Automatic control system for method and apparatus for checking devices of an automotive vehicle in use with a microcomputer

Abstract

An automatic control system for an automotive vehicle in use with a microcomputer has a checking system for checking an input unit, a ROM, a RAM and an output unit of the microcomputer. The checking system comprises a means which stores various checking programs to be executed for checking above-mentioned elements of the microcomputer. The checking system effectively operates to check the elements without causing expanding of duration of execution of the checking programs.

Description

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates generally to a control system including a digital computer or microcomputer system being capable of being mounted on an automotive vehicle for controlling various vehicle devices. More particularly, the present invention relates to a method and means for checking elements of the control system, after the control system has been assembled.

2. Background of the Invention

As is known to those skilled in the art, in recent years, it has become quite popular to control various vehicle systems automatically by using a datasdetector explained more concretely using FIG. 8. FIG. 8 is drawn in terms of a microcomputer system (such as the Motorola MC6802) which uses a 8×128 bit RAM, with address addresses from 0 to 127, but the same process can be carried out with minor modifications for different numbers of bits, numbers of bytes, and addresses. FIG. 8 is a flow chart of a program to check the RAM.

In the RAM check program, first in block 202 the data value N₂ representing the RAM address is set to 0. Next, in block 204 a particular data value D₄ is written into the address N₂ (=0). Next in block 206, the data D₅ is read out from address N₂ so as to be compared with the input data D₄ to decide whether both of the data values D₅ and D₄ match at step 208. When the data values D₅ , and D₄ match, the address data N₂ is compared with the last address number (=127) of the RAM at a step 210. When the result of comparing the address data N₂ and the last address number (=127) determines that the address data N₂ is smaller than 127, the checking program goes back to the process step 204. At this time, the address data N₂ is incremented by 1 in the process step 212 to address N₂ +1 to read out the stored data D₅ from the address N₂ +1 (=1) of the RAM at the process step 204. The stored data D₅ read from the address N₂ +1 is compared with the input data D₄, and it is decided whether it matches with the latter. As mentioned above, the checking program runs repeatedly until the result of comparing the address data N₂ and the last address number 127 are equal; namely, in the above example, the program is repeated one hundred twenty-eight times and until the value of the address data is 127. When address data N₂ is equal to the last address number 127, an "OK" signal is generated in a process step 214 and is outputted through the output unit. If some of the stored data D₅ is different from the corresponding input data D₄, a decision that the RAM operates incorrectly is made. At this time, an "NG" signal is generated in a process step 216 and is outputted:.

As mentioned hereinabove, the RAM can be checked whether it operates correctly by use of the checking means of a preferred embodiment of the invention, in which the above described checking program is stored in specific addresses of the ROM₂ 32 of FIG. 1. It should be understood that, at the start of checking and before running the checking program, the program will be read out from the ROM₂ 32. Further, it must be noted that, in the above-mentioned example the address data N₂ is cleared or reset to 0 at starting in the step 202. If the data values to be checked are stored in different addresses; for example, the data values are stored in the RAM at the addresses from 15 to 120, the first address number is written as the address data N₂ in the step 202 after clearing the data N₂ previously contained therein. If there are additional values stored in different, and perhaps a large number of groups of addresses, checking can be performed by repeating the above-mentioned program with respect to the first address of each group.

While it is possible for checking of the RAM to run the above-explained checking program to check data for all the combinations expected, since all the data values to be inputted and stored are binary numbers composed of only 1's or 0's, it will be sufficient for checking the RAM to check whether each bit of the RAM can be written 1 and 0 and be read out exactly as written. Therefore in practice, the checking program will be run to check the RAM with respect to a first and second data value. The second value data may be the complement of the first data value. Since both data value are combinations of 1's and 0's, checking with respect to the first and second data values can cover all the possible combinations of the data and therefor is sufficient for checking, the RAM. By this way of checking duration of running the checking program can be considerably shortened, and the storage are required for storing the checking program can be reduced to thereby lessen the capacity of the ROM₂ 32.

There are various ways in which error can occur in the input circuit, but the more common of these include the following cases: a short circuit between adjacent leads, a break in a lead, or a particular bit in a register staying at 0 or 1. In the short circuit case, adjacent bits in a register have the same values all the time (so-called horizontal short circuit). In the two latter cases, the value of a particular bit in a register never changes.

To detect the fault caused by the abovementioned horizontal short circuit case, data may be loaded into a register in a pattern of repeated binary 01's or 10's, so that adjacent bits do not have the same value. Upon read-out, if two adjacent bits have the same value, a short circuit is indicated.

Next, a method of checking for the other cases, is to first check with one set of data, and then to recheck with new data in which every bit is reversed, from 0 to 1 and vice versa, from the first set of data, checking that the operation is correct with both sets of data.

To carry out these two tests at the same time, a first check may be made with an input in which the first standard data is 01010101, and a second check in an input state in which the second standard data is 10101010.

When the number of input signals is high, if the data (D2) showing the address of the input and the standard data (D3) are separate for each of the input signals, the amount of data involved is very large, and the program size is increased. In cases like this, if the input signal data addresses are arranged to be consecutive, the first and last addresses of the data can be stored, and the check can be made by incrementing the address progressively through the data to the last address. If this is done the amount of data (D2) indicating addresses is decreased, and the ROM for the check program can advantageously be made smaller. Further, if the standard data uses the two patterns described above (viz. 01010101 and 10101010) there is not only the above described benefit of using these patterns, but also the ROM may advantageously be made smaller. In cases where 1 byte data items and 2 or 3 byte data items are mixed, the size of the ROM may be decreased by, instead of attaching to each data item a data determining the number of bytes in that particular data item, collecting together consecutively all data item with the same number of bytes and determining the number of bytes per items from the first and last address of the data.

When register addresses are made consecutive, and when the registers are physically adjacent, there is the possibility of a short circuit between registers. In this case the same bits in adjacent registers may be short circuited (so-called vertical short circuit), or adjacent bits in adjacent registers may be short circuited (so-called diagonal short circuit). These types of short circuit will happen only very rarely, but in cases where an extremely high level of reliability is required, it will be desirable to add procedures to check for them. In practice this will be done as follows.

First check the first address supposing that the address is even) with the first data value 00000000. (Choose an input state such that the input data naturally takes such a value.) Check the next address (an odd address) with the second data value 11111111. From there on, alternate the first and second data values in even and odd addresses. When this is done, in the vertical direction (i.e. between registers) the data bits will be aligned in a pattern of alternating 0's and 1's, and a vertical short circuit can be determined. Furthermore, in the diagonal direction the bits also alternate between 0 and 1, so that diagonal short circuits can also be detected.

If it is desired to check for a horizontal short at the same time as a vertical short, this can be done by checking using a first data value 01010101 in even addresses and a second data value 10101010 in odd addresses alternately.If this is done 0's and 1's alternate in both horizontal and vertical directions so that short circuits can be detected.

In case where the addresses of the input circuit registers are not consecutive or data items with the same number of bytes are not or cannot be arranged consecutively, then the input data may be organized in the manner described above, rearrranged, and stored in a RAM; the data can then be checked in the RAM. In this case it will also form a partial check of the RAM.

In the meanwhile, as another function of the RAM, it will be also essential to keep data written therein for a long period exactly as is. Therefore, when the RAM is checked, it is preferable to provide a sufficient time lag between writing data and reading out the same. Therefore, upon running or executing the checking program, the time lag may be provided between the steps 204 and 206. This can be performed by a delaying process step interposed between the steps 204 and 206. However, this may expand the duration of running the program and waste time; therefore, preferably the program will be arranged to contain a job in step 204 such as writing all of the required input data in sequence and then moving to step 206. By this, for the first data written in the RAM at first, there can be provided a time lag. If the time lag thus provided is insufficient, the abovementioned step can be interposed between the steps 204 and 206. In this case, the time lag to be provided by the step as a job is shorter than that required in the above example and will comparably decrease wasting of time.

Referring to FIG. 8, there is illustrated a flowchart which shows in detail the execution of the checking program in use with the checking means in accordance with the preferred embodiment of the invention. It should be noted that hereinafter described in an execution of the checking program in use with the Motorola Model No. MC 6802. However, the specific microcomputer system is used as an example for making a detailed description of the preferred embodiment of the present invention, and it should not considered limitative thereof. The present invention is applicable to all other microcomputer systems which can operate as sought in the invention. In the Motorola Model No. MC 6802, there is provided eight bits of RAM at addresses 0 to 127. Further, at addresses 1200 to 1203 there are respectively stored reference data values 01010101, 10101010, 00000000 and 11111111.

