Dual processor supervisory control system for a vehicle

• US 20060126256A1
• Filed: 02/09/2005
• Published: 06/15/2006
• Est. Priority Date: 12/15/2004
• Status: Active Grant

• Current Assignee: GM Global Technology Operations LLC (General Motors Company)
• Original Assignee: GM Global Technology Operations Incorporated (General Motors Company)
• Inventors: Katrak, Kerfegar K., Forest, Thomas M.
• Granted Patent: US 7,467,029 B2
• Time in Patent Office: Days
• US Class Current: 361/139
• CPC Class Codes: B60W 50/0098 Details of control systems ensuring comfort, safety or stability not otherwise provided for
• CPC Class Codes: B60W 50/029 Adapting to failures or work around with other constraints, e.g. circumvention by avoiding use of failed parts
• CPC Class Codes: B60W 50/045 Monitoring control system parameters

Abstract

A vehicle control module for controlling an actuator unit in response to an input having a first processor, a first communication link coupled to the first processor, and a second processor coupled to the first processor via the first communication link. The first processor is configured to generate a first value based on the input, transmit the first value to the actuator unit, and receive a second value from the actuator unit based on a data received by the actuator unit from the first processor. The first communication link is configured to transfer the input and the second value to the second processor. The second processor is configured to determine a third value based on the input, and verify the first value based on a comparison of the second value with the third value.

Claims

1. A vehicle control module for controlling an actuator unit in response to an input, the vehicle control module comprising:

a first processor configured to;

generate a first value based on said input;

transmit said first value to the actuator unit; and

receive a second value from the actuator unit based on a data received by the actuator unit from said first processor;

a first communication link coupled to said first processor; and

a second processor coupled to said first processor via said first communication link, said first communication link configured to transfer said input and said second value to said second processor, said second processor configured to;

determine a third value based on said input; and

verify said first value based on a comparison of said second value with said third value.

2. A vehicle control module according to claim 1, wherein said second value comprises a signature based on said data received by the actuator unit from said first processor.

3. A vehicle control module according to claim 2, wherein said signature is a mathematical function of said data received by the actuator unit from said first processor.

4. A vehicle control module according to claim 2, wherein said first processor is further configured to transmit said first value to said second processor via said first communication link;

and

wherein said second processor is configured to disable said first processor when at least one of;

no data is received by said second processor from said first processor for a pre-determined amount of time;

said second value and said third value do not match; and

said signature and said first value received by said second processor from said first processor do not match.

5. A vehicle control module according to claim 4, wherein said second value further comprises said data received by the actuator unit from said first processor;

and

wherein said second processor is further configured to disable said first processor when said signature and said data received by the actuator unit from said first processor do not match.

6. A vehicle control module according to claim 1, wherein said second processor is an independent computational path in said first processor.

7. A vehicle control module according to claim 5, wherein said third value comprises a range of values;

and

wherein said second processor is further configured to reset said first processor when said second value is outside of said range of values.

8. A vehicle control module according to claim 2, wherein the actuator unit is coupled to said first processor via a second communication link and configured to generate said signature without duplication by said first processor.

9. A vehicle control module according to claim 1, wherein said first processor is configured to transfer said second value to said second processor without alteration of said second value.

10. A vehicle control system comprising:

an actuator unit;

a first communication link coupled to said actuator unit;

a first processor coupled to said actuator unit via said first communication link, said first processor configured to generate a first value based on a system input, said first value corresponding to a first operation mode of the vehicle control system, said actuator unit configured to generate a second value based on a data received from said first processor corresponding to said first value, said second value comprising a signature;

a second communication link coupled to said first processor; and

a second processor coupled to said first processor via said second communication link, said second processor configured to;

determine a third value based on said system input; and

verify said first value based on a comparison of said second value with said third value.

11. A vehicle control system according to claim 10, wherein said signature is a mathematical function of said data received by said actuator unit corresponding to said first value.

