Patent Publication Number: US-2004054429-A1

Title: Control system having abnormality monitor function

Description:
CROSS REFERENCE TO RELATED APPLICATIONS  
       [0001] This application is based on and incorporates herein by reference Japanese Patent Application No. 2002-267050 filed on Sep. 12, 2002.  
       FIELD OF THE INVENTION  
       [0002] The present invention relates to a control system where a signal processing unit and a computation processing unit are connected through a data bus, and especially to the control system that has abnormality monitor function.  
       BACKGROUND OF THE INVENTION  
       [0003] Multiplex communications systems are recently formed, for instance, in an automotive. Of the multiplex communications systems a control system connects a signal processing unit, a computation processing unit, and an output processing unit to enable them to communicate data one another. Here, the signal processing unit sends a switch state or a sensor detection result as signal data. The computation processing unit computes based on the signal data sent by the signal processing unit, signal data sent by other than the signal processing unit, or internal control data to thereby send operation command data. The output processing unit activates, based on the received operation command data, an actuator or a load. This control system further includes a monitor processing unit for monitoring abnormality of the system. The monitor processing unit can detect and store the abnormality of the system for analyzing malfunction of the system or troubleshooting.  
       [0004] For instance, JP-B2-2980709 discloses a system including a single monitor processing unit that has the same input computation function as each of a plurality of computation processing units. Here, abnormality diagnosis for each computation processing is executed by comparing a computation result of each computation processing unit with that of the monitor processing unit.  
       [0005] Furthermore, for instance, JP-A-S60-35901 discloses a system including a function that stores, when abnormality occurs in an information sending unit of a vehicle, information around the time when the abnormality occurs. Here, the information includes an operation command for a control target device and an operating state of the control target device. The stored information is thereafter outputted when the vehicle returns to a garage. In the system, a detection method takes place as follows: a central station sends an operation command for a control target device to a terminal; after receiving it, the terminal activates the control target device while it sends operation information of the control target device to the central station; and an information monitor unit monitors the operation information of the control device that is sent to the central station to detect abnormality of the information.  
       [0006] As a system becomes highly functional, a vehicle is connected with tens of computation processing units, of which relating units are different depending on the respective functions. For instance, although a vehicle-speed door-lock and a driver-seat centralized door-lock functions relate to a door lock motor, each function uses different units. A user&#39;s claim regarding a malfunction results from inconsistency between an actual state and a function that the user expects. It means that a cause of the claim results from one of three cases. The first case is an abnormal operation that can be found by self-diagnosis. The second is an abnormal operation that cannot be found by the self-diagnosis. The third is user&#39;s mismanipulating or misunderstanding that is a normal operation for the system.  
       [0007] For instance, when a user&#39;s claim of “doors are automatically locked without any user&#39;s intention” is informed, it is not known which function executed locking the doors. Any related control devices cannot be picked up. Even if it is known that which function executed locking the doors, it cannot be known that which computation processing unit is causative.  
       [0008] Under this situation, using above conventional monitoring technologies exhibits a problem. For instance, when abnormality diagnosis for a present vehicle is executed by using the monitor processing unit in JP-B2-2980709, computation function corresponding to the tens of computation processing units must be installed in the single monitor processing-unit. The computation processing units are respectively developed by plural component manufacturers, so that it is very difficult to install the computation function corresponding to the tens of units to the single monitor processing unit. Vast memory is necessary for software having the computation function corresponding to the tens of units, so that a microcomputer for handling the software becomes expensive. Further, re-designing one of the computation processing units is followed by re-designing the monitor processing unit, which results in lessening maintenance efficiency of the system.  
       [0009] In above-mentioned JP-A-S60-35901, what the central station sends is only an operation command to the control target device. Further, on the assumption that the control target device in the terminal normally operates, the information monitor unit determines whether abnormality is present by monitoring the information sent to the central station. In this structure, when a signal unit, a computation unit, and an output unit exist as nodes within a network, objects for determining are limited to relation between the computation unit and the output unit. On the other hand, when considering relation between the signal unit and the computation unit, it is not known how the signal information sent by the signal unit is processed by the computation unit. Therefore, using the above conventional technologies does not lead to properly determining presence or absence of abnormality in the system.  