The checking program is started from START. At first, in process step 220, data N₃ counting the running phase of the program is cleared or reset to 0. The data N₃ is stored in an index-register (B-register) of the CPU, for example. In process step 222, an address data N₄ is cleared or reset to 0. The address data N₄ may be also stored in an index-register of the CPU, for example. In process step 224, reference data D₆ stored in address 1200×N₃ (=1200) is read out and is written in address N₄ (=0). On a process step 226, the address data is incremented by 1. In process step 228, complement data D₇ of the reference data D₆ is written in address N₄. In step 230, the address data N₄ is compared with the last address number (=127). If the value of the address data is smaller than that of the last address data, then the program will go back to step 224. At this time, the address data N₄ is incremented by 1 in process step 232. In other words, since the reference data D₆ stored in the address 1200+N₃ (=0)(=1200) is 01010101, the complement data D₇ is 10101010. As will be apparent from the flowchart of FIG. 9, since the beginning address is 0 and the address N₄ is gradually increased in steps 226 and 232, the value N₄ in the step 224 is even and that on the step 228 is odd. Therefore, by this series of execution of the program in the addresses 0 to 127 of the RAM, the reference data D₆ (=01010101) is stored in each even address and the complement data D₇ (=10101010) of the reference data D₆ is stored in each odd address. When the address data N₄ reaches 127 and is equal to the last address number, the program goes to the next process step 234. At step 234, the address data, which is 127, is cleared and reset to 0, again. In step 236, the stored data D₈ (=01010101) stored in the address N₄ and the reference data D₆ (=01010101) are read out and compared together. If the data D₈ is different from the data D₆, a jump instruction to executed process step 238 is generated in step 236. In step 238, the NG signal is generated and forwarded to be outputted. When the data values D₈ and D₆ are matched in step 236, the program proceeds to next process step 240. In step 240, the address data N₄ is incremented by 1. In step 242, the stored data D₈ (=10101010) stored in the address N₄ +1 and the reference data D₇ (=10101010) are read out and compared together. If the data D₈ is different from the data D₇, a jump instruction to jump the program to the process step 238 is generated. In step 238, NG signal to be outputted is generated. When the data values D₈ and D₇ match, the program goes to step 244. In step 244, the address data N₄ is compared with the last address number (=127). When the value of data N₄ is less than 127, the program goes back to step 236. At this time, the address number N₄ is incremented 1 on a process step 246. Execution of the program in the series of steps 236 to 244 is repeated until the address number reaches 127. When the address data N₄ is 127, in step 244 the value of address data N₄ matches or exceeds the last address number (=127), and the program goes to step 248. In step 248, the phase count data N₃ is read out from the B-register of the RAM and is compared with the last phase count number (=3). When N₃ is less than 3, the program goes back to step 222. At this time, the data N₃ is incremented by 1 on the process step 250. Then, the checking program is run or executed to check the function of the RAM with respect to the reference data 10101010 stored in the address 1201 and the complement data thereof. In the same manner, the checking program is further run and executed with respect to the reference data 00000000 and 11111111 respectively stored in the addresses 1202 and 1203 and the complement data thereof.

When the phase count data N₃ reaches 3 and matches the last phase count number (=3) in step 248, the checking program goes to process step 252 in which an OK signal is generated and forwarded to be outputted. Then, the checking program for checking the function of the RAM reaches the final step END. During running or executing the above-mentioned checking program, writing and reading data, performing the complement operation and the comparing operation is carried out by the A-register of the CPU, for example. The following Table II shows data written in addresses 0 to 9 of the RAM during each phase.

TABLE II
______________________________________
address phase
N3 = 0
N3 = 1
N3 = 2
N3 = 3
______________________________________
0        01010101  10101010  00000000
11111111
1        10101010  01010101  11111111
00000000
2        01010101  10101010  00000000
11111111
3        10101010  01010101  11111111
00000000
4        01010101  10101010  00000000
11111111
5        10101010  01010101  11111111
00000000
6        01010101  10101010  00000000
11111111
7        10101010  01010101  11111111
00000000
8        01010101  10101010  00000000
11111111
9        10101010  01010101  11111111
00000000
______________________________________

As will be understood from the above Table II,

during the first and second phases; i.e. during the phases in which the phase count, N₃ is 0 or 1, all the bits of the RAM can be checked as to whether each bit can be written with input data and read out without change;

during the third and fourth phases; i.e. during the phases in which the phase count is 2 or 3, all the bits of the RAM can be checked as to whether each bit can be written with input data and read out without change;

during phase 0, shorting between the same bits in adjacent addresses and adjacent bits in the same address can be checked;

during phase 1, shorting between the same bits in adjacent addresses and adjacent bits in the same address can be checked;

during phase 2, shorting between one bit in an address and adjacent bits to the left and right in adjacent addresses can be checked; and

during phase 3, the same checking operation can be made as in phase 2. By this, it will be appreciated that the checking program need not be executed for all the phases. Namely, for checking all the function of the RAM, it may be sufficient to execute the program for phases 0, 1 and 2, for example, it should be further appreciated that the above-explained flowchart in FIG. 8 can be applied to check the input unit without changing the chart except for the steps 222 to 232. If the flowchart of FIG. 8 is applied to check the input unit, the steps 222 to 232 will be omitted from the chart.

As mentioned above, the checking program as shown in FIG. 9 can perform checking of the functions of the RAM. However, in this way, the data previously stored in the RAM to be checked will necessarily be cleared or rewritten during execution of the checking program. In order to execute the control program, all of the data, some of which was previously stored and cleared during running of the checking program, should be re-written into the RAM after finishing the checking operation. This causes a waste of time due to writing of the data. If the data stored in the RAM is a history, for example, which can not be restored, it will be impossible to run or execute the checking program without losing some data. Therefore, it is recommendable that the necessary data is restored in other storage means such as, for example, in a temporary memory. However, if the control system is provided with the temporary memory, the RAM memory must be provided with a capacity twice that required for carrying out control operations. Otherwise, for restoring the necessary and important data in the RAM, there will be required another RAM connected to the former. For eliminating such a difficulty and drawback in the former flowchart, there is shown another flowchart of checking a program which can solve the above-mentioned problems, in FIG. 8. In the flowchart shown in FIG. 9, the addresses of the RAM 0 to 127 are divided into sixteen blocks, i.e. block Nos. 0 to 15. Each block is checked in sequence after finishing the check of the previous block. Upon executing the checking program for one of the blocks, data stored in the block is transferred and stored in the previous block to maintain the storage.

As shown in FIG. 9, immediately after START of executing the checking program, an address data N₉ is cleared and reset to 0 in process step 260. It should be noted that, in this chart, the address data N₉ indicates not individual addresses but the blocks of addresses previously divided. In step 262, the address data N₉ is compared with the last block number 15. When the value of the address data N₉ is smaller than 15, the program proceeds to process step 264. In steps 264 and 266, the data stored in each address is read out and checked in order by way of comparing the data with the reference data. The manner of checking in step 264 is substantially the same as illustrated in FIGS. 7 and 8. When the data stored and read out from each address of the block is matched with the corresponding reference data, the step of the checking program goes to a process step 268. In step 268, the data stored in the next block N₉ +1 is transferred and stored in the block N₉. Thereafter, the address data N₉ is incremented by 1 in process step 270. Then, the program goes back to step 262. The series of steps 262 to 260 are repeatedly carried out until the address data reaches 16. When the address data N₉ is 16 in step 262, the value of the address data N₉ exceeds the last block number 15, and the program step goes to process step 272. In step 272, an OK signal is generated and transmitted to be outputted, and N₉ is decremented by one. Then, in step 274, the address data N₉ is compared with the first block number 0. When the address data N₉ is larger than 0, the program goes to process step 276. In step 276, the data stored in the block N₉ -1 is transferred and stored in the block N₉. Thereafter, the address data N₉ is decremented by 1 on a process step 278. Then, the step goes back to the step 274. The series of steps 274 to 278 will be repeated until the address data N₉ and the first block number 0 match. If the result of checking in step 264 determines an error in step 266, the program goes to a process step 280. In step 280, an NG signal is generated and transmitted to be outputted. Thereafter, in step 274, the address data N₉ is compared with the first block number 0. When the address data N₉ is larger than 0, the program step goes to a process step 276. In step 276, the data stored in the block N₉ -1 is transferred and stored in the block N₉. Thereafter, the address data N₉ is decreased by 1 in process step 278. Then, the program goes back to the step 274. The series of steps 274 to 278 will be repeated until the address data N₉ and the first block number 0 match. Thereby, the functions of all the addresses of the RAM can be checked, and the previously stored data may be maintained except the data in the block 0. Thus, only unimportant data should be stored in block 0.

