Fault-resilient automobile control system

• US 5,957,985 A
• Filed: 12/16/1996
• Issued: 09/28/1999
• Est. Priority Date: 12/16/1996
• Status: Expired due to Term

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Wong, William, Lee, Lawrence W.
• Primary Examiner(s): NGUYEN, TAN QUANG
• Application Number:
  US08/771,343
• Time in Patent Office: 1,016 Days
• Field of Search: 701/29, 701/32, 701/33, 701/34, 701/35, 364/131, 364/132, 364/134, 364/140, 370/217, 370/221, 370/241, 370/242, 370/245, 395/185.01, 395/183.17, 395/182.11, 395/183.04
• US Class Current: 701/33
• CPC Class Codes: B60R 16/0315 using multiplexing techniques multiplexing for transmission of signals G08C15/00; multiplexing for electrical communication in general H04J
• CPC Class Codes: B60W 2050/0006 Digital architecture hierarchy
• CPC Class Codes: B60W 2050/0292 Fail-safe or redundant systems, e.g. limp-home or backup systems
• CPC Class Codes: B60W 2050/0297 Control Giving priority to different actuators or systems
• CPC Class Codes: G06F 11/2028 eliminating a faulty processor or activating a spare
• CPC Class Codes: G06F 11/2035 without idle spare hardware

Abstract

A fault-resilient automobile control system integrates diverse and separate automobile components and provides fault-tolerance to component failure. The automobile control system includes a master control unit (MCU) electrically coupled via a primary data communications bus to the electronic automobile components. The MCU is master of the bus and manages data flow over the bus among the electronic automobile components. The MCU can be configured with a routing table to route data monitored in one component to one or more other components. The MCU is also capable of performing the same functions as those performed by local controllers at the electronic components. During initialization, driver software for all of the local controllers is downloaded and storded at the MCU. In the event that a local controller fails, the MCU executes the driver software for the failed controller to remotely control the electronic automobile component in place of the failed local controller. Switching logic is installed at each of the electronic components to selectively route data to the primary bus, circumventing the failed controller. The automobile control system has a secondary control unit (SCU) electrically coupled to the MCU via the primary bus. The SCU is a standalone computer that supports clients and other devices on a secondary support bus. The SCU is also configured to backup the MCU. During normal operation, the SCU is subordinate to and controlled by the MCU on the primary bus. In the event that the MCU fails, however, the SCU assumes control of the data communications network and manages the data flow among the electronic automobile components.

Claims

1. A fault-resilient automobile control system for an automobile having multiple electronic automobile components, each electronic automobile component having a local controller for controlling operation of the electronic automobile component, the automobile control system comprising:

a master control unit electrically coupled to the electronic automobile components, the master control unit having a computer processor programmed to perform control tasks of the local controllers so that in an event that one of the local controllers fails, the master control unit controls the electronic automobile component in place of the failed local controller.

2. A fault-resilient automobile control system as recited in claim 1, wherein the master control unit has an open platform operating system executing on the computer processor.

3. A fault-resilient automobile control system as recited in claim 1, wherein the master control unit has a multitasking operating system executing on the computer processor.

4. A fault-resilient automobile control system as recited in claim 1, wherein the master control unit facilitates data communication among the electronic automobile components.

5. A fault-resilient automobile control system as recited in claim 1, wherein the master control unit maintains a routing table which the master control unit employs to route data detected by one electronic automobile component to one or more other electronic automobile components.

6. A fault-resilient automobile control system as recited in claim 1, wherein the master control unit monitors for failure of the local controllers of the electronic automobile components.

7. A fault-resilient automobile control system as recited in claim 1, wherein the master control unit has a memory and maintains a priority table in the memory, the priority table associating a priority rating with corresponding ones of the electronic automobile components, the master control unit handling the tasks of one or more failed local controllers in an order according to the priority ratings of the electronic automobile components in the priority table.

