Intelligent fault management

• US 6,654,910 B1
• Filed: 07/07/2000
• Issued: 11/25/2003
• Est. Priority Date: 08/14/1999
• Status: Expired due to Term

• Current Assignee: Slingshot IOT LLC
• Original Assignee: International Business Machines Corporation
• Inventors: Eibach, Wolfgang, Staiger, Dieter E.
• Primary Examiner(s): BADERMAN, SCOTT T
• Application Number:
  US09/611,475
• Time in Patent Office: 1,236 Days
• Field of Search: 714/37, 714/25, 714/43, 714/44, 714/39, 714/47, 701/29
• US Class Current: 714/37
• CPC Class Codes: G05B 19/0428 Safety, monitoring G05B19/0423 takes precedence
• CPC Class Codes: G05B 2219/24018 Computer assisted repair, diagnostic
• CPC Class Codes: G05B 2219/24019 Computer assisted maintenance
• CPC Class Codes: G05B 2219/24024 Safety, surveillance
• CPC Class Codes: G05B 2219/24182 Redundancy
• CPC Class Codes: G05B 2219/24196 Plausibility check in channels for correct sequence or result
• CPC Class Codes: G06F 11/0739 in a data processing system embedded in automotive or aircraft systems
• CPC Class Codes: G06F 11/0757 by exceeding a time limit, i.e. time-out, e.g. watchdogs
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40
• CPC Class Codes: G06F 11/2035 without idle spare hardware

Abstract

A principle for handling system failure situations thereby maintaining minimum fault recovery time and providing high system availability is described, especially for controlling the system behavior in fault situations of Electronic Control Units used in automotive vehicles. This principle is providing unique solutions for fault analysis, fault recovery definition and system re-vitalization. It is a key attribute of the principle keeping the demand for hardware and software overhead at a minimum. The method applies graceful degradation of system functionality, allowing to achieve the implementation of cost effective systems.

Claims

1. Electronic control system for controlling the function of a processing system, especially in an automotive vehicle, said electronic control system comprising a plurality of main logical control elements, each of which is especially adapted to perform special tasks, and each of said control elements being able to communicate to each other control element, characterized in that each of said logical control elements comprises additional control means for continuously monitoring the system and performing tests and diagnostics to detect system faults and severity of system faults, whereby said additional control means are interconnected by busses, thus allowing each of said control means to communicate with all other control means,

wherein if the severity of a fault exceeds a predefined value, said additional control means identify failing element(s) by determining bit values representing the status of each individual control element, degrade functionality of said processing system in pre-assigned levels depending on the bit values determined, and re-initialize and re-vitalize said processing system in the degraded state.

2. Electronic control system according to claim 1, wherein said processing system is a loosely coupled system.

3. Electronic control system according to claim 1, wherein said logical control elements additionally comprise an individual timing functionality.

4. Electronic control system according to claim 1, wherein said additional control means are represented by hardware and/or software.

5. Electronic control system according to claim 1, additionally comprising arbitration means for judging said tests and diagnostics performed by each of said control means.

6. Electronic control system according to claim 2, wherein said logical control elements additionally comprise an individual timing functionality.

7. Electronic control system according to claim 2, wherein said additional control means are represented by hardware and/or software.

8. Electronic control system according to claim 3, wherein said additional control means are represented by hardware and/or software.

9. Electronic control system according to claim 2, additionally comprising arbitration means for judging said tests and diagnostics performed by each of said control means.

10. Electronic control system according to claim 3, additionally comprising arbitration means for judging said tests and diagnostics performed by each of said control means.

11. Electronic control system according to claim 4, additionally comprising arbitration means for judging said tests and diagnostics performed by each of said control means.

12. Electronic control system for controlling the function of a processing system, especially in an automotive vehicle, said electronic control system comprising a plurality of main logical control elements, each of which is especially adapted to perform special tasks, and each of said control elements being able to communicate to each other control element, characterized in that each of said logical control elements comprises additional control means for continuously monitoring the system and performing tests and diagnostics to detect system faults, wherein said additional control means are represented by hardware and/or software and wherein said additional control means are selected from the group comprising a state machine, a processor and a programmable sequencer, whereby said additional control means are interconnected by busses, thus allowing each of said control means to communicate with all other control means.

13. Method for managing system fault situations of an electronic control system, comprising the following steps:

a) providing a plurality of main logical control elements, each of said elements being adapted to perform special tasks,

b) providing additional control means to each of said control elements, said control means being interconnected by busses, thus allowing each of said control means to communicate with all other control means,

c) continuously monitoring said system and performing tests and diagnostics by each of said control means individually,

d) in case a failure and/or deviation from a predefined operation of said system is detected, analysing the system'"'"'s present state and evaluating the severity of said failure and/or deviation by each of said control means individually,

e1) in case the severity of the failure and/or deviation does not exceed a predefined value, resuming normal operation of said system,

e2) in case the severity of the failure and/or deviation exceeds a predefined value, identifying the failing element(s) by determining bit values, representing the status of each individual control element,

f) degrading the system functionality in pre-assigned levels depending on the bit values determined; and

g) re-initializing and re-vitalizing said system in said degraded state.

14. Method according to claim 13, wherein said control means are carrying out individual programs adapted to respective control elements.

15. Method according to claim 13, wherein said control means are operating simultaneously and concurrently.

16. Method according to claim 13, wherein said control means are exchanging status information of the system.

17. Method according to claim 13, wherein said control means are exchanging calculated signatures, each of said control means providing individual results for re-vitalizing said system.

18. Method according to claim 17, wherein said control means each calculate a digital value representing a trust-level of said result.

19. Method according to claim 18, wherein an arbiter determines the highest digital value and subsequently executes a command in order to reorganize said system to the calculated degraded state.

20. Method according to claim 14, wherein said control means are exchanging calculated signatures, each of said control means providing individual results for re-vitalizing said system.

21. Method according to claim 15, wherein said control means are exchanging calculated signatures, each of said control means providing individual results for re-vitalizing said system.

22. Method according to claim 16, wherein said control means are exchanging calculated signatures, each of said control means providing individual results for revitalizing said system.

23. Electronic control system for controlling the function of a processing system, especially in an automotive vehicle, said electronic control system comprising a plurality of main logical control elements, each of which is especially adapted to perform special task, and each of said control elements being able to communicate to each other control element, characterized in that each of said logical control elements comprises additional control means for continuously monitoring the system and performing tests and diagnostics to detect system faults, wherein said additional control means are represented by hardware and/or software and wherein said additional control means are selected from the group comprising a state machine, a processor and a programmable sequencer, whereby said additional control means are interconnected by busses, thus allowing each of said control means to communicate with all other control means, said electronic control system further comprising arbitration means for judging said tests and diagnostics performed by each of said control means.