Now referring to FIG. 10, there is shown a flowchart of a checking program for checking functions of the ROM. Since the function of the ROM is to store programs to be run in the CPU and data for running the program in the form of a binary code or decimal representation, the checking is carried out by reading out the data stored in the ROM and comparing the data read with the data which should be stored in the addresses. Therefore, the checking may be performed, in practice, by comparing the data read with the reference data. The control program and the data thereof will be stored in the ROM₁ 31 of FIG. 1, and the checking program and the reference data will be stored in the ROM₂ 32 of FIG. 1. For performing checking of the function of the ROM, the stored data in each address of the ROM₁ 31 is read out in order and compared with corresponding reference data stored in corresponding addresses of the ROM₂ 32. When ROM₁ 31 is functioning correctly, the data read therefrom should match with the corresponding reference data. By the above method of checking, the function of the ROM₁ 31 can be checked. However, in such a process, ROM₂ 32 is required to have at least the same capacity as the ROM₁ 31. If the ROM₂ 32 is contained in the control system as a component, it necessarily increases the size of the ROM 30 of FIG. 1 comprising ROM₁ 31 and the ROM₂ 32. This may also cause an increase of the cost of the system. For avoiding such a drawback, it is preferable to perform checking the function of the ROM in use with a ROM and arithmetic unit provided outside the system. It will be appreciated that, if necessary, the CPU in the system can be used as an arithmetic unit for performing the checking operation. However, there is disclosed hereinafter an example of the use of a ROM and arithmetic unit provided outside the system. In this case, the data stored in the ROM of the system is read out therefrom and outputted to the arithmetic unit. At the same time, corresponding reference data is read from the ROM outside the system. The arithmetic unit operates to compare the data to see if they match. By this, only a program for reading out the stored data from the ROM of the system and outputting the same is required in the control system for checking the function of the ROM therein. Thereby, the control system can be reduced in size and cost. FIG. 10 is a flowchart of a program for reading and outputting the data stored in the ROM of the system. It should be noted that hereinafter disclosed is an example of a case in which the data is stored in addresses 1000 to 3999" of the ROM. Immediately after the START of the program, an address data N₅ which is generally stored in an index-register of the CPU, is set to 1000 in process step 302.

In the next process step 304, data D₉ stored in the address N₅ (=1000) of the ROM is read out. The data D₉ read is outputted through the output unit of the system, which method of output will be illustrated later, in a process step 306. Then, the address data is compared with the last address number (=3999) in a step 308. When the value of the address data N₅ is less than the last address, control goes to process step 310. In step 310, the address data N₅ is incremented by 1. Then control returns to process step 304 wherein the data D₉ stored in the address N₅ +1 of the ROM is read out. By repeating the above-mentioned series of steps 304 to 310, the function of all the addresses 1000 to 3999 of the ROM can be checked in order. When the address data N₅ reaches 3999 which matches with the last address number, the step 308 makes a decision that the checking program has run fully and finishes the job. The data read out and outputted is checked by comparing with the reference data corresponding thereto which is stored in the ROM provided outside the control system. It will be understood that the checking program is run in the arithmetic unit to which the data read from the ROM of the system and the reference data read from the ROM for checking are transferred and in which the comparison operation is carried out with respect to both data.

Now we explain a method for outputting the data from the control system. For outputting the data, there are provided a plurality of output terminals, the number of terminals corresponding to the number of data. It will be preferable that, since the outputting of the data is made by way of time sharing, the clock-pulse normally applied to the control system is outputted to the arithmetic unit for controlling the later in synchronism with the control system. This may result in eliminating the time lag between the operations of the control system and the arithmetic unit. This is also advantageous in making the checking operation accurate. Although the above-mentioned output system is preferable from the point of view of accuracy of checking result, it has the disadvantage that it requires a large number of output terminals in the control system. For avoiding and eliminating such a drawback or disadvantage, it will be practical to modulate the form of output data by pulse code modulation and to perform a parallel-serial conversion on the output data. By this, an output signal consisting of several bits, for example eight bits, of data can be outputted by one output line. Thereby, the number of output terminals provided on the control system can be considerably reduced. Further, by reducing the output terminals, it will be possible to increase durability of checking.

Hereafter disclosed is an example actually applicable to the control system of the present invention. In this example, for converting the parallel data to the serial data, there is employed a parallel-serial convertor, such as, for example, Motorola Model No. 6850 or Motorola Model No. 6852. The output data from the CPU is inputted and written in the parallel-serial convertor and is converted into a serial pulse code train. It is apparent that, in recent years, there have been developed microcomputer systems incorporating such parallel-serial converters, and if such a microcomputer is used, a further converter is unnecessary.

Although the above-mentioned output method can simplify the construction of the output circuit, it may increase the cost thereof. In view of the cost, it will be preferable to convert the parallel code data to serial code data without using a parallel-serial convertor. FIG. 11 shows a way of converting the output data from the CPU into a parallel code or pulse code train,. It should be noted that in FIG. 11 there is shown a process step corresponding to the process step 306 of FIG. 10 and in this step eight bits of data are converted from parallel code to serial code. After the START of the program, first the output is cleared to the value 0 in step 320. It should be noted that, in this program, a start-bit signal and stop-bit signal are generated and outputted to the arithmetic unit so as to start and stop execution of the program. The start-bit signal is generated by clearing the output from the value 1 to 0 and the stop-bit signal is generated by setting the output value to 1. Thus, when the output value is cleared from the value 1 to 0 and the arithmetic unit detects the start-bit signal, the program is started. After starting the arithmetic unit, the execution of the program is delayed in process step 322 by a period t₁ in order to adjust the interval for modulating the output data to a constant. This delay will be carried out by repeatedly executing NO OPERATION instructions or executing a looping program, which may have no meaning, for the required period. Thereafter, in process step 324, phase count N₆ is cleared to 0. In process step 326, the least significant bit of data D₉ is outputted to the arithmetic unit. In process step 328, the contents of D₉ are shifted one bit to the right, so that the bit above the least significant bit becomes the next bit to be outputted. After the operation of the step 328, a delay time t₂ is provided by process step 330. The method for providing the delay time t₂ is substantially the same as that explained with respect to step 322. After expiration of the delay time t₂, the phase count N₆ is incremented by 1 in process step 332. Then data N₆ is compared with 8 in step 334. When the value of N₆ is less than 8, the program goes back to step 326 to repeatedly execute the series of steps 326 to 334. The series of operation may be repeated until the value of the phase count N₆ reaches or exceeds the value 8 in step 334. Actually, in the above disclosed example, the series of operation is repeated eight times. When a decision that the data N₆ is equal to or more than 8, control goes to process step 336 in which the stop bit signal is outputted to the arithmetic unit. After expiration of a delay time t₃ provided by a process step 338, the program reaches END. The delay time t₃ is provided for the purpose of waiting for the arithmetic unit to finish the checking operation. Therefore, if the checking operation by the arithmetic unit can be finished in a substantially short period, step 338 is unnecessary and can be omitted.

It should be noted that, although in the specific flowchart the program for converting the parallel code to the serial code is disclosed hereabove, it can be embodied otherwise; for example, the decision step 334 can be arranged between the process steps 326 and 328. In this case, the phase count N₆ is compared with the value 7.

As a result of the above-explained parallel-serial conversion, a serial code, as shown in FIG. 12 as an example, can be outputted. In FIG. 12, is shown a waveform of the output signal having a value 01110101.

As the addresses of the ROM to be checked by the foregoing checking program may be previously decided before executing the program and as the data stored in each address is outputted in sequence, the address from which the data is outputted can be determined by counting the start bits outputted to the arithmetic unit. However, it will be preferable to output the address data N₅ together with the stored data D₉. In practice, the address data N₅ and the stored data D₉ will be outputted alternately. This may provide advantages and convenience for detecting the addres from which the stored data D₉ is outputted. Further, the counting element for counting the start bit from the arithmetic unit may be omitted so as to simplify the unit and to increase the durability thereof.

It should be clearly understood, that the above mentioned method for converting the parallel code to serial code can be applied to an output element for outputting the result of checking with respect to other units or elements for example, the input unit, or RAM.