       SUMMARY OF THE INVENTION  
       [0010] It is an object of the present invention to enable a monitor processing unit to determine abnormality between a signal processing unit and a computation processing unit without grasping contents of computation function of the computation processing unit.  
       [0011] To achieve the above object, a control system is provided with the following. A signal processing unit sends, to a computation processing unit and a monitor processing unit, signal data that indicates a state of a switch or a detection result of a sensor. The computation processing unit executes a computation using the signal data sent by the signal processing unit or other, or internal data, and then sends operation command data to an output processing unit and operation condition data to the monitor processing unit. Here, the operation command data controls the output processing unit for activating at least one of an actuator and a load, while the operation condition data indicates that condition where an operation command trigger that activates an operation command target is effected. The monitor processing unit receives the operation condition data and stores it. The monitor processing unit determines whether abnormality is present, by comparing the stored signal data with the operation condition data received from the computation processing unit. This structure enables the monitor processing unit to determine abnormality between the signal processing unit and the computation processing unit without necessity of grasping contents of computation function of the computation processing unit.  
       [0012] For instance, in a door-lock system, a signal processing unit detects a state of a door-lock switch, while an output processing unit activates a door-lock motor. The monitor processing unit receives from the signal processing unit signal data indicating the door-lock switch shifts from an OFF state to an ON state. The monitor processing unit receives operation data including data indicating that the door-lock switch is in an ON state. In the case, information that the door-lock switch is on the ON state is commonly found in the signal data from the signal processing unit and the operation data from the computation processing unit. The monitor processing unit thereby determines that the door-lock normally functioned.  
       [0013] By contrast, the monitor processing unit receives from the signal processing unit signal data indicating the door-lock switch shifts from an ON state to OFF state. The monitor processing unit receives operation data including data indicating that the door-lock switch is in an ON state. In the case, information regarding the state of the door-lock switch is inconsistent between the signal data and the operation data. This leads to indicating possibility of abnormality between the signal processing unit and the computation processing unit or abnormality within the computation processing unit itself.  
       [0014] For instance, in a case where the abnormality determination result is stored somewhere, when a user claims that the door-lock automatically functions without any user&#39;s intension, the stored determination result enables analysis for the claimed item to be easily executed. 
     
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
     [0015] The above and other objects, features, and advantages of the present invention will become more apparent from the following detailed description made with reference to the accompanying drawings. In the drawings:  
     [0016]FIG. 1A is a schematic block diagram showing structure of a control system according to an embodiment of the present invention;  
     [0017]FIG. 1B is a diagram showing applied instances in a door-lock control system according to the embodiment;  
     [0018]FIGS. 2A to  2 C are diagrams showing contents of data in a signal device;  
     [0019]FIGS. 3A to  3 C are diagram showing contents of data in a computation device;  
     [0020]FIGS. 4A to  4 C are diagram showing contents of data in an output device;  
     [0021]FIG. 5A is a timing chart diagram explaining operations among the signal device, the computation device, and a monitor device;  
     [0022]FIG. 5B is a flow chart diagram explaining operations of the monitor device; and  
     [0023]FIGS. 6A to  6 C,  7 A to  7 C are schematic block diagrams showing structures of control systems according to other embodiments of the present invention. 
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS  
     [0024] The present invention is directed to a vehicular control system. Structure of the system according to an embodiment of the present invention is shown in FIG. 1A. The control system includes a signal device  1 , a computation device  2 , an output device  3 , and a monitor device  4 , each of which has a multiplex communications function and communicates data with one another through a communications bus  5 .  
     [0025] The signal device  1  includes a signal processing unit  1 A and a communications unit  1 B. It further includes switches (not shown) and sensors (not shown) and is capable of sending to the communications bus  5  states of the switches, e.g., ON/OFF states of a door-lock switch, and detection results of the sensor, e.g., vehicle speed. The control system includes only one signal device  1  in FIG. 1, but it can includes more than one signal device  1 .  
     [0026] The computation device  2  includes a computation processing unit  2 A and a communication processing unit  2 B. The computation device  2  executes given computation using signal data sent by the signal device  1  or other, internal control data or the like. It then thereby sends operation command data for activating a given function in the output device  3 . The control system includes only one computation device  2 . It means that the control system conceptually includes one computation device  2 . For instance, in a distributed control system including apparent plural computation devices  2 , when we focus attention on a given computation device  2 , the other computation devices  2  are treated as signal devices  1 .  