8. A fault-resilient automobile control system as recited in claim 1, in which the electronic automobile components further include non-intelligent components configured without local controllers, and wherein the master control unit performs data processing and control functions for the non-intelligent components.

9. An automobile comprising a fault-resilient automobile control system as recited in claim 1.

10. An automobile control system for an automobile having multiple electronic automobile components interconnected by a data communications network, each electronic automobile component having a local controller configured to perform one or more tasks, the automobile control system comprising:

a master control unit electrically coupled to the electronic automobile components via the data communications network, the master control unit having a computer processor programmed to manage data flow over the data communications network among the electronic automobile components; and

the master control unit maintaining a routing table which the master control unit employs to route data detected by one electronic automobile component to one or more other electronic automobile components.

11. An automobile comprising an automobile control system as recited in claim 10.

12. A fault-resilient automobile control system for an automobile having multiple electronic automobile components, each electronic automobile component having a local controller for controlling operation of the electronic automobile component, the automobile control system comprising:

a master control unit electrically coupled to the electronic automobile components, the master control unit having a computer processor programmed to manage data flow among the electronic automobile components and to perform the tasks of the local controllers in an event that one or more of the local controllers fails; and

a secondary control unit electrically coupled to the master control unit, the secondary control unit having a computer processor programmed to manage the data flow among the electronic automobile components in an event that the master control unit fails.

13. A fault-resilient automobile control system as recited in claim 12, wherein the master control unit has an open platform, multitasking operating system executing on the computer processor of the master control unit.

14. A fault-resilient automobile control system as recited in claim 12, wherein the master control unit monitors for failure of the local controllers of the electronic automobile components.

15. A fault-resilient automobile control system as recited in claim 12, wherein the master control unit has a memory and maintains a priority table in the memory, the priority table associating a priority rating with corresponding ones of the electronic automobile components, the master control unit handling the tasks of one or more failed local controllers in an order according to the priority ratings of the electronic automobile components in the priority table.

16. A fault-resilient automobile control system as recited in claim 12, in which the electronic automobile components further include non-intelligent components configured without local controllers, and wherein the master control unit performs data processing and control functions for the non-intelligent components.

17. A fault-resilicnt automobile control system as recited in claim 12, wherein the secondary control unit has an open platform, multitasking operating system executing on the computer processor of the secondary control unit.

18. A fault-resilient automobile control system as recited in claim 12, further comprising:

a dual bus data structure having a primary bus and a support bus;

the primary bus interconnecting the electronic automobile components, the master control unit, and the secondary control unit; and

the support bus being connected to the secondary control unit for interfacing to one or more other devices.

19. A fault-resilient automobile control system as recited in claim 12, wherein:

the master control unit manages data flow among the electronic automobile components and the secondary control unit over a primary bus; and

in an event that the secondary control unit attempts to gain unauthorized control of one of the electronic automobile components on the primary bus, the master control unit is configured to disable communication originating from the secondary control unit on the primary bus.

20. An automobile comprising a fault-resilient automobile control system as recited in claim 12.

21. A fault-resilient automobile control system for an automobile having multiple electronic automobile components interconnected by a data communications network, each electronic automobile component having a local controller configured to perform one or more tasks, the automobile control system comprising:

switching logic resident at ones of the electronic automobile components, the switching logic routing data to one of (1) the local controller of the electronic automobile component when the local controller is functioning properly or (2) the data communications network, circumventing the local controller, when the local controller is not functioning properly; and

a master control unit coupled to the electronic automobile components via the data communication network, the master control unit having a computer processor programmed to perform the tasks of the local controllers; and

in an event that a local controller of one of the electronic automobile components fails, the switching logic routes data to the master control unit via the data communication network bypassing the failed local controller and the master control unit performs the tasks of the failed local controller.

22. A fault-resilient automobile control system as recited in claim 21, wherein the master control unit has an open platform, multitasking operating system executing on the computer processor.