Although the hereabove disclosed method can check the function of the ROM with respect to all the data stored therein, and further is advantageous to detect what data is in error, it takes a substantially long time to run the checking program both in the control system outputting all the data stored in the ROM and in the arithmetic unit carrying out the checking operation. For avoiding such drawback and disadvantages in the foregoing example, there is provided another method for checking the function of the ROM in use with the checking means in accordance with the preferred embodiment of the present invention. The other method will be disclosed hereinafter with reference to FIGS. 13 and 14. It should be noted that, for performing the hereafter explained checking method, there are two ways, one of which is calculating the sum of the value of all the data by an arithmetic operation and the other way is calculating the logical sum of the data by a logical operation. First, there is disclosed a method for checking the function of the ROM by way of calculating the arithmetic sum. FIG. 13 shows a flowchart of a program for checking the function of the ROM by calculating the arithmetic sum of all the data stored in the ROM. Immediately after the START of the program, a register A, which maybe an A-register of the CPU and in which the arithmetic sum of the data is to be stored, is cleared to 0 in process step 340. Thereafter, in process step 342, an address data N₅ is set to the value of the first address of the ROM. In this example, the ROM has addresses 1000 to 3999. Therefore, the address data N₅ is first set to 1000. In process step 344, the data D₉ stored in the address N₅ (=1000) is read out. The read data N₅ is added to the value in the register A in process step 346. Thereafter, in decision step 348, the address data N₅ (=1000) is compared with the final address number (=3999). When the value of the address data N₅ is less than 3999, the program goes back to process step 344. At this time, the address data N₅ is incremented by 1 in process step 350. Thereby, in a next series of steps 344 to 348, the data stored in address N₅ +1 (=1000) is added to the register A. The series of steps 344 to 348 is repeated until the address data N₅ reaches 3999. Therefore, in this example, the series of steps 344 to 348 is repeated four thousand times. When the step 348 decides that the address data N₅ has reached 3999, then the program goes to a decision step 352. In step 352, the data stored in the register A, which is the arithmetic sum of all the data values D₉, is read out and compared with a reference data values D₁0 . If the data values match, an OK signal is generated and outputted in process step 354. If the data values are different, an NG signal is generated and outputted in process step 356. It should be appreciated as a matter of course that the value of the reference data D₁0 will be previously preset to the arithmetic sum of the data values D₉. It is natural that when a large number of data values are added, the number of digits in the arithmetic sum will be high. Of course it is possible to check the function of the ROM by comparing all digits of the sum with the reference data D₁0. In this case, the reference data D₁0 must have the same number of digits as the sum. However, it will be preferable to check the sum with reference to the reference data D₁0 by comparing only some of the least significant digits with the corresponding digits of the reference data. For example, if eight bit of data values are added and if one or more values are in error, the difference between the sum and the reference data will become apparent by comparing the least significant bits of each byte. Therefore, the checking of the ROM cam be performed by comparing the least significant bits of the sum and the reference data D₁0. In the practical manner, when each data is added to the register A and when a column carry is made, the carried column can be omitted and merely the least significant bits of data must be stored in the register A. It will further be preferable to arrange the data to be added ito the arithmetic sum so that the value of the least significant bits of data, if there is no error is a predetermined value, for example, 00000000 or 01010101. This will also make it possible to check shorting between adjacent bits of register A.

Now we explain another method of checking the ROM by use of a sum of the data stored in the ROM, in which the exclusive logical sum is compared with the corresponding reference data D₁0. In practice, the exclusive logical sum can be calculated by an exclusive logical sum operation in process step 346 of FIG. 13 in which the data D₉ stored in the address N₅ is added to the register A. This means, in other words, checking the parity of the data. Of course the parity of the reference data should correspond to the parity of the data values. Further, if desired, a data value to adjust the parity may be used merely for the purpose of checking so that the exclusive logical sum is a predetermined value. It will be also possible to check the function of the ROM by checking the exclusive logical sum of all the data D₉ with reference to the reference data D₁0. This means a parity check being made with respect to the sum of data D₉. FIG. 14 shows a flowchart for running the checking program. Immediate after START, in process step 360, register A is reset to 0. Then, in process step 362, the address data N₅ is set to the first address (=1000) to be checked. It should be noted also in this example, that the data stored in addresses 1000 to 3999 is checked. In process step 364, a count N₆ with respect to each data D₉, is reset to 0. In process step 368, data D₉ stored in address N₅ of the ROM is read out. First, in step 370, the exclusive logical sum of the data D₉ and register A is formed, and stored back in register A. Thus the exclusive logical sum of the 2⁰ bit of register A and the 2⁰ bit of the data D₉ is stored in register A. Next, in decision step 372, the count N₆ is compared with the number of the most significant bit (=7) to check whether the all bits of data D₉ have been operated on in the exclusive logical sum with the 2⁰ bit of the register A. When the value of the count N₆ is less than 7, the program goes back to step 370. At this time, in process step 374, the count N₆ is incremented by 1 and in a process step 376, the data D₉ is shifted one bit to the right. The series of steps 370 to 376 is repeated until the count N₆ reaches 7. Namely the series of steps 370 to 376 is repeated eight times. Thus all bits of the data D₉ from 2⁰ to 2⁷ are operated on to calculate the exclusive logical sum with the least significant bit 2⁰ of the register A. When a decision that the count N₀ is equal to or more than 7 is made, the program goes to a decision step 378. In step 378, the address data N₅ (=1000) is compared with the last address number (=3999) to check whether the data of all the addresses of the ROM has been operated on. When the value of the address data N₅ is less than 3999, the program goes back to step 364. At this time, in process step 380, the address data N₅ is incremented by 1. Next, the series of program steps 370 to 374 is executed with respect to the data D₉ of the address N₅ +1 (=1001). The series of steps 364 to 380 including the series of steps 370 to 376 is repeated until the value of the address data N₅ is 3999; i.e. the series of steps 364 to 380 is repeated four thousand times. When the address data N₅ reaches 3999 and a decision that the address data N₅ is equal to or more than 3999 on the step 378 in made, the program goes to a decision step 382. In step 382, the value of the least significant bit of the register A is checked. In the example shown in FIG. 14, if the function of the ROM is correct, the value will be 1. Therefore, when the value of the least significant bit of the register A is 1, the program goes to a process step 384 to generate and forward to output an OK signal. On the other hand, if the value of the least significant bit of the register is 0, the program goes to a process step 386 to generate and forward to output an NG signal. Thereby, the parity of the data stored in the ROM can be checked.

As another method, a parity chek can be made by calculating eight separate exclusive logical sums in each of which the bit is shifted one bit to the left with respect to the bit of the preceding address; i.e., by calculating an exclusive logical sum of the 2⁰ bit of address 1000, the bit 2¹ of address 1001 . . . the 2⁷ bit of address 1007, the 2⁰ bit of address 1008 . . . the 2⁷ bit of address 1015 and so on. Next an exclusive logical sum is made of the 2¹ bit of address 1000 and so on and this is repeated until all the bits of all the data of the ROM are calculated in the exclusive logical sum. Namely, each series of operation such that the 2⁰ bit of address 1000 to the 2⁶ bit of address 3999, containing eight series of calculation, will be made. The results of the operation will be checked either per series or as a total as to whether the value of the least significant bit of register A is matched with the correct parity.

Although the above-mentioned checking method by way of checking parity can make it possible to check the function of the ROM easy, it may cause an error of checking in such a case that an even numbers of data values are incorrect, and thus, occasionally, the least significant bit of the A register may match with the correct value even though there are errors. This type of error will comparably frequently occur in the case of checking a large number of data values. For probabilistically avoiding such an error, one may divide the data into a plurality of blocks in which the exclusive logical sum is individually calculated and the parity checked. For example, in case of checking the parity with respect to data stored in address 1000 to 9999, the data is divided into three blocks, addresses 1000 to 3999, 4000 to 6999 and 7000 to 9999. For each block, the exclusive logical sum is calculated and the parity thereof is checked independently. When the parity of any one of the blocks is different from the correct parity, the NG signal is outputted to indicate that there are one or more data values in error.

Generally, the capacity of a RAM or ROM and the other devices employed for the control system is 2" bits for some integer n. For example, in one case, the capacity of the RAM is 2¹0 bits and the capacity of the ROM is 2¹3 bits, 2¹4 bits or 2¹5 bits. Comparing the amounts of the data and the capacity of the RAM or the ROM, it is naturally that the latter is larger than the former.

Therefore, if problems arise in one or more bits which are not used for storing data, it will not affect the control system and can be disregarded. Thus, it is sufficient to check the ROM and RAM within the area where the data for running the control program is stored. However, in considering shorting between bits, it will be preferable also to check the addresses adjacent to addresses storing the control data.

Checking whether the control program is executed can be carried out by checking the output data corresponding to the input data. For checking the output data, there may be used control data, such as, for example, data for table look up. Therefore, in a simple check of the control system, it will be necessary to check only the control data stored in the ROM. This may result in simplification of the checking program and shortening the duration of running of the checking program. Thus, this may provide advantages, but has a risk of error in checking the control system.

Now we explain a method for checking the output unit of the control system. Generally, the function of the output unit in a control system employing a microcomputer system is to write an output data forwarded from the CPU as a result of an operation thereof in an address where an output circuit is provided. Therefore, checking of the function of the output unit should be made with respect to whether the output data from the CPU can be written in the address of the output unit and can be read therefrom as it is. In practice, therefore, checking of the output unit can be performed by checking the inputted data and the output data and by checking whether these data values are identical. For the purpose of checking, data previously arranged for checking the output unit is written in the address of the output unit and is read out therefrom to output to a measuring means provided outside the control system.