     [0027] The output device  3  includes an output processing unit  3 A and a communication processing unit  3 B. The output device  3  further includes an actuator or the like, and activates the actuators or loads, e.g., door-lock motor, based on the operation command data sent by the computation device  2 . Although this control system includes the output device  3 , an output device can be disposed in an external system or the like. Here, the operation command data can be externally sent by the computation device  2  to the external output device. Therefore, the control system can include no output device  3 , or one or more output devices  3 .  
     [0028] When the computation device  2  sends the operation command data to the output device  3 , it additionally sends operation trigger data and operation condition data. Here, the operation trigger data indicates a trigger for the operation command data that activates an operation command target, while the operation condition data indicates that a condition where the trigger indicated in the operation trigger data is effected. Hereafter, the operation command data, operation trigger data, and operation condition data are generally called operation data.  
     [0029] The monitor device  4  includes a monitor processing unit  4 A and a communication processing unit  4 B. The monitor device  4  receives the signal data sent by the signal device  1  to store the signal data in a memory (not shown). It further determines presence/absence of abnormality by comparing the stored signal data with the operation data received from the computation device  2 . Although this control system includes only one monitor device  4  in FIG. 1A, it can include more than one monitor device  4 . When more than one monitor device  4  are included, reliability of a determination result can be enhanced.  
     [0030] The communication processing units in the devices  1  to  4  can be combined as a common communication processing unit, as described later. “This control system can includes more than one signal device  1  or more than one monitor device  4 ” or “the control system includes only one computation device  2 ” does not necessarily mean that the same number of the communication processing units are included in the referred devices. Each device  1  to  4  does not necessarily include a communication processing unit as a unit. For instance, the signal device  1  must include a signal processing unit as a primary processing unit, but can include no communication processing unit.  
     [0031] Each of the communication processing units  1 A,  2 A,  3 A,  4 A is disposed between the communications bus  5  and each of the signal processing unit  1 A, computation processing unit  2 A, output processing unit  3 A, and monitor processing unit  4 A, to thereby relay various data among them.  
     [0032] Operations and data of a door-lock control system as applied instances are explained in FIG. 1B. Triggers for a door-lock command include a vehicle-speed door-lock function and a centralized door-lock function. The vehicle-speed door-lock function is effected under a condition where a vehicle speed exceeds a given speed or other conditions if existing. The centralized door-lock function is effected under a condition where a door-lock switch is turned on (shifted to an ON state), or other conditions if existing.  
     [0033] Information that should be grasped from the operation condition data is not which operation trigger is effected, but under which condition among several conditions the operation trigger is finally effected. In detail, it is not important that which operation trigger, the vehicle-speed door-lock function or the centralized door-lock function, generates a door-lock command, but it is important that under which condition the door-lock function is finally effected. Abnormality determination can be executed by additional considering added information that is which operation trigger, the vehicle-speed door-lock function or the centralized door-lock function, generates the door-lock command.  
     [0034] Here, words and detailed instances will be summarized as follows.  
     [0035] (i) Operation command target: door-lock motor  
     [0036] (ii) Operation command: door-lock command  
     [0037] (iii) Operation trigger: vehicle-speed door-lock function, centralized door-lock function  
     [0038] (iv) Operation condition: where vehicle speed exceeds given speed, where door-lock switch is in an ON state  
     [0039] Detailed instances of processing data in the signal device  1 , computation device  2 , and output device  3  will be explained.  
     (1) Data Processing in Signal Device  1   
     [0040] (1-1)  
     [0041]FIG. 2A shows an instance of contents of data that the signal processing unit  1 A of the signal device  1  generates. The data includes signal data D 11  and sending-timing specifying information D 12 . The data is generated based on an input from sensors. The sending-timing specifying information D 12  can be generated by the communication processing unit  1 B instead of the signal processing unit  1 A.  
     [0042] (i) The signal data D 11  includes as follows:  
     [0043] State signals such as ON/OFF or detection value of sensors  
     [0044] State-shifting signals such as OFF→ON, or ON→OFF  
     [0045] (ii) The sending-timing specifying information D 12  includes as follows.  
