherwise, control proceeds to S755.

On the other hand, on determining in S730that the error count ECic1has become equal to or greater than the prescribed value Ei1, or on determining in S750that the error count ECic2has become equal to or greater than the prescribed value Ei2, it proceeds to S760to execute predetermined fail-safe processing, and then proceeds to S755. Since control proceeds to S760because some error may occur in the MPU3, conceivable fail-safe processing performed in S760is to output a fail-safe signal to reduce the output of the engine in precedence over output from the MPU3. The prescribed value for determining error determination used in the respective determinations of S730and S750may be the same value or different values.

S755transmits information to the MPU3. Specifically, if this time is the history verification time at an interval of the specific period Thc, it transmits to the MPU3the test result verification result and the history verification result set in the latest test result analysis processing, the error count ECic2, and the test ID received from the MPU3along with the test result. If this time is not the history verification time, it transmits to the MPU3the test result verification result set in the latest test result analysis processing, the error count ECic2, and the test ID received from the MPU3along with the test result. After the processing of S755is performed, the processing ofFIG. 10terminates.

The following describes the operation of the monitor IC5by processing ofFIGS. 10 and 11.

If the MPU3is normal, as shown inFIG. 13, only when the test ID from the MPU3has become five from other than five (that is, when the IC test run flag has been turned on in the MPU3), the test result verification result becomes “NG” (S880). In other cases, the test result verification result becomes “OK” (S875). When the test ID from the MPU3has become five from other than five MPU3, the test replies for the control functions #1to #16transmitted from the MPU3to the monitor IC5all become {FF}, while expected values for determining correctness or incorrectness used in S870ofFIG. 11in the monitor IC5are {41}, {42}, {43}, . . . {50} as shown in the rightmost column ofFIG. 12.

When the MPU3is normal and the test ID to the monitor IC5has become from other than five to five, in the monitor IC5, since the test result verification result becomes “NG” and the error count ECic2is counted up by S745ofFIG. 10, “NG” is transmitted as the test result verification result from the monitor IC5to the MPU3, and one is transmitted as the error count ECic2. However, in this case, since the processing ofFIG. 7in the MPU3proceeds in the order of S510:NOS530:YESS535:YESS525, the final test result becomes “OK” instead of “NG.”

On the other hand, when an error occurs in the MPU3and, for example, as shown inFIG. 14, it is assumed that the result of running a test of ID=1 becomes a value different from the expected value used for determination in S615ofFIG. 8, the test result from the MPU3to the monitor IC5is different from numerical values {01}, {02}, . . . {10} described in the column of “ID=1” inFIG. 9A. Therefore, the monitor IC5determines in S870ofFIG. 11that the test result from the MPU3and the expected value for determining correctness or incorrectness do not match, sets the test result verification result to “NG” (S880), and counts up the error count ECic2(S745). When the test result verification result from the monitor IC5to the MPU3becomes “NG,” since the IC test run flag is not turned on in the MPU3, in the processing ofFIG. 7, determination is made as S510:NOS530:NO. The final test result is set to “NG” (S540). The processing of S155and S160inFIG. 3is performed, the test of the same test ID=1 as the last time is run again in the MPU3, and the same test ID (=1) as the last time is transmitted from the MPU3to the monitor IC5.

As shown inFIG. 14, when the test of ID=1 is not normally run for a long time in the MPU3, the error count ECic2is counted up in the monitor IC5(S745). When the error count ECic2reaches the prescribed value EI2, the determination in S750ofFIG. 10is made as “YES” and the fail-safe processing (S760) is performed. The error count ECmpu2is counted up also in the MPU3(S160). When the error count ECmpu2reaches the prescribed value Em2, the determination in S165ofFIG. 3is made as “YES” and the fail-safe processing (S170) is performed.

In the MPU3, for example, when a test result cannot be normally created in the processing ofFIG. 8, in the monitor IC5, since S870ofFIG. 11determines that the test result from MPU3and the expected value for determining correctness or incorrectness do not match, and error is detected.