12. A vehicle control system according to claim 10, wherein said first processor is further configured to transmit said first value to said second processor via said second communication link;

and

wherein said second processor is configured to switch the vehicle control system to a second operation mode when at least one of;

no data is received from said first processor by said second processor for a first amount of time;

said second value and said third value do not match; and

said signature does not correspond with said first value.

13. A vehicle control system according to claim 12, wherein said second value further comprises said data received by said actuator corresponding to said first value;

and

wherein said second processor is further configured to switch the vehicle control system to said second operation mode when said signature does not correspond with said data.

14. A vehicle control system according to claim 10, wherein said first processor further comprises:

a first control path coupled to said actuator unit via said first communication link and coupled to said second processor via said second communication link, said first control path configured to generate said first value based on said system input;

a third communication link coupled to said first control path;

a second control path coupled with said first control path via said third communication link, said second control path configured to;

generate a fourth value based on said system input; and

verify said first value based on a comparison of said fourth value with said second value; and

a fourth communication link coupling said second control path with said second processor.

15. A vehicle control system according to claim 14, wherein said second processor is further configured to switch the vehicle control system to said second operation mode when at least one of:

no data is received from said first control path by said second control path for a pre-determined amount of time;

said signature does not correspond with said fourth value; and

said first value and said fourth value do not match.

16. A vehicle control system according to claim 12, wherein said second operation mode comprises one of:

said second processor disabling said first processor for a second amount of time sufficient for a remedial action by said actuator unit; and

said second processor resetting said first processor for a third amount of time sufficient for a remedial action by said actuator unit.

17. A vehicle control system according to claim 10, wherein said third value comprises a range of values;

wherein said first processor is further configured to transmit said first value to said second processor via said second communication link; and

wherein second processor is further configured to switch the vehicle control system to a second operation mode when said second value is outside of said third value.

18. A vehicle control system according to claim 14, wherein said fourth value comprises a range of values;

and

wherein said second processor is further configured to switch the vehicle control system to said second operation mode when said first value is outside of said fourth value.

19. A vehicle control system according to claim 10, wherein said actuator unit is configured to generate said signature without duplication by said first processor.

20. A vehicle control system comprising:

an actuator unit;

a first communication link coupled to said actuator unit; and

a processor coupled to said actuator unit via said first communication link, said processor comprising;

a first control path configured to generate a first value based on a system input, said first value corresponding to a first operation mode of the vehicle control system, said actuator unit configured to generate a second value based on a data received from said first control path corresponding to said first value, said second value comprising a signature;

a second communication link coupled to said first control path; and

a second control path coupled to said first control path via said second communication link, said second control path configured to communicate with said first control path via said second communication link, said second control path configured to;

determine a third value based on said input; and

verify said first value based on a comparison of said second value with said third value.

21. A vehicle control system according to claim 20, wherein said signature is a mathematical function of said data received from said first control path corresponding to said first value.

22. A vehicle control system according to claim 20, wherein said said second control path is configured to switch the vehicle control system to a second operation mode when at least one of:

no data is received from said first control path by said second control path for a first amount of time;

said second value and said third value do not match; and

said signature does not correspond with said first value.

23. A vehicle control system according to claim 22, wherein said second value further comprises said data received from said first control path corresponding to said first value;

and

wherein said second control path is further configured to switch the vehicle control system to said second operation mode when said signature does not correspond with said data.

24. A vehicle control system according to claim 22, wherein said second operation mode comprises one of:

said second control path disabling said processor for a second amount of time sufficient for a remedial action by said actuator unit; and

said second control path resetting said processor for a third amount of time sufficient for a remedial action by said actuator unit.

25. A vehicle control system according to claim 20, wherein said third value comprises a range of values;

wherein said first control path is further configured to transmit said first value to said second control path via said second communication link; and

wherein second control path is further configured to switch the vehicle control system to a second operation mode when said second value is outside of said third value.

26. A vehicle control system according to claim 20, wherein said actuator unit is configured to generate said signature without duplication by said first control path.