     [0046] Information with prior/posterior relationship: counter value (one counter value provided for one signal device  1  or one data ID is incremented or decremented every sending timing)  
     [0047] Information without prior/posterior relationship: random number that is not repeatedly present during a given period (one random number provided for one signal device  1  or one data ID is changed at sending timing) or a number calculated using a given mathematic function  
     [0048] Sending-time information (absolute time or relative time, time common among the devices or time dedicated to each device)  
     [0049] Number specifying signal data during a given period (either of with or without prior/posterior relationship)  
     [0050] information that changes only when a content of the signal data is changed  
     [0051] (1-2)  
     [0052]FIG. 2B shows an instance of contents of data (data unit) that the signal processing unit  1 A generates and stores in a memory within the communication processing unit  1 B. The data includes a data ID (DATA-ID) indicating a kind of sending data and a data length code (DLC) indicating a data length, in advance of the signal data D 11  and sending-timing specifying information D 12  shown in FIG. 2A. Here, the signal data D 11  and the sending-timing specifying information D 12  can be expressed with being combined with a part of the DATA-ID or the entire DATA-ID.  
     [0053] (1-3)  
     [0054]FIG. 2C shows an instance of contents of data (data frame) that the communication processing unit  1 B generates and sends to the communications bus  5 . The data is used in Controller Area Network (CAN). The data is formed of a header region, a data region, and a footer region. The header region includes a start-of-frame (SOF) that indicates a start of the frame in advance of the above DATA-ID and DLC. The data region includes the above-mentioned data signal D 11  and sending-timing specifying information D 12 . The footer region includes a cyclic redundant check (CRC) and an end-of-frame that indicates an end of the frame.  
     (2) Data Processing in Computation Device  2   
     [0055] (2-1)  
     [0056]FIG. 3A shows an instance of contents of data that the computation processing unit  2 A generates. The data includes operation command data D 21 , operation condition data D 22 , operation trigger data D 23 , operation-command-timing specifying information D 24 , and signal-data specifying information D 25 . The operation-command-timing specifying information D 24  can be generated by the communication processing unit  2 B instead of the computation processing unit  2 A.  
     [0057] (i) The operation command data D 21  includes as follows:  
     [0058] Operation command of “lock” or “unlock” 
     [0059] Operation continuing command of “continue a state of locking” or “continue a state of unlocking” 
     [0060] (ii) The operation condition data D 22  includes as follows.  
     [0061] Equivalents to signal data D 11  such as data indicating that a door-lock switch is in an ON state, data indicating that an effective condition that a vehicle speed exceeds a given speed (a final effective condition when plural conditions exist) or the like)  
     [0062] (iii) The operation trigger data D 23  includes as follows.  
     [0063] Kinds of control systems relating to the operation command target (e.g., vehicle-speed door-lock system, door-lock switch system)  
     [0064] (iv) The operation-command-timing specifying information D 24   
     [0065] Counter value (one counter value provided for one computation device  2  or one data ID is incremented or decremented every sending timing)  
     [0066] Random number that is not repeatedly present (one random number provided for one communication device  2  or one data ID is changed at sending timing) or a number calculated using a given mathematic function  
     [0067] Sending-time information (absolute time or relative time, time common among the devices or time dedicated to each device)  
     [0068] Number that is calculated using a given mathematic function and not repeatedly present during a given period  
     [0069] Number specifying the signal data D 11  during a given period (either of with or without prior-posterior relationship)  
     [0070] information that changes only when a content of the signal data D 11  is changed  
     [0071] (v) The signal-data specifying information D 25  includes as follows.  