As shown inFIG. 15, when, for example, test ID=3 is not selected for the specific period Thc (96 ms) or longer because of an error in the MPU3, in the monitor IC5, the history verification result is set to “NG” by the processing of S810-S850in FIG.11.” At the same time, the error count ECic1is counted up by the processing S715and S725ofFIG. 10. When that state lasts and the error count ECic1reaches the prescribed value Ei1, the determination in S730ofFIG. 10is made as “YES” and the fail-safe processing (S760) is performed. Furthermore, the history verification result at the interval of the specific period Thc by the monitor IC5is transmitted to the MPU3. When the history verification result becomes “NG,” in the MPU3, the error count ECmpu1is counted up by the processing of S125and S135ofFIG. 3. Also in the MPU3, when the error count ECmpu1reaches the prescribed value Em1, the determination in S140ofFIG. 3is made as “YES” and the fail-safe processing (S170) is performed.

Although the test result verification result previously transmitted to the MPU3is “NG” (that is, the previous test result from the MPU3is determined as “error”), when the same test ID as the previous one is not transmitted from the MPU3(S855:YESS860:NO inFIG. 8), the monitor IC5determines that the MPU3is abnormal, and sets the test result verification result to “NG.” Therefore, the abnormality (that is, abnormality of re-test run function) that the processing of S150and S155ofFIG. 3is not normally performed in the MPU3can be detected.

When the MPU3is normal but the test ID changes from five to other than five, the test result for verifying NG determination to be determined intentionally as “error” is transmitted from the MPU3to the monitor IC5. The test result verification result becomes “NG” in the monitor IC5. On receiving the test result verification result, since the IC test run flag is ON, the MPU3performs processing as S510:NOS530:YESS535:YESS525inFIG. 7, and the final test result becomes “OK.” Therefore, in this case, even if the test result verification result from the monitor IC5to the MPU3is “NG,” the processing of S150and S155inFIG. 3is not performed in the MPU3. However, in this case, by the processing ofFIG. 5or6performed in S115ofFIG. 3, the test ID remains set to five, which is the same as that in the last time. That is, test ID=5 is originally transmitted repeatedly twice from the MPU3to the monitor IC5. Accordingly, when the test ID from the MPU3becomes from other than five to five, even if the test result verification result becomes “NG,” the next time also receive the same test ID=5 as the last time, so that an incorrect determination is not made as abnormality without the determination in S860ofFIG. 11being made as “NO.”

The ECU1includes in the MPU3the verification result check and test selection unit3athat selects a test for function verification. The MPU3runs a test selected by the verification result check and test selection unit3a, and transmits the test result showing the execution result to the monitor IC5. The monitor IC5determines the correctness or incorrectness of the test result from the MPU3. Therefore, the monitor IC5does not need to have a function to select a test, so that the functions of the monitor IC5can be simplified. Still, since the MPU3itself selects a test, tests suited for control mode are very easily selected. Since the MPU3has all parameters concerning control states of the engine, such test selection is enabled.

Accordingly, in this embodiment, the verification result check and test selection unit3aof the MPU3, by the processing ofFIG. 4(FIGS. 4 and 5), during normal mode, selects tests (tests of ID=1, 2) of processing performed during the normal mode more frequently than tests (test of ID=3, 4) of processing performed at fail-safe. Conversely, during the fail-safe mode, it selects tests (test of ID=3, 4) of processing executed during the fail-safe mode more frequently than tests (test of ID=1, 2) of processing performed during the normal mode. That is, tests of processing performed during the current control mode are selected more frequently than tests of processing performed during other control modes. Such test selection corresponding to control modes enables quick detection of abnormality related to the current control mode.

Since the monitor IC5transmits the test result verification result being the result of determining the correctness or incorrectness of the test result from the MPU3to the MPU3, the MPU3can also check whether any abnormality exists, from the test result verification result from the monitor IC5.

The verification result check and test selection unit3aof the MPU3, by the processing ofFIG. 7, basically sets the final test result to “OK” if the test result verification result from the monitor IC5is “OK.” It sets the final test result to “NG” if the test result verification result from the monitor IC5is “NG.” When the final test result is “NG,” the same test as the previous one is selected (S155ofFIG. 3). Therefore, when the test result of the test is determined as “NG” in the monitor IC5(when the determination of S870ofFIG. 1is made as “NO”), the test is run again, and an abnormal condition can be verified not once but successively plural times. Furthermore, in comparison with the running of a re-test after a round of all types of tests, there is an advantage in that time until abnormality is determined can be reduced.

The MPU3transmits the test ID of the test run this time to the monitor IC5along with the test result. The monitor IC5sets the expected value of the test result from the MPU3based on the test ID from the MPU3(S865), and compares the expected value with the test result to determine the correctness or incorrectness of the test result (S870). Therefore, in comparison with, for example, the transmission of the expected value for determining correctness or incorrectness along with the test result from the MPU3to the monitor IC5, the accuracy of determining correctness/incorrectness by the monitor IC5can be increased.

