ORCHESTRATOR REPORTING OF PROBABILITY OF DOWNTIME FROM WATCHDOG RESETS AND STACK OVERFLOW

• US 20190034256A1
• Filed: 07/24/2018
• Published: 01/31/2019
• Est. Priority Date: 07/25/2017
• Status: Active Grant

• Current Assignee: Aurora Labs Limited
• Original Assignee: Aurora Labs Limited
• Inventors: Fox, Zohar
• Granted Patent: US 10,496,469 B2
• Time in Patent Office: Days
• CPC Class Codes: B60W 2050/021 Means for detecting failure or malfunction
• CPC Class Codes: B60W 50/02 Ensuring safety in case of control system failures, e.g. by diagnosing, circumventing or fixing failures
• CPC Class Codes: B60W 50/0205 Diagnosing or detecting failures; Failure detection models
• CPC Class Codes: B60W 50/0225 Failure correction strategy
• CPC Class Codes: B60W 50/04 Monitoring the functioning of the control system
• CPC Class Codes: B60W 50/045 Monitoring control system parameters
• CPC Class Codes: G06F 11/0721 within a central processing unit [CPU]
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40
• CPC Class Codes: G06F 11/1433 during software upgrading
• CPC Class Codes: G06F 11/1629 Error detection by comparing the output of redundant processing systems
• CPC Class Codes: G06F 11/3612 by runtime analysis performance monitoring G06F11/3466
• CPC Class Codes: G06F 12/0284 Multiple user address space allocation, e.g. using different base addresses interprocessor communication G06F15/163
• CPC Class Codes: G06F 12/0646 Configuration or reconfiguration
• CPC Class Codes: G06F 16/188 Virtual file systems
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2212/1008 Correctness of operation, e.g. memory ordering
• CPC Class Codes: G06F 2212/1044 : Space efficiency improvement
• CPC Class Codes: G06F 2212/1056 : Simplification
• CPC Class Codes: G06F 2221/033 : Test or assess software
• CPC Class Codes: G06F 8/60 : Software deployment
• CPC Class Codes: G06F 8/65 : Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 8/654 : using techniques specially adapted for alterable solid state memories, e.g. for EEPROM or flash memories
• CPC Class Codes: G06F 8/656 : while running
• CPC Class Codes: G06F 8/658 : Incremental updates; Differential updates
• CPC Class Codes: G06F 8/66 : of program code stored in read-only memory [ROM]
• CPC Class Codes: G06F 8/71 : Version control security arrangements therefor G06F21/57; Configuration management
• CPC Class Codes: G06F 9/4401 : Bootstrapping security arrangements therefor G06F21/57
• CPC Class Codes: G06F 9/445 : Program loading or initiating bootstrapping G06F9/4401; security arrangements for program loading or initiating G06F21/57
• CPC Class Codes: G06F 9/44521 : Dynamic linking or loading; Link editing at or after load time, e.g. Java class loading
• CPC Class Codes: G06N 20/00 : Machine learning
• CPC Class Codes: Y02D 10/00 : Energy efficient computing, e.g. low power processors, power management or thermal management

Abstract

Disclosed embodiments relate to reporting Electronic Control Unit (ECU) errors or faults to a remote monitoring server. Operations may include receiving operational data from a plurality of ECUs in the vehicle, the operational data being indicative of a plurality of runtime attributes of the plurality of ECUs; generating, through a machine learning process, a statistical model of the operational data; receiving live, runtime updates from the plurality of ECUs in the communications network of the vehicle; identifying an ECU error associated with an ECU in the communications network of the vehicle, the ECU error being determined by a comparison of the live, runtime updates with the statistical model of the operational data to identify at least one deviation from the operational data; and wirelessly sending a report to the remote monitoring server based on the live, runtime updates, the report identifying the ECU and the identified ECU error.

Claims

1. A non-transitory computer readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform operations for reporting Electronic Control Unit (ECU) errors or faults to a remote monitoring server, comprising:

receiving, at a processor in a communications network of a vehicle, operational data from a plurality of ECUs in the vehicle, the operational data being indicative of a plurality of runtime attributes of the plurality of ECUs;

generating, through a machine learning process, a statistical model of the operational data, wherein the machine learning process is based on the plurality of runtime attributes;

receiving live, runtime updates from the plurality of ECUs in the communications network of the vehicle;

identifying, based on the live, runtime updates, an ECU error associated with an ECU in the communications network of the vehicle, the ECU error being determined by a comparison of the live, runtime updates with the statistical model of the operational data to identify at least one deviation from the operational data; and

wirelessly sending a report from the vehicle to the remote monitoring server based on the live, runtime updates, the report identifying the ECU and the identified ECU error.

