Dual core architecture of a control module of an engine

• US 20090024775A1
• Filed: 07/20/2007
• Published: 01/22/2009
• Est. Priority Date: 07/20/2007
• Status: Active Grant

• Current Assignee: GM Global Technology Operations LLC (General Motors Company)
• Original Assignee: GM Global Technology Operations LLC (General Motors Company)
• Inventors: Bauerle, Paul A., Costin, Mark H.
• Granted Patent: US 9,207,661 B2
• Time in Patent Office: Days
• US Class Current: 710/107
• CPC Class Codes: B60G 2600/086 Redundant systems
• CPC Class Codes: B60G 2600/187 Digital Controller Details and Signal Treatment
• CPC Class Codes: B60W 50/02 Ensuring safety in case of control system failures, e.g. by diagnosing, circumventing or fixing failures
• CPC Class Codes: G05B 19/0428 Safety, monitoring G05B19/0423 takes precedence
• CPC Class Codes: G05B 2219/24187 Redundant processors run identical programs
• CPC Class Codes: G05B 2219/24195 Compare data in channels at timed intervals, for equality
• CPC Class Codes: G05B 2219/24198 Restart, reinitialize, boot system after fault detection, hanging up, stalling
• CPC Class Codes: G06F 11/1637 using additional compare functionality in one or some but not all of the redundant processing components
• CPC Class Codes: G06F 11/1641 where the comparison is not performed by the redundant processing components
• CPC Class Codes: G06F 11/1654 where the output of only one of the redundant processing components can drive the attached hardware, e.g. memory or I/O
• CPC Class Codes: G06F 11/1683 at instruction level
• CPC Class Codes: G06F 11/1687 at event level, e.g. by interrupt or result of polling
• CPC Class Codes: G06F 11/2236 to test CPU or processors

Abstract

A control system for a control module of a vehicle includes a first integrated circuit (IC) core of a primary processor that generates a first control signal using a central processing unit (CPU). A second IC core of the primary processor generates a second control signal using a second CPU and generates a remedial control signal based on the first control signal and the second control signal.

Claims

1. A control system for a control module of a vehicle, comprising:

a first integrated circuit (IC) core of a primary processor that generates a first control signal using a central processing unit (CPU); and

a second IC core of said primary processor that generates a second control signal using a second CPU and that generates a remedial control signal based on said first control signal and said second control signal.

2. The system of claim 1 wherein said second IC core generates said remedial control signal when said second control signal is not equivalent to said first control signal.

3. The system of claim 1 wherein said second IC core generates said second control signal when said second IC core receives a notification signal from said first IC core.

4. The system of claim 3 wherein said second IC core commands a remedial action when said second IC core fails to receive said notification signal within a calibrated period.

5. The system of claim 1 wherein said remedial control signal includes at least one of signaling a resynchronization of a data path of said first IC core and a redundant data path of said second IC core to a predetermined state and signaling a running reset of said first IC core and said second IC core.

6. The system of claim 1 wherein said first IC core and said second IC core independently process data.

7. The system of claim 1 further comprising:

memory; and

an error correction coding (ECC) module, wherein said first IC core and said second IC core share said memory and said ECC module verifies said memory.

8. The system of claim 7 wherein one of said first IC core and said second IC core verify an operation of said (ECC) module.

15. The method of claim 1 wherein one of said first IC core and said second IC core verify an operation of an error correction coding (ECC) module of said control module.

9. A method for operating a control module of a vehicle, comprising:

generating a first control signal using a first CPU of a first IC core; and

generating a second control signal using a second CPU of a second IC core; and

generating a remedial control signal based on said first control signal and said second control signal.

10. The method of claim 9 further comprising generating said remedial control signal when said second control signal is not equivalent to said first control signal.

11. The method of claim 9 further comprising generating said second control signal when said second IC core receives a notification signal from said first IC core.

12. The method of claim 11 further comprising commanding a remedial action when said second IC core fails to receive said notification signal within a calibrated period.

13. The method of claim 9 wherein said remedial control signal includes at least one of signaling a resynchronization of a data path of said first IC core and a redundant data path of said second IC core to a predetermined state and signaling a running reset of said first IC core and said second IC core.

14. The method of claim 9 wherein said first IC core and said second IC core independently process data.