In the above embodiment, the monitor IC5selects one corresponding to the test ID from among plural expected values for determining correctness or incorrectness stored in advance. However, expected values for determining correctness or incorrectness may be computed according to predetermined operation rules from the value of test ID.

In the ECU1of the embodiment, the monitor IC5transmits the test ID to the MPU3along with the test result verification result. The verification result check and test selection unit3aof the MPU3, when selecting the test ID of the same test as the previous one, selects the test ID from the monitor IC5as the test ID of the same test as the previous one. Therefore, this makes it possible to prevent the discrepancy between test IDs recognized in the MPU3and the monitor IC5, assuring re-test of the same test as the previous one, if desired.

When the monitor IC5determines that the previous test result from the MPU3is “error” but the same test ID as the previous one is not transmitted from the MPU3(S860: NO), the monitor IC5determines that the MPU3is abnormal, and sets the test result verification result to “NG.” As a result, abnormality of the function of the MPU3to run a re-test can be detected.

Since the monitor IC5has an all test run verification function by S810to S850ofFIG. 11, it can detect a fault of the MPU3such as “a specific test is not run.” The all test run verification function can respond to a change in a transmission order of test IDs from the MPU3.

Each time a test ID changes from other than five to five, the MPU3transmits the test result for verifying NG determination to be determined intentionally as “error” to the monitor IC5(S635), and determines by S510, S515, and S530ofFIG. 7whether the test result verification result from the monitor IC5to the test result is “NG.” Otherwise, it determines the result as abnormality (S510:YESS515:YESS540). Therefore, the MPU3can check whether the correctness/incorrectness function of the monitor IC5that determines correctness or incorrectness of the test result from the MPU3is normal.

Furthermore, the monitor IC5has a function (S745) to count up the error count ECic2each time it determines that the test result from the MPU3is “error,” and transmits the error count ECic2to the MPU3along with the test result verification result. The MPU3determines by S535ofFIG. 7whether the error count ECic2transmitted from the monitor IC5along with the test result verification result for the test result for verifying NG determination is normally counted up. Otherwise, it determines as “abnormal” (S535:NOS540). Therefore, the MPU3can check whether the count-up function of the monitor IC5to count up the error count ECic2is normal.

In the above embodiment, the verification result check and test selection unit3ain the MPU3operates as a test selection means. Of processing performed by the MPU3, S635ofFIG. 8and S510, S515, and S530ofFIG. 7operate as IC determination function test means. Of processing performed by the MPU3, S635ofFIG. 8and S535ofFIG. 7operates as IC count function test means.

Second Embodiment

In a second embodiment, an ECU has the same hardware configuration as the ECU1of the first embodiment, and hence the reference numerals of individual units are the same as those in the first embodiment.

In contrast to the ECU1of the first embodiment, the MPU3runs tests for checking whether the all test run verification function (S810to S850) of the monitor IC5, the function to reset the error count ECic1, and the count-up function (S715to S725) are normal. The monitor IC5transmits a history verification result to the MPU3in S755ofFIG. 10along with the error count ECic1. Therefore, the MPU3executes the processing of a verification result check and test selection unit3ashown inFIG. 16instead of the processing ofFIG. 3. The processing ofFIG. 16is different from the processing ofFIG. 3in the following points (1-1) to (1-3).

(1-1): S115performs test ID selection processing ofFIG. 17in place of the processing ofFIG. 4.

(1-2): When S122determines that the history verification result is received, S123performs the processing of analyzing history verification results ofFIG. 18, and then proceeds to S125.

Details of the processing of analyzing history verification results will be described later. The processing determines the history verification final result being an inspection result obtained by analyzing the history verification result received from the monitor IC5and the error count ECic1to comprehensively check whether tests of all types have been run in the MPU3, whether the all test run verification function of the monitor IC5is normal, and whether the reset function of the error count ECic1and the count-up function in the monitor IC5are normal.

(1-3): S125checks whether the history verification final result determined this time in S123instead of the history verification result received from the monitor IC5is “OK” indicating “normal.”

The following describes the test ID selection processing ofFIG. 17performed in S115ofFIG. 16. The test ID selection processing ofFIG. 17is an addition of the processing of S240to S270to the test ID selection processing (S210to S230) ofFIG. 4.

