Abstract:
An automotive internal combustion engine electronic control unit for performing safety-related functions with a predetermined automotive safety integrity level, including: a microcontroller and an integrated circuit distinct from and communicating with the microcontroller. The microcontroller performs one or more safety-related functions with the same automotive safety integrity level as required to the automotive engine electronic control unit. The integrated circuit performs one or more safety-related functions with an automotive safety integrity level that is lower than that of the microcontroller. The integrated circuit performs, for each performed safety-related function, a corresponding diagnosis function for detecting failures in the performance of the safety-related function. The microcontroller performs, for each performed diagnosis function, a corresponding monitoring function for monitoring performance of the corresponding diagnosis function by the integrated circuit to detect failures that may compromise the diagnostic capability of the diagnosis function.
Abstract:
An automotive internal combustion engine electronic control unit for performing safety-related functions with a predetermined automotive safety integrity level, including: a microcontroller and an integrated circuit distinct from and communicating with the microcontroller. The microcontroller performs one or more safety-related functions with the same automotive safety integrity level as required to the automotive engine electronic control unit. The integrated circuit performs one or more safety-related functions with an automotive safety integrity level that is lower than that of the microcontroller. The integrated circuit performs, for each performed safety-related function, a corresponding diagnosis function for detecting failures in the performance of the safety-related function. The microcontroller performs, for each performed diagnosis function, a corresponding monitoring function for monitoring performance of the corresponding diagnosis function by the integrated circuit to detect failures that may compromise the diagnostic capability of the diagnosis function.