     [0072] Sending-timing specifying information D 12  that is added to the signal data D 11  for effecting a function of the operation command target  
     [0073] Information that is generated based on the sending-timing specifying information D 12  and that specifies the signal data D 11  stored in the monitor device  4   
     [0074] Other information that specifies the signal data D 11  stored in the monitor device  4   
     [0075] (2-2)  
     [0076]FIG. 3B shows an instance of contents of data (data unit) that the computation processing unit  2 A generates and stores in a memory within the communication processing unit  2 B. The data includes a data ID (DATA-ID) indicating a kind of sending data and a data length code (DLC) indicating a data length in advance of the operation command data D 21 , operation condition data D 22 , operation trigger data D 23 , operation-command-timing specifying information D 24 , and signal-data specifying information D 25  shown in FIG. 3A. Here, the operation command data D 21 , operation condition data D 22 , operation trigger data D 23 , operation-command-timing specifying information D 24 , and signal-data specifying information D 25  can be expressed with being combined with a part of the DATA-ID or the entire DATA-ID. The operation condition data D 22  must be included, while the operation trigger data D 23 , the operation-command-timing specifying information D 24 , or the signal-data specifying information D 25  cannot be included. The operation command data D 21  is necessary for the output device  3 , while it is optional for the monitor device  4 .  
     [0077] (2-3)  
     [0078]FIG. 3C shows an instance of contents of data (data frame) that the communication processing unit  2 B generates and sends to the communications bus  5 . The data is used in CAN. The data is formed of a header region, a data region, and a footer region. The header region includes a start-of-frame (SOF) that indicates a start of the frame in advance of the above DATA-ID and DLC. The data region includes the above-mentioned operation command data D 21 , operation condition data D 22 , operation trigger data D 23 , operation-command-timing specifying information D 24 , and signal-data specifying information D 25 . The footer region includes a cyclic redundant check (CRC) and an end-of-frame that indicates an end of the frame.  
     (3) Data Processing in Output Device  3   
     [0079] (3-1)  
     [0080]FIG. 4A shows an instance of contents of data that the output processing unit  3 A generates. The data includes output data D 31 , operation-command-data specifying information D 32 , and output-timing specifying information D 33 . The output-timing specifying information D 33  can be generated by the communication processing unit  3 B instead of the output processing unit  3 A.  
     [0081] (i) The output data D 31  includes as follows:  
     [0082] Data indicating that the operation command data D 21  is received  
     [0083] Data indicating that whether an actuator or a load is activated based on the operation command data D 21   
     [0084] Data indicating whether an actuator or a load was actually activated based on the operation command data D 21   
     [0085] (ii) The output-timing specifying information D 32  includes as follows.  
     [0086] Counter value (one counter value provided for one output device  3  or one data ID is incremented or decremented every sending timing)  
     [0087] Random number that is not repeatedly present (one random number provided for one output device  3  or one data ID is changed at sending timing) or a number calculated using a given mathematic function  
     [0088] Sending-time information (absolute time or relative time, time common among the devices or time dedicated to each device)  
     [0089] Number that is calculated using a given mathematic function and not repeatedly present during a given period  
     [0090] Number specifying the signal data during a given period (either of with or without prior-posterior relationship)  
     [0091] information that changes only when a content of the signal data is changed  
     [0092] (iii) The operation-command-data specifying information D 33  includes as follows.  
     [0093] Operation-command-timing specifying information D 24  that is added to the operation command data D 21   
     [0094] Information that is generated based on the operation-command-timing specifying information D 24  and that specifies the operation command data D 21  stored in the monitor device  4   
     [0095] Another information that specifies the operation command data D 21  stored in the monitor device  4   
     [0096] (3-2)  
     [0097]FIG. 4B shows an instance of contents of data (data unit) that the output processing unit  3 A generates and stores in a memory within the communication processing unit  3 B. The data includes a data ID (DATA-ID) indicating a kind of sending data and a data length code (DLC) indicating a data length in advance of the output data D 31 , operation-command-data specifying information D 32 , and output-timing specifying information D 33  shown in FIG. 4A. Here, the operation-command-data specifying information D 32  or output-timing specifying information D 33  can be expressed with being combined with a part of the DATA-ID or the entire DATA-ID.  
     [0098] (3-3)  
     [0099]FIG. 4C shows an instance of contents of data (data frame) that the communication processing unit  3 B generates and sends to the communications bus  5 . The data is used in CAN. The data is formed of a header region, a data region, and a footer region. The header region includes a start-of-frame (SOF) that indicates a start of the frame in advance of the above DATA-ID and DLC. The data region includes the above-mentioned output data D 31 , operation-command-data specifying information D 32 , and output-timing specifying information D 33 . The footer region includes a cyclic redundant check (CRC) and an end-of-frame that indicates an end of the frame.  