As shown inFIG. 17, in the test ID selection processing S115, S240checks whether the test run flag is ON. The MPU3, to check whether the all test run verification function of the monitor IC5is normal, intentionally prohibits the transmission of any (five of one to five in this embodiment) of test IDs of all types to the monitor IC5. The test run flag indicates the period (that is, a test period of the all test run verification function hereinafter referred to as a specific ID transmission prohibition period) during which the transmission of the test ID=5 is prohibited. The test run flag is turned on in S255described later, and turned off in S940or S950ofFIG. 18described later.

When S240determines that the test run flag is not ON, control proceeds to S245to check whether a value of a test start time counter (value of a test start time count) is equal to or greater than a time-up value. Otherwise, control proceeds to S250to increment the test start time count. Then, control proceeds to S210. The test start time count is for measuring elapsed time after the end of the previous specific ID transmission prohibition period. The time-up value is for determining after the end of the previous specific ID transmission prohibition period until the next specific ID transmission prohibition period is started. For example, it is set to a value several times or several tens times the specific time Thc. The processing of S210to S230is the same as those inFIG. 4. When the processing of S220or S230terminates, the test ID selection processing in S115inFIG. 16terminates. On the other hand, when S245determines that the test start time count is equal to or greater than the time-up value, control proceeds to S255to turn on the test run flag, and then proceeds to S260.

When S240determines that the test run flag is ON, control proceeds to S260. S260clears the test start time count to zero, and S265initializes the first count Cnt1used in processing of S220(test ID selection processing for normal mode:FIG. 5), and the second count Cnt2used in processing of S230(test ID selection processing for fail-safe mode:FIG. 6) to zero. S270performs ID selection processing during the periods of specific ID transmission prohibition. The ID selection processing during the periods of specific ID transmission prohibition sets the latest test ID to two if the current test ID (that is, a test ID transmitted last) is one, sets the latest test ID to three if the current test ID is two, sets the latest test ID to four if the current test ID is three, and sets the latest test ID to one if the current test ID is not any of one to three. When the processing of S270terminates, the test ID selection processing in S115inFIG. 16terminates.

That is, in the test ID selection processing ofFIG. 17, although the test ID is selected by the processing of the same S210to S230as that of the first embodiment until the test start time count reaches the time-up value (S245:NO, when the test start time count reaches the time-up value, the test run flag is turned on (S255) along with clearing the test start time count (S260). After that, until the test run flag is turned off in S940or S950ofFIG. 18, the test ID is changed between one and four except five by the processing of S270.

The analysis processing of history verification result is performed in S123ofFIG. 16, which is more fully shown inFIG. 18. In this analysis processing of history verification result, S910checks whether the history verification result received from the monitor IC5is “OK.” If so, control proceeds to S915to check whether the test run flag is ON. Otherwise, control proceeds to S920to check whether the error count ECic1received from the monitor IC5along with the history verification result is zero. If so, control proceeds to S925. S925sets the history verification final result to “OK” indicating “normal,” and then the analysis processing of history verification result terminates.

When S915determines that the test run flag is ON, control proceeds to S945to check whether a prescribed time Tov has elapsed after the test run flag is turned on. The prescribed time Tov is longer than the prescribed time Thc (96 ms) described previously. If the transmission of any test ID is prohibited for the time, the history verification result is to be set to “NG” by the all test run verification function of the monitor IC5. In this embodiment, this time is set to 112 ms, which is less than twice the specific time Thc.

When S945determines that the prescribed time Tov does not elapse, although the transmission of test ID=5 is prohibited for the period, since the all test run verification function of the monitor IC5cannot yet be determined to be abnormal, the analysis processing of history verification result terminate immediately. In this case, the history verification final result remains the same as the previous setting value.

On the other hand, when S945determines that the prescribed time Tov has elapsed, since the prescribed time Tov has elapsed after the transmission of test ID=5 is stopped, but the history verification result from the monitor IC5is “OK” instead of “NG,” it determines that the all test run verification function of the monitor IC5is abnormal. Control proceeds to S950to turn the test run flag OFF. S955sets the history verification final result to “NG” indicating “abnormal,” and then the analysis processing of history verification result terminates.

When S920determines that the error count ECic1is not zero, it determines that abnormality occurs in the reset function of the error count ECic1in the monitor IC5(S720), and proceeds to S950. Therefore, also in this case, the test run flag is turned off and the history verification final result is set to “NG.”

