FAILURE MANAGEMENT IN A VEHICLE

• US 20160009235A1
• Filed: 03/20/2015
• Published: 01/14/2016
• Est. Priority Date: 07/11/2014
• Status: Active Grant

• Current Assignee: Ford Global Technologies, LLC (Ford Motor Company)
• Original Assignee: Ford Global Technologies, LLC (Ford Motor Company)
• Inventors: Joyce, John P., Lauffer, Scott J.
• Granted Patent: US 9,604,585 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: B60R 16/0232 for measuring vehicle parameters and indicating critical, abnormal or dangerous conditions
• CPC Class Codes: B60R 16/03 for supply of electrical power to vehicle subsystems or for circuit arrangements for charging batteries H02J7/00
• CPC Class Codes: G05D 1/0077 using redundant signals or controls

Abstract

A system includes first and second failsafe devices. Each of the failsafe devices includes a processor and a memory. The memory stores instructions executable by the processor for performing at least one of detecting a fault and providing a communication concerning a fault. The system further includes an arbitration bus connecting the first and second failsafe devices. The communication concerning the fault may be provided from a first one of the first and second failsafe devices to a second one of the first and second failsafe devices.

Claims

1. A system, comprising a control sub-system, comprising:

first and second failsafe devices, each of the failsafe devices comprising a processor and a memory, the memory storing instructions executable by the processor for performing at least one of detecting a fault and providing a communication concerning a fault; and

an arbitration bus connecting the first and second failsafe devices, whereby the communication concerning the fault may be provided from a first one of the first and second failsafe devices to a second one of the first and second failsafe devices.

2. The system of claim 1, further comprising at least one component sub-system communicatively coupled to the control sub-system.

3. The system of claim 2, wherein the at least one component sub-system is communicatively coupled to the control sub-system via each of a first communications bus and a second communications bus, the first and second communications buses being distinct from the arbitration bus.

4. The system of claim 3, the at least one vehicle component sub-system including third and fourth failsafe devices, each of the third and fourth failsafe devices comprising a processor and a memory, the memory storing instructions executable by the processor for performing at least one of detecting a fault in providing a communication concerning the fault.

5. The system of claim 4, further comprising an arbitration sub-system, the arbitration sub-system including first and second failsafe devices.

6. The system of claim 1, wherein the first failsafe device is powered by a first power source and the second failsafe device is powered by a second power source.

7. The system of claim 1, wherein each of the first and second failsafe devices are programmed for substantially performing operations of the subsystem that are performed by the other failsafe device under normal conditions, detecting a fault, and providing a communication concerning a fault.

8. The system of claim 1, wherein the system is in a vehicle and the control subsystem is an autonomous vehicle control subsystem.

9. A system in a vehicle, comprising:

a first subsystem comprising first and second failsafe devices;

a second subsystem comprising third and fourth failsafe devices; and

a first communications bus and a second communications bus;

wherein each of the failsafe devices comprising a processor and a memory, the memory storing instructions executable by the processor for performing at least one of detecting a fault and providing a communication concerning a fault; and

the first and third failsafe devices are communicatively connected via the first communications bus and the second and fourth failsafe devices are connected via the second communications bus.

10. The system of claim 9, further comprising a first arbitration bus connecting the first and second failsafe devices, whereby the communication concerning the fault may be provided from a first one of the first and second failsafe devices to a second one of the first and second failsafe devices.

11. The system of claim 10, further comprising a second arbitration bus connecting the third and fourth failsafe devices, whereby the communication concerning the fault may be provided from a first one of the third and fourth failsafe devices to a second one of the third and fourth failsafe devices.

12. The system of claim 9, wherein the first subsystem is an autonomous operation subsystem and the second subsystem is one of a powertrain subsystem, a brake subsystem, a steering subsystem, and a lighting subsystem.

13. The system of claim 9, further comprising a plurality of second subsystems.

14. The system of claim 9, wherein the first failsafe device is powered by a first power source and the second failsafe device is powered by a second power source.

15. The system of claim 9, wherein each of the first and second failsafe devices are programmed for substantially performing operations of the subsystem that are performed by the other failsafe device under normal conditions, detecting a fault, and providing a communication concerning a fault.

16. A system in a vehicle, comprising:

an autonomous operation subsystem comprising first and second failsafe devices;

a second subsystem; and

a first communications bus and a second communications bus;

wherein each of the failsafe devices comprising a processor and a memory, the memory storing instructions executable by the processor for performing at least one of detecting a fault and providing a communication concerning a fault; and

each of the failsafe devices are further programmed to, in the event of a fault in the other failsafe device, provide at least some communications to the second subsystem that the other device is programmed to provide.

17. The system of claim 16, wherein the first failsafe device is powered by a first power source and the second failsafe device is powered by a second power source.

18. The system of claim 16, wherein each of the first and second failsafe devices are programmed for substantially performing operations of the subsystem that are performed by the other failsafe device under normal conditions, detecting a fault, and providing a communication concerning a fault.