     [0100] In the next place, operations of the monitor device  4  for monitoring abnormality of the system will be explained. FIG. 5A shows a timing chart of schematic operation of the signal device  1 , the computation device  2 , and the monitor device  4 .  
     [0101] As the signal device  1  sends signal data, the computation device  2  receives the signal data. The computation device  2  executes given computation using the signal data received from the signal device  1 , signal data received from other than the signal device  1 , internal control data, or the like. The computation device  2  then sends to the output device  3  operation data, which is received also by the monitor device  4 . The monitor device  4  thereafter determines whether abnormality is present.  
     [0102] A flow chart shown in FIG. 5B explains processing of determining presence/absence of abnormality by the monitor device  4 .  
     [0103] At Step  10 , the monitor device  4  receives the signal data sent by the signal device  1 . At Step  20 , the device  4  stores the received signal data in its memory  4 A. At Step  30 , the device  4  thereafter receives operation data sent by the computation device  2 . At Step  40 , the device  4  compares the received operation data with the stored signal data. At Step  50 , the device  4  determines whether system is normal or abnormal. In detail, the device  4  determines it by comparing operation condition data (D 22  in FIGS. 3A to  3 C) in the received operation data with the stored signal data. Here, the device  4  determines it with considering sending-timing specifying information D 12  (see FIGS. 2A to  2 C). Namely, when the signal data D 11  is repeatedly sent, the sending-timing specifying information D 12  is used for determining which data should be compared.  
     [0104] For instance, it is assumed that the signal device  1  sends signal data D 11  indicating that a door-lock switch shifts from an OFF state to an ON state. The monitor device  4  then receives and stores in its memory the signal data D 11  along with the sending-timing specifying information D 12  corresponding to the signal data D 11 . Thereafter, when the monitor device  4  receives, from the computation device  2 , the operation condition data D 22  that includes data indicating that the door-lock switch shifts to an ON state, that the door-lock switch shifts to the ON state is confirmed commonly in both the signal data D 11  and the operation condition data D 22 . The monitor device  4  thereby determines that door-lock control normally functions. Consequently, at Step  60  this case is determined to be normal. In detail, a determination result of normality that the door-lock switch shifts to the ON state and door-lock is thereby executed is stored, for instance, in a nonvolatile internal memory or the like. Here, the sending-timing specifying information D 12  is also stored along with the signal data D 11 .  
     [0105] Furthermore, for instance, it is assumed that the signal device  1  sends signal data D 11  indicating a vehicle speed. The monitor device  4  then receives and stores in its memory the signal data D 11  along with the sending-timing specifying information D 12  corresponding to the signal data D 11 . Thereafter, the monitor device  4  receives, from the computation device  2 , operation condition data D 22  including data that indicates an effective condition that a vehicle speed exceeds a given speed enabling execution of the door-lock. The monitor device  4  determines whether the stored vehicle speed actually exceeds the given speed. When the vehicle speed exceeds the given speed, it is determined that normal door-lock control functions to lock doors. Consequently, at Step  60  this case is determined to be normal. In detail, a determination result of normality that the vehicle speed exceeds the given speed enabling execution of the door-lock is stored, for instance, in the nonvolatile internal memory or the like. Here, the sending-timing specifying information D 12  is also stored along with the signal data D 11 .  
     [0106] Thus, the above stored determination result can be analyzed when a user claims that door-lock was executed without any user&#39;s intention. It is judged, through the analysis, that the execution of the door-lock is under normal condition and the user&#39;s claim may result from his misunderstanding. For instance, the user may mistakenly turn on the door-lock, or he may be unconscious of turning on the door-lock switch. He may not know the system where the door-lock is automatically executed when the vehicle speed exceeds the given speed. In any cases, knowing which operation condition was effective leads to easy analyzing of the execution of the function. Here, as the above cases where plural operation triggers, i.e., door-lock switch and vehicle speed, are present, the effected operation trigger is specified with the operation trigger data D 23  within the operation data. The operation condition is then compared.  