In FIG. 15 is illustrated a flowchart of the checking program for checking the output unit. In FIG. 15, the checking program structure is constructed for checking an output unit having output circuits in addresses 30, 32, 34 and 36.

Immediately after START, a count N₇ is reset to 0 in process step 410. In process step 412, data D₁1 stored in an address 1304+N₇ (=1304) is read out and rewritten in the address determined by address data D₁0 (=30) stored in address 1300+N₇ (=1300). The values of data D₁1 and D₁0 will be found in Table III.

TABLE III
______________________________________
Address               Address
N7
(N00 + N7)
Data (D10)
(1304 + N7)
Data (D11)
______________________________________
0    1300       30         1304     10
1    1301       32         1305     20
2    1302       34         1306     30
3    1304       36          130     40
______________________________________

Then, in decision step 414, the count data N₇ is compared with the last count (=3). When the value of the count data N₇ is less than 3, the program goes back to step 412. At this time, the running phase data N₇ is incremented by 1 in a process step 416. Thereby, in the series of steps 412 and 414, the checking program is executed for data D₁0 (=32) and D₁1 (=20). The series of steps 412 to 416 is repeatedly executed until the count data N₇ reaches 3; i.e., the series of step 412 to 416 will be repeated four times. When the value of the count data N₇ is 3 and the step 414 determines that the data N₃ (=3) matches with the last count number (323), the program goes to END. At this time, the data D₁1 (=10, 20, 30, 40) is written to the output circuit provided in addresses D₁0 (=30, 32, 34, 36). Outputs which correspond to the data value D₁1, is outputted to the measured means. By the measuring means, each output is measured. The result of measurement is compared with corresponding data D₁1 to check whether the result is matched with the data D₁1. When, all the results are matched with respective corresponding data values D₁1, it indicates that the function of the output unit is correct, and otherwise it indicates that the output unit is damaged in one or more bits.

It should be appreciated that the value of data D₁1 may be changed to any value. However, it seems preferable to change the value of data D₁1 to 00000000, 11111111, 01010101 or 10101010, if eight bits of data are used. Thus, shorting between the bits can be checked as well as the function of output unit.

Although, as disclosed hereabove, the function of the output unit can be checked by use with the measuring means outside of the control system, it will be possible to check the output unit in use with the input unit. This maybe preferable as it requires no measuring means to be provided outside of the system. FIG. 16 shows, as an example, a preferred structure of checking means for checking the output unit. A control unit 190 comprises an input unit, a CPU, a RAM, one or more ROM's and an output unit. The input unit is provided with a plurality of input terminals I₁ to I₆. The output unit is provided with a plurality of output terminals O₁ to O₄. The input terminals I₁, I₂, I₄ and I₆ are respectively connected to the output terminals O₁ to O₄ through lines 1₁ to I₄. For the purpose of explanation only, from the output terminal O₁ is outputted an output signal in the form of a variable frequency signal; from the terminal O₂ is outputted an ON-OFF signal; from the terminal O₃ is outputted a variable pulse width signal; and, from the terminal O₄ is outputted an analog signal. Corresponding to the output signal outputted from each corresponding output terminals, the input terminal I₁ allows a frequency signal to pass; the terminals I₂ and I₃ allow an ON-OFF signal to pass; the terminal I₄ allows a pulse signal to pass; and, the terminals I₅ and I₆ allow an analog signal to pass. As mentioned above, if the number of input terminal is more than the number of output terminals, and the kinds of signal to be passed through the input terminals include all the kind of signals to be outputted from the output terminals, each output terminal will be simply connected to corresponding terminals. When the output terminal is connected to an input terminal which allows a different kind of signal to pass and can not allow the output signal outputted from the output terminal to pass, it is necessary to dispose a converter for adapting the output signal to the input signal to be passed through the input terminal. For example, if the output signal is a variable frequency signal, while the input terminal allows only analog signals to pass, it will be necessary to dispose a frequency-analog converter between the terminals. If the number of output terminals is more than the number of input terminal, a signal option device such as a multiplexer channel unit, will be provided so as to input different output signals to one input terminals by time sharing. For checking whether the output signal is identical to the data written in the output circuit, the programs shown in FIG. 17 will be linked with the program for checking the input unit as shown in FIG. 6, for example. In this case, the data written in the output circuit is outputted as an input signal of the input unit. In the input unit, the output signal forwarded from the output unit is stored and read out to check whether the data contained in the signal is identical to the data D₁1 with reference to a reference signal. It should be appreciated as matter of course that the reference data to be compared with the output signal is previously adapted to the data D₁1 corresponding to the output signal. It will be also appreciated that by checking the output unit by the latter method, it can also check the input unit, and if the input unit is damaged the output data transmitted from the output unit and stored in the input unit may not match the reference data. If an error occurs on checking whether the input unit or the output unit is damaged, either unit should be checked again by the foregoing individual checking methods. If there is a time lag between operations of the output unit and the input unit, it is recommendable to provide a delay circuit between the units for increasing the accuracy of checking. Further, it is preferable to arrange the data for checking the output unit so that in all bits of both of the output circuit and the input unit, 0 and 1 can both be written. Thus, shorting between the bits as well as checking of functions of the unit can be checked. It will be also recommendable to provide in the reference data a range corresponding to allowable range of the input and output units.

When the input unit and the control program is checked, as mentioned hereabove, the checking can be done by inputting a given input signal to the control system and checking outputs as a results of operation of the control system. However, if some error is detected during the above checking operation, it is impossible to distinguish whether the error is caused by errors of the input unit or an error of the program or operation of the micro-computer. For avoiding such inconvenience, it is preferable to determine the input data for executing the control program in use with the checking program. As an actual way of checking the control program and the CPU executing the control program, only data for executing the checking program is given and inputted, and at this time, the input signal forwarded from the input unit is not used for checking. In this way, even when the input unit is in error and therefore it cannot input correct data to the CPU, the control program and the CPU can be checked. Further, when the input unit includes an analog circuit for receiving analog input signal, X₁0, or a frequency signal circuit for receiving frequency signal, conversion errors caused by non-uniform signals, quantizing errors, etc. will not affect the checking operation of the control program. Thereby, the checking of the control program can be made without being affected by problems in the input phase, and the result of checking will be quite reliable.

Now we explain how to output the results of checking. It should be noted that the hereafter disclosed method of outputting the results of checking will be applicable to checking the input unit, the RAM, the ROM, the CPU and the output unit. At first, the simplest way to output the results is to provide a special output unit for outputting the checking results only. The special output unit will change the output in response to an OK signal or NG signal provided thereto during running or executing the checking program. This method is advantageous in not affecting the output for controlling the vehicle driving or vehicle equipment. However, this requires an increase of the output circuit which causes an increase of cost of the control system. For reducing the number of output circuits and thereby reducing the cost, one or more of the output circuits will be used in common for outputting checking result as well as for outputting control signals. In order not to affect, or to affect as little as possible output of the control signal and for controlling vehicle driving and other equipment, one or more output circuit, for outputting control signals for warning indicators or indication devices may be advantageously used for outputting the results of checking. Since such indicators are provided for the purpose of warning of erroneous operation of some element of the vehicle or indication of the condition of some feature, it will not affect actual driving or operation of other vehicle equipment. Further, by use with an output circuit as an indicator, the result of checking can be indicated visually, for example. Other output circuit, for example circuits for outputting a control signal to control engine driving, should not be used for outputting the checking results, as they may possibly cause a malfunction of the driving system. However, if the control unit is checked independently or separately from actual control of the driving system or of other vehicle equipment, it might be possible to use the output circuit thereof as the output circuit for outputting the checking results.

For outputting the checking result both in cases of using the output circuits for indicator or other elements, it is preferable to output the result within a substantially short period to avoiding affecting vehicle control, or reduce such effect as much as possible. Since, a variation of the intensity of an indicating lamp or light emitting diode in response to a variation of power over a period of several milliseconds cannot be visually detected, and since a relay circuit or electromagnetic valve etc. will not respond to such variation of power within several milliseconds due to the response delay, an electrical measuring device may be employed to be responsive to such a change of power even if the change occurs within a substantially short period. When the checking results are NG, the output is inverted for a short time period. By this, problems in the control system can be indicated without varying the output thereof. Further, when outputting the checking results, it is preferable to indicate other information of the checking result in addition to OK or NG; for example, what element of the control system is in error. In case of checking the ROM and RAM simultaneously, and when either one of the ROM and RAM is in error, the checking result is indicated as NG. For maintainance of the element, the control unit will obviously prefer to know what element should be repaired for making maintainance easy. When the control unit includes a plurality of ROMs and a notification is made as to which ROM is in error, it will possible to replace the bad ROM. This may result in reducing time and expense for maintenance thereof. When a plurality of input circuits are contained in the unit, it will also be convenient to be notified which input unit is in error. For indicating which element is malfunctioning, a number is associated with each element of the control system or each checking program.