On the other hand, when S910determines that the history verification result from the monitor IC5is not “OK,” control proceeds to S930to check whether the test run flag is ON. If so, since the transmission of test ID=5 is prohibited in terms of period and the all test run verification function of the monitor IC5is normal, it can be determined that the history verification result from the monitor IC5is not “OK” (that is, “NG”). Therefore, control proceeds to S935to check whether the error count ECic1received from the monitor IC5is one. If the error count ECic1is one, since it can be determined that the count-up function (S725) of the error count ECic1in the monitor IC5is normal, control proceeds to S940to turn the test run flag off, and then proceeds to S925. Therefore, in this case, the history verification final result is set to “OK.”

On the other hand, when S930determines that the test run flag is not ON, it means that although the transmission of test ID=5 is not prohibited, the history verification result from the monitor IC5was “NG.” S930determines that tests of all types are not truly run, and proceeds to S955. Therefore, in this case, the history verification final result is set to “NG.”

When S935determines that the error count ECic1is not one, it determines that abnormality occurs in the count-up function (S725) of the error count ECic1in the monitor IC5, control proceeds to S950to turn the test run flag off, and then proceeds to S955. Therefore, also in this case, the history verification final result is set to “NG.”

In the second embodiment, the history verification final result set to “OK” or “NG” in the processing ofFIG. 18is referred to in S125ofFIG. 16, when the continuous number of times the history verification final result is set to “NG” becomes equal to or greater than a prescribed value, fail-safe processing is performed (S140:YESS170)

According to the ECU1of the second embodiment, the MPU3can detect that the all test run verification function of the monitor IC5has become abnormal. Furthermore, the MPU3can detect that the function to reset the error count ECic1in the monitor IC5and the function to count it up have become abnormal. The processing of S240to S270inFIG. 17and the processing of S910, S915, S945, S950and S955inFIG. 18operate as all test run verification function testing means. On the other hand, S935ofFIG. 18checks whether the error count ECic1is one or greater. If so, control may proceed to S940, determining as normal.

Third Embodiment

In a third embodiment shown inFIG. 19, the ECU1is different from the ECU1of the first embodiment in the following points (2-1) to (2-5).

(2-1): The monitor IC5includes, in addition to the test result verification unit5a, a test result verification unit5bhaving the same construction and functions as the test result verification unit5a. The two test result verification units5aand5boperate in parallel.

The fail-safe signal outputted in the processing of S760inFIG. 10by each of the test result verification units5aand5bis outputted to the outside of the monitor IC5via an OR circuit5c. In short, if at least one of two test result verification units5aand5boutputs the fail-safe signal, the signal is outputted from the monitor IC5to reduce the output of the engine. An AND circuit may be provided in place of the OR circuit5c. The two test result verification units5aand5bcorrespond to plural circuit blocks.

(2-2): The MPU3performs the processing of analyzing the test result verification results shown inFIG. 20in S145ofFIG. 3in place of the processing ofFIG. 7.

In the processing ofFIG. 20, S550checks whether a first test result verification result received from the monitor IC5is “OK.” The first test result verification result is one transmitted from the test result verification unit5a. If the first test result verification result is “OK,” S555checks whether the second test result verification result received from the monitor IC5is “OK.” The second test result verification result is one transmitted from the test result verification unit5b. If the second test result verification result is “OK,” control proceeds to S560to set the final test result to “OK,” and then the processing of analyzing the test result verification result terminates. When S550determines that the first test result verification result is “NG” or S555determines that the second test result verification result is “NG,” control proceeds to S565to set the final test result to “NG,” and then the processing of analyzing a test result verification result terminates.

Thus, in the processing ofFIG. 20, if all test result verification results transmitted from the two test result verification units5aand5bare “OK,” the final test result is set to “OK,” determining as normal. If any one of the test result verification results is “NG,” the final test result is set to “NG,” determining as abnormal.