     [0107] By contrast, for instance, it is assumed that the signal device  1  sends signal data D 11  indicating that a door-lock switch shifts from an ON state to an OFF state. The monitor device  4  then receives and stores in its memory the signal data D 11 . Thereafter, when the monitor device  4  receives, from the computation device  2 , the operation condition data D 22  that includes data indicating that door-lock switch shifts to an ON state, it is judged that the door-lock was executed although the door-lock switch does not shift to the ON state. In this case, it is assumed that abnormality is present between the signal device  1  and the computation device  2  or in the computation device itself  2 . Consequently, at Step  70  this case is determined to be abnormal. In detail, a determination result of abnormality that the door-lock is executed without the door-lock switch shifting to the ON state and the vehicle speed exceeding the given speed is stored in the nonvolatile internal memory or the like. For instance, when a user claims that the door-lock is automatically executed without any user&#39;s intention, response to the claim can be shortly executed by consulting the stored determination result.  
     [0108] The monitor device  4  executes, in determining whether abnormality is present, one or more procedures included in the following.  
     [0109] (i) Abnormality presence/absence is determined by comparing signal data D 11  (see FIGS. 2A to  2 C) with operation condition data D 22  (see FIGS. 3A to  3 C).  
     [0110] (ii) Abnormality presence/absence is determined by additionally considering operation trigger data D 23  (see FIGS. 3A to  3 C) in addition to the procedure (i).  
     [0111] (iii) Abnormality presence/absence is determined by additionally considering sending-timing specifying information D 12  (see FIGS. 2A to  2 C) in addition to the procedure (i) or (ii).  
     [0112] (iv) Abnormality presence/absence is determined by additionally considering operation-command-timing specifying information D 24  (see FIGS. 3A to  3 C) in addition to the procedure (i), (ii) or (iii).  
     [0113] (v) Abnormality presence/absence is determined by additionally considering signal-data specifying information D 25  (see FIGS. 3A to  3 C) in addition to the procedure (iii).  
     [0114] (vi) Abnormality presence/absence is determined by additionally considering output data D 31  (see FIGS. 4A to  4 C) in addition to the procedure (i), (ii), (iii), (iv), or (v).  
     [0115] (vii) Abnormality presence/absence is determined by additionally considering output-timing specifying information D 33  (see FIGS. 4A to  4 C) in addition to the procedure (vi).  
     [0116] (viii) A determination result is stored, after determination is executed, along with information used in the determination, in addition to the any one of the procedures (i) to (vii).  
     [0117] Thus, according to the system of the embodiment, the monitor device  4  can determine abnormality between the signal device  1  and the computation device  2  even without grasping any contents themselves of a computation function of the computation device  2 .  
     [0118] Furthermore, as shown in FIG. 3C, the data frame sent by the computation device  2  includes, along with the operation command data D 21  indicating an operation command for the output device  3 , the operation condition data D 22  and operation trigger data D 23  used in abnormality determination in the monitor device  4 . The computation device  2  thereby only once sends this data frame without necessity of separately sending different data frames to either of the output device  3  or the monitor device  4 . Otherwise, the computation device  2  must send data including the operation condition data D 22  and the like to the monitor device  4  in addition to sending data including the operation data D 21  to the output device  3 .  
     [0119] (Modification)  
     [0120] Although the embodiment of the present invention is explained above, the present invention is not limited to the above embodiment, but also directed to various embodiments.  
     [0121] (i) In the door-lock system (see FIG. 1B), two operation triggers, a door-lock switch and a vehicle speed, are present, so that operation trigger data D 23  shown in FIGS. 3A to  3 B are necessary in the operation data. However, if the door-lock system is effected under only one condition that the door-lock switch shifts to an ON state, operation trigger is not necessary for being differentiated for determination. Namely, when only one operation trigger is present, the operation trigger is unnecessary.  
     [0122] (ii) A signal device  1 , a computation device  2 , an output device  3 , and a monitor device  4  are explained as independent devices. However, as shown in FIG. 6A, a single processing device  11  can include: a pair of a signal processing unit  1 A and a communication processing unit  1 B; a pair of a computation processing unit  2 A and a communication processing unit  2 B; a pair of an output processing unit  3 A and a communication processing unit  3 B; and a pair of a monitor processing  4 A and a communication processing unit  4 B. Here, within the processing device  11 , each of the communication processing units  1 B,  2 B,  3 B,  4 B can be disposed as mutually communicating data through a communications bus  5 .  