2. The non-transitory computer readable medium of claim 1, wherein the operations comprise sending a request message to the ECU, in response to which there is one or more correct response messages the ECU can make indicating correct ECU operation.

3. The non-transitory computer readable medium of claim 2, wherein the ECU error is identified based on an ECU failing to respond to the request message.

4. The non-transitory computer readable medium of claim 2, wherein the ECU error is identified based on an ECU incorrectly responding to the request message.

5. The non-transitory computer readable medium of claim 1, wherein the ECU error is identified based on a detected stack overflow in the ECU.

6. The non-transitory computer readable medium of claim 1, wherein the remote monitoring server operates according to a multi-tier model, wherein one of the tiers includes receiving, from the vehicle, samples of the live, runtime updates for further analysis at the remote monitoring server.

7. The non-transitory computer readable medium of claim 1, wherein the remote monitoring server operates according to a multi-tier model, wherein one of the tiers includes receiving, from the vehicle, an identification of a delta file in use in the ECU.

8. The non-transitory computer readable medium of claim 1, wherein the remote monitoring server operates according to a multi-tier model, wherein one of the tiers includes determining to roll-back a software version of the ECU to a prior software version.

9. The non-transitory computer readable medium of claim 1, wherein the remote monitoring server operates according to a multi-tier model, wherein one of the tiers includes determining to implement a safe mode for the ECU.

10. The non-transitory computer readable medium of claim 1, wherein the operations further include determining whether the identified ECU error is detrimental to the ECU.

11. The non-transitory computer readable medium of claim 1, wherein the machine learning process is based on a pattern of memory usage by the ECU.

12. The non-transitory computer readable medium of claim 1, wherein the machine learning process is based on a pattern of execution of software on the ECU.

13. The non-transitory computer readable medium of claim 1, wherein ECU software on the ECU is mapped to a plurality of functional units, and the ECU is configured to utilize a virtual file system (VFS) to manage and track one or more versions of each of the plurality of functional units.

14. The non-transitory computer readable medium of claim 13, wherein the operations further comprise configuring a second version of ECU software on the ECU for execution, including updating memory addresses of one or more of the plurality of functional units managed through the VFS.

15. The non-transitory computer readable medium of claim 13, wherein the second version of ECU software is a previous version of ECU software having one or more functional units disabled by the VFS.

16. The non-transitory computer readable medium of claim 1, wherein the operational data includes identifiers of the plurality of ECUs.

17. The non-transitory computer readable medium of claim 1, wherein the operational data includes data indicating a last-known poll of the plurality of ECUs.

18. The non-transitory computer readable medium of claim 1, wherein the instructions further comprise:

determining a probability of downtime for the plurality of ECUs based on the operational data and the live, runtime updates.

19. A system for reporting Electronic Control Unit (ECU) errors or faults to a remote monitoring server, the system comprising:

one or more processors; and

one or more memories having instructions that, when executed by the one or more processors, cause the one or more processors to perform the operations of;

receiving, at a processor in a communications network of a vehicle, operational data from a plurality of ECUs in the vehicle, the operational data being indicative of a plurality of runtime attributes of the plurality of ECUs;

generating, through a machine learning process, a statistical model of the operational data, wherein the machine learning process is based on the plurality of runtime attributes;

receiving live, runtime updates from the plurality of ECUs in the communications network of the vehicle;

identifying, based on the live, runtime updates, an ECU error associated with an ECU in the communications network of the vehicle, the ECU error being determined by a comparison of the live, runtime updates with the statistical model of the operational data to identify at least one deviation from the operational data; and

wirelessly sending a report from the vehicle to the remote monitoring server based on the live, runtime updates, the report identifying the ECU and the identified ECU error.

20. A computer-implemented method for reporting Electronic Control Unit (ECU) errors or faults to a remote monitoring server, the method comprising:

receiving, at a processor in a communications network of a vehicle, operational data from a plurality of ECUs in the vehicle, the operational data being indicative of a plurality of runtime attributes of the plurality of ECUs;

generating, through a machine learning process, a statistical model of the operational data, wherein the machine learning process is based on the plurality of runtime attributes;

receiving live, runtime updates from the plurality of ECUs in the communications network of the vehicle;

identifying, based on the live, runtime updates, an ECU error associated with an ECU in the communications network of the vehicle, the ECU error being determined by a comparison of the live, runtime updates with the statistical model of the operational data to identify at least one deviation from the operational data; and

wirelessly sending a report from the vehicle to the remote monitoring server based on the live, runtime updates, the report identifying the ECU and the identified ECU error.