Therefore, although in the first embodiment, the MPU3transmits the test result for verifying NG determination to the monitor IC5to confirm that the test result verification result for the test result is “NG,” according to the third embodiment, without performing such processing, influence by abnormality of the correctness/incorrectness function of the monitor IC5can be eliminated. This is because abnormality occurs in any of the two test result verification units5aand5bin the monitor IC5and the test result from the MPU3to the monitor IC5is truly wrong. However, even if the test result verification result from the faulty test result verification unit to the MPU3becomes “OK,” if the test result verification result from another test result verification unit is “NG,” the MPU3is not incorrectly determined as normal (that is, the final test result is not “OK.) Therefore, in the third embodiment, test ID=5 does not exist. In the MPU3, however, the test ID is set to any of one to four, and the test ID=1 to 4 is transmitted to the monitor IC5. Therefore, differences from the first embodiment are summarized as (2-3) to (2-5).

(2-3): The MPU3, in S220ofFIG. 4, performs the test ID selection processing for normal mode shown inFIG. 21in place of the processing ofFIG. 5. In S230ofFIG. 4, in place of the processing ofFIG. 6, the MPU3performs the test ID selection processing for fail-safe mode shown inFIG. 22.

Processing ofFIG. 21is different from the processing ofFIG. 5in that S360to S370, and S380are not provided. When S340determines that the first count Cnt1is not five or less, control proceeds to S375to return the first count Cnt1to zero, and then proceeds to S325to set the test ID to one. Therefore, test IDs are selected in the order of “1212341212341.”

Processing ofFIG. 22is different from the processing ofFIG. 6in that S460to S470, and S480are not provided. When S440determines that the second count Cnt2is not five or less, control proceeds to S475to return the second count Cnt2to zero, and then proceeds to S425to set the test ID to three. Therefore, the test IDs are selected in the order of “3434123434123.”

(2-4): The MPU3performs the processing ofFIG. 23in place of the processing ofFIG. 8as the processing of the test result management unit3b.

The processing ofFIG. 23is different from the processing ofFIG. 8in that S610and S630to640are not provided. In the MPU3, the rules shown inFIG. 9Bare not stored, and only the same rules ofFIG. 24as those ofFIG. 9Aare stored. S620or S625ofFIG. 23uses the rules ofFIG. 24to create the test result. Therefore, a procedure for creating the test result in S620or S625ofFIG. 23, and the contents of the test result created are the same as those in the first embodiment.

(2-5): Each of the test result verification units5aand5bin the monitor IC5stores the same rules ofFIG. 24as those in the MPU3in place of the rules ofFIG. 12. In the rules ofFIG. 24, information about test ID=5 is deleted in the rules ofFIG. 12. Each of the test result verification units5aand5bselects the expected value for determining correctness or incorrectness by using the rules ofFIG. 24in S865ofFIG. 11.

As another different point from the first embodiment, the MPU3determines in S125ofFIG. 3whether the history verification result from one of the two test result verification units5aand5b(e.g., the test result verification unit5a) in the monitor IC5is “OK.” Likewise, the MPU3sets in S155ofFIG. 3the test ID sent from one of the two test result verification units5aand5b(e.g., the test result verification unit5a) as the same test ID (that is, rest ID of re-test) as the previous one. In the third embodiment, the test result verification units5aand5bof the monitor IC5may not transmit the error count ECic2to the MPU3.

According to the ECU3of the third embodiment, in comparison with the first embodiment, the processing of the MPU3for verifying the operation of the monitor IC5can be made simpler. The MPU3may be constructed to compare the test result verification results transmitted from the test result verification units5aand5bof the monitor IC5to determine that the monitor IC5is faulty unless all of them are the same. In short, if the comparison of information from the test result verification units5aand5bresults in mismatch or disagreement, it can be determined that any of them is abnormal. Therefore, for example, the MPU3may be constructed to determine that the monitor IC5is abnormal unless all of test IDs transmitted from the test result verification units5aand5bof the monitor IC5are the same after comparing them. Still, the MPU3may be constructed to determine that the monitor IC5is abnormal unless all of the history verification results transmitted from the test result verification units5aand5bof the monitor IC5are the same after comparing them. By this construction, like the second embodiment, whether the all test run verification function of the monitor IC5is normal can be verified in the MPU3.

The present invention is not limited to the foregoing embodiments and modifications, but may be implemented in various ways without departing from the purport of the present invention.

For example, in place of two control modes, there may be three control modes or more. Without providing the NG expectation tests, only the OK expectation tests may be run. In this case, the test ID=1, 2 may be integrated to one test ID, and the test ID=3, 4 may be integrated to one test ID. The MPU3may transmit the result of the test to the monitor IC5as a test result without editing it, while the monitor IC5may determine correctness or incorrectness for the test result representative of the test result.