FIG. 17 shows an example of outputting the result of checking with information as to which element is in error. When the checking results with respect to all the elements are OK, the program starts at START I. When the program starts at START I, output data D₁2 is reset to 0 in process step 420. The output data D₁2 is outputted in process step 422. It will be appreciated that the method of outputting the checking result is substantially the same as previously explained with reference to FIGS. 15 and 16. When the input unit is in error and during execution of the input unit checking program, an NG signal is generated, and the program starts at START II. In this case, in process step 424, the output data D₁2 is set to 1. In step 422, the data D₁2 (=1) is outputted. Thereby, when the indicator indicates 1, it indicates that the input unit is in error. When the RAM is in error and during the RAM checking program an NG signal is generated, the program starts at START III. In process step 426, the output data D₁2 is set to 2. The data D₁2 (=2) is outputted to indicate that the RAM is in error, in step 422. When the ROM is in error and during ROM checking programan NG signal is generated, the program starts at START IV. In process step 428, output data D₁2 is set to 3. The data D₁2 (=3) is outputted in step 422 to indicate that the ROM is in error. When the output unit is in error and an NG signal is generated during execution of the output unit checking program, the program starts at START V. In process step 430 the output data D₁2 is set to 4. The data D₁2 (=4) is outputted in step 422 to indicate that the output unit is in error. Thereby, data D₁2 is outputted to a measuring means provided outside of the control system. Thereby, whether the control system operates correctly and further, if there is an element in error, which element is in error, can be indicated. If desired, the output data D₁2 containing a combination of information can be indicated by some number representation. Although in the above-explained example uses specially arranged numbers for indicating which element of the control system is in error, it is possible to indicate the element in error by use of the address of the element in error. For example, for the address 10 of the input unit, the output data D₁2 is set to 10 on the step 424. Further, if desired, together with the output data D₁2 having a value corresponding to the address of the element in error, the contents of the address can be outputtted for convenience in seeking the cause of trouble.

When some element of the control system is in error, it is undesirable to keep the vehicle under the control of such a control system. It is preferable to indicate such a situation of the control system or cease operation of the control system, otherwise the vehicle may possibly be subject to danger. For indicating the problem with the control system, the output signal which is the result of checking can be used. It is also possible to vary the output to vary the warning condition to indicate what problem has arisen in the control system. The control program may be stopped by, for example, executing another program which is structured to loop so as not to output any output signals. It will also be possible to stop the vehicle by stopping the fuel supply or stopping the ignition, for example, in response to the output of the checking program.

Although as mentioned above, when the control system malfunctions, the vehicle may be protected from danger by stopping the control system or stopping the vehicle however, this procedure is not generally desirable as great inconvenience will be caused by malfunctions of the control system. For preventing such a drawback or disadvantage, it will be preferable to provide auxiliary elements in the control system which can replace malfunctioning elements. Generally some elements of a control system including a microcomputer unit for application to an automotive vehicle are capable of replacement when malfunctions of elements are detected on initial checking before the system is coated for the purpose of water or liquid proofing, but it is quite difficult to replace the elements after they have been encapsulated. Meanwhile, the elements employed in the control system, such as the ROM and the RAM, generally have an input so called chip-select for selecting the element. Therefore, it is possible to incorporate auxiliary elements so as to automatically replace the elements malfunctioning in response to the result of checking, by using the chip-select input. Thus, even if some element in the control system malfunctions, the control system can maintain correct operation in order to control the vehicle driving system and the other equipment. For example, when the ROM holding the control program malfunction, the output of the checking result of the ROM is inputted to the chip-select input thereof and the inverted output is inputted to the chip-select input of the auxiliary ROM. Thus, the faulty ROM is disconnected and replaced by the auxiliary ROM to maintain control of the control system for the vehicle driving system and the other vehicle equipment. With respect to the input and output units, there will be provided a plurality of circuits which are selectively used for inputting or outputting signals. For selecting the circuit, there will be further provided a relay-gate circuit to selectively connect the input or output circuit to the arithmetic operation unit of the control system. Further with respect to the output unit, when elements of the control system other than the output unit malfunction, the output unit can not output a correct control signal, even though the output unit itself is operating normally. In this case, it will be desirable to maintain output control signals by inputting the control data to the output unit from another control system. For example, for an ignition control system, when the control program for ignition control makes an error because a sensing element for detecting or measuring spark timing is damaged, as a replacement thereof, an auxiliary program for outputting a fixed control signal will be executed. Meanwhile, for a fuel control system, when the sensor for engine temperature or an input circuit for inputting an input signal of engine temperature is damaged, the fuel control program must be modified to stop correcting operation in response to engine temperature or to fix the input data for the engine temperature.

It will be appreciated that when the ROM is damaged, it is sometimes impossible to modify the control program. In this case, it will be preferable to change to a circuit which can generate a fixed output or to replace the control system of an other arithmetic unit which has the function of executing simple arithmetic operations.

Next, we refer to starting operation of the check program and a method for starting a plurality of checking programs, as subroutines of a program. As starting instructions for execution of the checking program, interrupt signals are preferred. In general, a microcomputer unit is provided with inputs for interrupt signals. These interrupt signals may be generated in response to input signals from the sensor used for detecting and measuring various vehicle driving parameters. When an interrupt signal is inputted, the executing program or subroutine is stopped and an interrupt processing routine is executed. If the interrupt processing routine is executed to execute the checking program interrupting the control programs, a decision program to decide whether to allow the interruption by the checking program will be unnecessary. Therefore, in this case, the control programs and the checking programs can be structured independently of one another to make programming easy and thereby each program can be simplified to shorten the duration thereof. The interrupt signals may or may not be capable of being masked or inhibited. If the interrupt signal is capable of being masked or inhibited, it will be possible to continue the control program or other checking program if it is in the interrupt, inhibit or masked state. Thereby the checking program can be executed only when the execution of the checking program will not affect the control system or vehicle driving; for example, when the engine is stopped or the vehicle is parked or stopped. Thus, even if an interrupt signal is generated and inputted due to noise or malfunction while the control system is operating to control vehicle driving, as the control program is in the masked state, the checking program is not executed. Meanwhile, if the interrupt signals are not capable of being masked, it will be preferable to give the checking program priority for interruption. Since the checking program is started in accurate synchronism with the inputted interrupt signal, the synchronization of the programs can be easily controlled.

When there are several checking programs to be executed, the interrupt priority will be determined in response to the combination of input signals. For example, if there are two digital signals, four checking programs can be controlled by the associated interrupts. In a control system with an interrupt system, the interrupt signals are variously combined to control the interrupt priority of each checking program. It is recommendable to include a program to stop execution of the checking program. Such a stopping program is useful when the interrupt signal cannot be masked so as to prevent the control system from malfunction even when such an interrupt signal is inputted due to error. Thereby, the control such as interrupt signal is inputted due to error. Thereby, the control system is reliable with respect to execution of the checking program, particularly to execution timing of the checking program.

FIG. 18 shows an example program having several checking programs as subroutines. When the power for the control system goes on, power-on reset 1002 is actuated. In process step 1004, flags F_CK, F_NG, F_RAM, F_ROM are reset to an initial condition. In this example, all the flags are reset to 0 for simplification of description. In process step 1006, each signal is set to its initial value. Thereafter, in step 1008, the control program is executed. Although the control program executing step 1008 is illustrated as a single block, it will be easily understood that the control program may be structured in various steps. Further, it should be appreciated that the control program often includes various subroutines for executing various control operations therein. However, this is not so closely relatedly to the concept of the present invention and for simplicity of explanation below, the control program will be explained hereafter as a single block. After execution of the control program in step 1008, the value of the flag F_CK is checked in decision step 1010. Normally, the value of the flag C_CK is 0. When the value of the flag is 0, the program goes back to step 1008 to repeat the control program. Then, if an interrupt signal is inputted uring execution of the control program, execution of the control program is then stopped and control goes to a step 1100. Then, the interrupt processing routine is executed. In process step 1102, flag F_CK is set to 1. Thereafter, in process step 1104, control is returned to step 1008 to execute the control program. After execution of the control program, in the decision step the flag F_CK is checked and a decision made as to whether to enter the checking program. It should be noted that the flag F_CK indicates whether an interrupt signal for executing the checking program has been inputted. In the example shown, when F_CK is 1, it indicates that an interrupt signal has been inputted. It will be further understood that, the flag F_CK is stored in a specific bit, called a flag bit. At the start of execution of the checking program, first the starter switch is checked to see if it is in the ON position or in the OFF position, in a decision step 1012. When the starter switch is in the OFF position, then an idling switch which closes the throttle completely when ON, is checked in a decision step 1014. When the idling switch is ON, in a process step 1016, the flag F_CK is reset to 0 and then control is returned to the control program. The subroutine structured series of steps 1012 to 1016 is provided to avoid a malfunction caused in the control system by inputting an interrupt signal generated by a malfunction of the sensing means. Namely, when the starter switch is in the OFF position, and the idling switch is in the ON position, the vehicle may be decelerating or idling, and these driving conditions arise relatively frequently. If due to a malfunction, the control system operates the checking program during vehicle operation, because the control program is therefore stopped for a short period, the engine may misfire, or behave erractically, and therefore for safety reasons the driver is likely to take his foot from the accelerator pedal. Therefore, it will be convenient to check whether the vehicle is in a position to execute the checking program, by checking the positions of the starter switch and idling switch. Although in the example shown, when the vehicle state with the starter switch OFF and idling switch ON is detected, the interruption program is stopped, and control goes back to the control program for controlling vehicle driving and operation of other vehicle equipment, it will be possible to check whether the vehicle driving condition allows execution of the checking program in other ways (not shown in the drawings). For example, when the vehicle has starter switch OFF and the idling switch OFF, switch positions which arise in normal driving, the interrupt subroutine or program may be stopped with control going back to a position executing the control program. Such switch positions indicate a normal driving state of the vehicle and at this time the checking program may not be desired to be executed to prevent error or stopping of control operation of the vehicle driving system or other equipment.