23. A fault-resilicnt automobile control system as recited in claim 21, wherein the master control unit facilitates data communication among the electronic automobile components.

24. A fault-resilient automobile control system as recited in claim 21, wherein the master control unit maintains a routing table which the master control unit employs to route data detected by one electronic automobile component to one or more other electronic automobile components.

25. A fault-resilient automobile control system as recited in claim 21, wherein the master control unit has a memory and maintains a priority table in the memory, the priority table associating a priority rating with corresponding ones of the electronic automobile components, the master control unit handling the tasks of one or more failed local controllers in an order according to the priority ratings of the electronic automobile components in the priority table.

26. An automobile comprising a fault-resilient automobile control system as recited in claim 21.

27. A fault-resilient automobile control system for an automobile having multiple electronic automobile components interconnected by a data communications network, each electronic automobile component having a local controller configured to perform one or more tasks, the automobile control system comprising:

switching logic resident at ones of the electronic automobile components, the switching logic routing data to one of (1) the local controller of the electronic automobile component when the local controller is functioning properly or (2) the data communications network, circumventing the local controller, when the local controller is not functioning properly;

a master control unit coupled to the electronic automobile components via the data communication network, the master control unit having a computer processor programmed to manage data flow among the electronic automobile components and to perform the tasks of the local controllers of the electronic automobile components;

a secondary control unit electrically coupled to the master control unit, the secondary control unit having a computer processor programmed to manage the data flow among the electronic automobile components;

in an event that a local controller of one of the electronic automobile components fails, the switching logic routes data to the master control unit via the data communication network and the master control unit performs the tasks of the failed local controller; and

in an event that the master control unit fails, the secondary control unit manages the data flow among the electronic automobile components.

28. A fault-resilient automobile control system as recited in claim 27, wherein the master control unit has an open platform, multitasking operating system executing on the computer processor.

29. A fault-resilient automobile control system as recited in claim 27, wherein the master control unit has a memory and maintains a priority table in the memory, the priority table associating a priority rating with corresponding ones of the electronic automobile components, the master control unit handling the tasks of one or more failed local controllers in an order according to the priority ratings of the electronic automobile components in the priority table.

30. A fault-resilient automobile control system as recited in claim 27, wherein the secondary control unit has an open platform, multitasking operating system executing on the computer processor.

31. A fault-resilient automobile control system as recited in claim 27, wherein the secondary control unit is coupled to the master control unit via the data communications network, and further comprising a support bus independent of the data communications network, the support bus being connected to the secondary control unit for interfacing to one or more other devices.

32. A fault-resilient automobile control system as recited in claim 27, wherein in an event that the secondary control unit attempts to gain unauthorized control of one of the electronic automobile components on the data communications network, the master control unit is configured to disable communication originating from the secondary control unit on the data communications network.

33. An automobile comprising a fault-resilient automobile control system as recited in claim 27.

34. For an electronic automobile component having a sensor which generates data and a controller which uses the data to control operation of the automobile component, a switching logic interfaced with the sensor and the controller to selectively route data to one of (1) the controller when the controller is functioning properly or (2) an external data bus, circumventing the controller, when the controller is not functioning properly.

35. An electronic automobile component comprising the switching logic as recited in claim 34.

36. An automobile comprising the electronic automobile component as recited in claim 35.

37. A method for operating an automobile control system, comprising the following steps:

monitoring a plurality of local electronic controllers used to control associated automobile components; and

in an event that one of the electronic controllers fails, remotely controlling the associated automobile component from a master control unit.

38. A method as recited in claim 37, wherein the master control unit manages data communication among the local electronic controllers, and further comprising the following additional steps:

monitoring the master control unit;

in an event that the master control unit fails, managing the data communication among the local electronic controllers from a secondary control unit.

39. A computer-readable medium having computer-executable instructions for performing the steps of the method as recited in claim 37.

40. A computer programmed to perform the steps of the method as recited in claim 37.