Abstract: An internal combustion engine is controlled by a plurality of partially reliability-relevant functional units. Every reliability-relevant functional unit comprises at least one functional module and at least one monitoring module. The monitoring module is separate from the functional module associated therewith and monitors the functioning of the functional module. The control device also comprises a higher order monitoring functional group. The monitoring module has an entry point for communication with the higher order monitoring functional group. When an error is detected, the monitoring module signals the error to the higher order monitoring functional group using the entry point.

Abstract: A vehicle control unit has a microcontroller, to which multiple analog supply voltages are applied, and a monitoring unit for the functional monitoring of the microcontroller. The microcontroller includes an A/D converter for the conversion of the plurality of analog supply voltages into digitized supply voltages. A computing area of the microcontroller which is computationally secured is provided for monitoring the digitized supply voltages of the microcontroller. The plurality of digitized supply voltages are monitored in the area as to whether they lie within predetermined tolerance ranges.

Abstract: The operating voltage is monitored in a microcontroller having associated output stages which are used to control components. In the case of over-voltage, the output stage is disconnected. Two technology-related, voltage monitoring devices working in different operating voltage ranges are provided. Due to the combination thereof, a highly precise disconnection threshold and a greater area for the operating voltage, which is to be monitored, can be obtained. If a malfunction of an over-voltage occurs, the output stages can be disconnected in a reliable manner.

Abstract: An internal combustion engine is controlled by a plurality of partially reliability-relevant functional units. Every reliability-relevant functional unit comprises at least one functional module and at least one monitoring module. The monitoring module is separate from the functional module associated therewith and monitors the functioning of the functional module. The control device also comprises a higher order monitoring functional group. The monitoring module has an entry point for communication with the higher order monitoring functional group. When an error is detected, the monitoring module signals the error to the higher order monitoring functional group using the entry point.

Abstract: The operating voltage is monitored in a microcontroller having associated output stages which are used to control components. In the case of over-voltage, the output stage is disconnected. Two technology-related, voltage monitoring devices working in different operating voltage ranges are provided. Due to the combination thereof, a highly precise disconnection threshold and a greater area for the operating voltage, which is to be monitored, can be obtained. If a malfunction of an over-voltage occurs, the output stages can be disconnected in a reliable manner.