For avoiding malfunctions, there some further checking steps in the program shown, which will be exlained in detail.

When a decision that the starter switch is in the ON position is made step 1012, the position of the idling switch is checked in decision step 1018. When the idling switch is OFF, engine torque is checked. In step 1020, a check is made whether the engine torque exceeds 3,200 rpm. When a decision is made that the engine torque exceeds 3,200 rpm in the step 1020, flag F_RAM, indicating whether the RAM checking program has been executed, is checked in decision step 1022. If the value of flag F_RAM is 0, then the RAM checking program is executed in process step 1024. The structure of the RAM checking program is one of the foregoing RAM checking programs which have been illustrated with reference to FIGS. 8 and 9. During execution of the RAM checking program, the function of the RAM, writing data and reading out the same, is checked and also whether there are bits shorting with adjacent bits is checked.

Thereafter, the flag F_RAM is set to 1 in a process step 1026. Once the value of the flag F_RAM is 1 which indicates that the RAM checking program has been executed, then, when the program step comes to step 1022 again, a decision to return from the interrupt is made in the step 1022 and control goes to step 1008 where the control program is executed. Namely, since checking of the RAM need not be repeated, once the RAM checking program is executed, further execution of the RAM checking program is prevented to avoid unnecessarily long execution of the checking program. In decision step 1028, the result of execution of the RAM checking program in step 1024 is checked. The result of the RAM checking is indicated by the value of flag bit F_NG ; i.e., if the flag F_NG is 0 it indicates that the function of the RAM is correct, while the flag F_NG is 1 it indicates that the RAM is malfunctioning. In the program shown, merely whether the function of the RAM is correct is checked; namely whether the value of the flag F_NG is 0 or 1. However, as stated above, it will be possible to further check what kind of problems are occurring in the RAM or what address is faulty, if the result of the RAM checking is NG. When the flag F_NG is 0; i.e., the result of the RAM checking is OK, in process step 1030, an indicator for indication of the result of the checking program goes OFF. It will be appreciated that, as stated before, various vehicle indicators can be utilized for indication of the checking results. However, in the example shown, a visible warning means, such as a light emitting diode, is provided for indication of the checking result for the purpose of simplification of explanation. When the result of the RAM checking is NG and thus the value of the flag F_NG is 1, the indicator is turned on in process step 1032. Thus, when the RAM checking result is NG, it can be indicated by turning on an indicator. Thereafter, in a process step 1034, counter N₈ which indicates the run number of the checking program and also indicates the order of subroutines, in set to 0. In the example shown, the subroutine structure of a series of steps 1022 to 1034 is executed before other subroutines. Since the RAM holds data to be used for checking other elements of the control system, such as input unit, the ROM and output unit, it will be preferable to check the RAM first. However, it should be noted that the order of checking is not always required to start from the RAM, and therefore, the example shown should be understood as merely an example for illustration of the present invention. After setting the value of counter N₈ to 0, control goes back to step 1006.

In step 1018, when the idling switch is in the ON position, then the ROM checking subroutine is executed. First in a decision step 1036, flag F_ROM which indicates whether the ROM checking program is already executed is checked. Since the flag F_ROM is reset to 0 in step 1004, the flag F_ROM indicates 0 on the first time. Then, the ROM checking program is executed in a process step 1038. Although FIG. 18 shows the ROM checking program as a single block for simplification of explanation, it should be understood that there are included various steps for executing the ROM checking program. Actually, checking of the ROM is performed by either of the checking programs illustrated in FIGS. 10, 11, 13 or 14. After execution of the ROM checking program, the flag F_ROM is set 1 to prevent repeatedly executing the ROM checking program for the same purpose as stated above in the RAM checking, in process step 1040. In decision step 1042, the result of the ROM checking is checked. The result of the ROM checking is contained in the flag bit F_NG thus: when the function of the ROM is correct, the value of the flag F_NG is 0, while if the ROM is damaged or troubled, the flag F_NG is of value 1. When the function of the ROM is correct and thus the value of flag F_NG is 0, the indicator is turned in OFF on a process step 1044. If the ROM is faulty and thus the value of flag F_NG is 1, the indicator is turned to indicate visually that there is a fault in the ROM. Thereafter, in decision step 1048, the counter N₈ is checked. When the value of the counter N₈ is 0, the counter N₈ is set to 1 in step 1050, while if the value of the counter N₈ is larger than 0, the program goes immediately back to step 1008.

In step 1020, when the engine torque is less than 3,200 rpm, an input unit checking program I is executed through an input unit checking subroutine. As will be apparent from FIG. 18 and as different from the RAM and ROM checking subroutine, there is not provided a step for checking whether the input unit has already been checked by execution of the checking program I. The reason is that, since, in the case of inputting input data through and A/D convertor, for example, by time sharing, when a plurality of input data values are inputted to the input unit, it takes a comparatively long period and it may possible be that some data is inputted during or after execution of the input checking program; thus it is preferable to check the input unit repeatedly. It will also be seen from FIG. 18, that there are two different input unit checking programs; i.e., input unit checking program I and II. These input unit checking program I and II are provided to check the input unit twice in different driving conditions of the vehicle. Checking program I is executed under the vehicle conditions: starter switch on, idling switch off and engine torque less than 3,200 rpm, i.e. vehicle is idling, and the checking program II is executed under the driving conditions: starter switch off, idling switch off, i.e. the vehicle is parked or stopped. However, it is not always necessary to check the input unit twice as specified above, and it is of course possible to check the input unit one time in one vehicle condition adapted for execution of the checking program. Step 1052 may include various steps, and checking program I may be structured as illustrated FIG. 6.

During execution of the input unit checking program, the flag F_NG is set to 0 when the function of the input unit is correct and to 1 when the function of the input unit is incorrect and the unit is considered as faulty. Next, the counter N₈ is checked in decision step 1054. The value of the counter N₈ is incremented by 1 and thus becomes 2 in step 1056. Thereater, the value of flag F_NG is checked in decision step 1058. When the value of the flag F_NG is 0 and therefore a decision is made that the function of the input unit is correct, the indicator is turned off in a process step 1062, while, when the value of the flag F_NG is 1, the indicator is turned on in a process step 1064. Then, in decision step 1054, the counter N₈ is checked. When the value of the counter N₈ is 1, the counter N₈ is incremented to 2 in a process step 1056, whle when the value of the data N₈ is 3, the value of flag F_NG is checked in a decision step 1060. Thereafter, the program goes back to step 1008 to execute the control program. In decision step 1054, when the counter N₈ contains a value other than 1 or 3, the program jumps the step 1056 and goes to the decision step 1058. In this case, the value of the data N₈ is either 0 or 2. When the value of the data N₈ is of 0, it means that either or both the RAM and ROM have not yet been checked. Therefore, the result of checking with respect to the input unit is not reliable. When the value of N₈ is 2, this indicates immediately after checking the input unit by the input checking program I. Therefore, it is unnecessary to change the value of the data N₈. Then, as mentioned above, in step 1508 it is decided whether the function of the input unit is correct by checking the flag F_NG, and when the value of the flag F_NG is 0, the indicator is turned off in process step 1062. If the value of the flag F_NG is 1, and it is decided that the input unit is faulty, the indicator is tuned on to light an indicator lamp, for example to inform or warn of the fact in a process step 1064. When, in the decision step 1054 it is decided that the counter N₈ is 3, the value of the flag F_NG is checked whether it is 1 or 0 in decision step 1060. When the result of the checking is that the flag F_NG is 0, i.e., the function of the input unit is correct, the indicator is turned on in the process step 1064. If the value of the F_NG is 1 in the step 1060, the indicator is turned off in process step 1062. In both cases, after executing the job, the program goes back to step 1008. It will be appreciated that, the decision steps 1058 and 1060 which are both check steps after performing a checking operation as to whether the value of the flag F_NG is 0, have alternating functions in operating the indicator. This is so because when the checking subroutines for checking each element of the system are executed in a given order, all the elements function correctly. The execution of the checking program is finished after execution of input unit checking subroutine in the sequence of steps 1054-1060-1062 or 1064. Namely, it is intended in the example shown that the checking is performed in the order RAM checking subroutine - ROM checking subroutine - input unit checking subroutine I-input unit checking subroutine II - input unit checking subroutine I. When the functions of all the elements are correct, the indicator is kept in off until the final input unit checking subroutine.