     [0123] In FIG. 6A, four communication processing units  1 B,  2 B,  3 B,  4 B are disposed for the signal processing unit  1 A, the computation processing unit  2 A, the output processing unit  3 A, and the monitor processing unit  4 A, respectively. However, as shown in FIG. 6B, a processing device  12  can include only one communication processing unit  8  commonly used for the signal processing unit  1 A, the computation processing unit  2 A, the output processing unit  3 A, and the monitor processing unit  4 A. Here, the signal processing unit  1 A, the computation processing unit  2 A, the output processing unit  3 A, and the monitor processing unit  4 A can mutually communicate data without any communications bus. In detail, a memory can be common for processing in the signal, computation, output, and monitor processing units  1 A,  2 A,  3 A,  4 A, e.g., by using a common RAM. Generating data frame in executing communication processing is naturally done by the communication processing unit  8 . Even when a signal function, a computation function, and an output function are thus assembled in one device  12 , the preceding functions are sometimes manufactured by the different manufactures, respectively. As a result, even within the one device  12 , in which function abnormality is present must be determined, so that the present invention can be effectively directed to this device  12 .  
     [0124] Further, as shown in FIG. 6C, a processing device  13  includes a set of a signal processing unit  1 A, a computation processing unit  2 A, an output processing unit  3 A, and a communication processing unit  21  that is commonly used for the preceding units  1 A,  2 A,  3 A. It further includes the other separated set of a monitor processing unit  4 A and a communication processing unit  22 . Here, the communication processing units  21 ,  22  communicate data through a communications bus  5  with each other. Any one or two of the signal processing unit  1 A, the computation processing unit  2 B, the output processing unit  3 A, and the monitor processing unit  4 A can be otherwise disposed as being separated from the other within one processing device.  
     [0125] (iii) In FIGS. 6A to  6 C, a signal processing unit  1 A, a computation processing unit  2 A, an output processing unit  3 A, and a monitor processing unit  4 A are included in any one of the processing devices  11 ,  12 ,  13 . However, the units  1 A,  2 A,  3 A,  4 A are dividedly disposed in plural devices. For instance, in FIG. 7A, a monitor device  4  having a monitor processing unit  4 A and a communication processing unit  4 B is separated from the other processing device  14  having a pair of a signal processing unit  1 A and a communication processing unit  1 B and a pair of a computation processing unit  2 A and a communication processing unit  2 B. Here, a monitor processing unit  3 A is not disposed within the processing unit  14 . Thus, a control system can be designed as including no output processing unit or device or as including one or more output units or devices. In FIG. 7A, the communication processing units  1 B,  2 B within the processing device  14  communicate data through a communications bus  5  with each other and also with the communication processing unit  4 B within the monitor device  4 .  
     [0126] As shown in FIG. 7B, a processing device  15  can be designed as including a communication processing unit  23  that is commonly used for a signal processing unit  1 A and a computation processing unit  2 A.  
     [0127] (iv) In FIGS. 1A, 6A,  6 B,  6 C,  7 A,  7 B, an independent control system is explained. However, in practical usage, plural systems can be related as shown in FIG. 7C. Here, the first control system  100  includes a signal device  101 , a computation device  102 , an output device  103 , and a monitor device  104 . The second control device  200  includes a signal device  201 , a computation device  202 , an output device  203 , and a monitor device  204 . However, the signal device  101  of the first control system  100  is integrated with the monitor device  204  of the second control system  200 , while the computation device  102  of the first control system  100  is integrated with the output device  203  of the second control system  200 . Furthermore, other devices are also integrated with other devices of a different control system. It means that monitor function in a network system having one or more control systems can be provided not only as being alone and independent, but also as being integrated within another device for lowering cost. Furthermore, this structure enables a network system to easily have a plurality of monitor functions. This leads to enhancing reliability by disposing a plurality of monitor functions to the same control system. This also leads to dispersing load of each monitor function by dividing a plurality of monitor control system targets into a plurality of the monitor functions.  
     [0128] It will be obvious to those skilled in the art that various changes may be made in the above-described embodiments of the present invention. However, the scope of the present invention should be determined by the following claims.