In decision step 1014, if the decision is made that the idling switch is in the OFF position, i.e., the vehicle is in the normally driven state, the input unit checking program II is executed in proces step 1066. As will be easily understood, the checking program II may contain various steps and perform checking of functions of the input unit with respect to input data which has different input conditions from the input data for the input unit checking program I. During execution of the input unit checking program II in step 1066, the value of the flag F_NG is changed to 0 or 1 corresponding to the result of checking. The value of the flag F_NG is checked in decision step 1068. When the value of the flag F_NG is 0, the indicator is turned off in process step 1070, while when the value of the flag F_NG is 1, the indicator is turned on in process step 1076. Thereafter, the counter N₈ is checked in decision step 1072. When the data N₈ is 2, the value is incremented by 1 and thus the counter N₈ becomes 3. If the value of the data N₈ is other than 2, the program goes back to step 1008.

It will be understood the input unit checking subroutine II of sequence of steps 1066 to 1076 may be substituted by a subroutine for checking the output unit by way of substitution of the step 1066 from the input unit checking program II for the output unit checking program.

For performing the above-mentioned checking operation in the given order, input data will be arranged so that the input data indicates each vehicle driving condition in which the checking programs are executed in order. Thus, the indicator is operated in the given order, i.e. it indicates whether each function is correct in the order: RAM- ROM-input unit (checked by program I)-input unit (checked by program II)-input unit (checked by program I). Meanwhile, it will be possible to detect trouble or damage caused in the indicator itself or circuit of the indicator by observing the change between on and off, since if the indicator and circuit thereof is correct, the order of lighting of the indicator corresponds to the given order of checking. Further, it will also be possible to detect faults in the input circuit by inputing signals to execute checking programs with respect to signals. For example, when the input circuits are faulty, and the input signal are kept in a state indicating start switch on and idling switch on, only the ROM checking program is executed. In this case, when the function of the ROM is correct, the indicator is kept off. At this time, the operation of the indicator is different from normal and can indicate the problem in the input circuit, since the indicator functions alternately during execution of the final phase of the checking programs. However, it is also possible to indicate the result of the checking with a plurality of indicators receiving various output signals to indicate the result with respect to each element or with an indicator capable of varying the output pattern to indicate different results of checking with respect to each element. Thus, it will be advantageous to use as indicator and single output pattern in view of the ease of observing the results and cost of the system.

It will be noted that, in the example shown, after the execution of the RAM checking subroutine, control goes back to step 1006 to reset to the initial condition all the data values so as to clear the data stored in the RAM for the purpose of avoiding errors in execution of the control program due to reading out such checking data and operating control on the basis of such data. Meanwhile, at this time, if the program goes back to the first step 1002, the counter N₈ and the flag F_NG are cleared, it causes the checking program to go back to the initial condition so as to loop and not proceed to next phase. It is further preferable that data for deciding what checking programs should be executed, is inputted to the CPU from the input unit, since for execution of the checking program, the data stored in the RAM is apt to be rewritten.

As mentioned in the example shown in FIG. 18, such a means for inputting input signals to the control system and thus for executing the checking program can be embodied relatively simply and, by use of such checking means, the control system can be easily checked even after it has been assembled. The means will be installed in a service station or mounted in a vehicle to check the control system easily.

The present invention, as illustrated above, can provide various and considerable advantages such as:

the functions of the control system can be checked even after being assembled or mounted on the automotive vehicle, and it may be checked in the vehicle without change of the control condition of the vehicle;

duration of execution of the checking program can be considerably and remarkably reduced;

all the functions of the control system can be checked, perfectly;

since, if desired, the information as to which element is faulty can be provided, it is convenient for looking for the faulty portion of the control system, mending or replacing the same and thus help reducing time for mending or replacing operation;

since it will be possible to replace the element or swith or the circuit which is faulty with an auxiliary element or circuit in response to the reslt of checking, it can increase durability of the control system;

since the control system can be checked easily even after the vehicle mounting the same is actually driven, the vehicle can be effectively protected from serious failures or accidents due to the problems with the control system; and

the checking can be quite easily performed in a service station having the checking means.

While the present invention has been shown and described with respect to the preferred embodiment, it should not, however, be considered as limited to these or mere and simple generalizations, or other detailed embodiments. Further, variations could be made to the form and the details of any parts or elements, without departing from the principles of the invention. Therefore, it is desired that the scope of the present invention, and the breadth of the protection sought to be granted by Letters Patent, should be defined solely by the accompanying claims.

Claims

1. In a control system for an automotive vehicle for controlling various devices in response to sensor signals fed from sensors, said system having a microcomputer for receiving and processing said sensor signals and for controlling said devices, said microcomputer including an input unit, an output unit, a CPU, and a memory storage device including a ROM and a RAM, a method of controlling said vehicle and checking operation of said microcomputer comprising steps of:

(a) operating a control program in said microcomputer in response to said sensor signals for controlling said vehicle devices,

(b) determining in said CPU and in response to said sensor signals at least a first and a second engine condition,

(c) in response to said first determined engine condition, operating a first checking program for checking operation of said memory storage device, operation of said first checking program including the steps of:

(i) in said RAM, feeding into said RAM a first plurality of data signals corresponding to a first set a data values,

(ii) reading out of said RAM said fed-in data signals,

(iii) comparing each of said read out data signals with each of said first plurality of data signals and generating a first error signal upon non-equivalence of same,

(iv) providing an indication of said first error signal,

(v) in said ROM, reading a second plurality of data values from storage locations of said ROM,

(vi) comparing at least the least significant bits of the sum of said read data values with a reference sum and generating a second error signal upon non-equivalence thereof,

(vii) providing an indication of said second error signal,

(d) in response to said second determined engine condition, operating a second checking program for checking operation of at least one of said input and output units, said second checking progrom program including the steps of:

(i) for said input unit, feeding into said input unit a third plurality of data signals corresponding to a third set of data values,

(ii) comparing in said CPU said third set of data values with one set of reference values stored in said memory storage device,

(iii) generating a third error signal if each of said third set of data values is not equal to each of said one set of reference values,

(iv) providing an indication of said third error signal,

(v) for said output unit, feeding a fourth plurality of data signals corresponding to a fourth set of data values from said memory device to said output unit,

(vi) comparing said fourth set of data values with another set of reference values,

(vii) generating a fourth error signal if each of said a fourth set of data values is not equal to each of said other set of reference values, and

(viii) providing an indication of said fourth error signal.

2. The method recited in claim 1 wherein said one set and another set are identical.

3. The method as recited in claim 2 further including the step of operating said second checking program for checking both said input and output units.

4. The method as recited in claim 3 further including the steps of feeding output signals from said output unit to said input unit for simultaneously checking operation of said input and output units by comparing, in said CPU, data fed to said output unit with data received by said input unit.

5. The method as recited in claim 1 wherein the second checking program in step (d) is preformed after execution of said first checking program in step (c).

6. The method recited in claim 1 wherein said vehicle has a starter switch and said first engine condition corresponds to the starter switch being ON, and said second engine condition corresponds to said starter switch being OFF.

7. The method as recited in claim 6 wherein said vehicle sensors include an idle speed sensor and an engine RPM sensor and said first checking program is divided into a first, RAM checking program, the operation thereof including steps (c)(i)-(c)(iv), and a second, ROM checking program, the operation thereof including steps (c)(v)-(c)(vii), said method further including the steps of:

(a) performing said RAM checking program in reponse to said idle switch being OFF and said engine RPM being above a predetermined value, and

(b) performing said ROM checking program in response to said idle switch being ON.

8. The method as recited in claim 1 wherein said steps of providing an indication of said first, second, third and fourth error signals include the steps of providing a visual indication of same.

9. The method as recited in claim 1 or 8 wherein a single indication is provided for said first, second, third and fourth error signals.