Control system and method for validating operation of the control system

• US 7,424,641 B2
• Filed: 04/06/2005
• Issued: 09/09/2008
• Est. Priority Date: 04/06/2005
• Status: Expired due to Fees

• Current Assignee: GM Global Technology Operations Incorporated (General Motors Company), Steering Solutions IP Holding Corporation (Nexteer Automotive Group Ltd.)
• Original Assignee: Delphi Technologies, Inc. (BorgWarner Incorporated)
• Inventors: Sundaram, Padma, D'Ambrosio, Joseph G., Chen, Yulei
• Primary Examiner(s): Chu; Gabriel L
• Application Number:
  US11/099,871
• Publication Number:
  US 20060236844A1
• Time in Patent Office: 1,252 Days
• Field of Search: None
• US Class Current: 714/11
• CPC Class Codes: G06F 11/1004 to protect a block of data words, e.g. CRC or checksum G06F11/1076 takes precedence; security arrangements for protecting computers or computer systems against unauthorized activity G06F21/00
• CPC Class Codes: G06F 11/28 by checking the correct order of processing G06F11/08 - G06F11/26 take precedence; monitoring patterns of pulse trains H03K5/19

Abstract

A control system and a method for validating operation of the control system are provided. The control system has a first controller operably communicating with a second controller. The first and second controllers have first and second read-only memories, respectively. The method includes executing a first software program in the first controller that retrieves a first key value from the second controller. The method further includes retrieving a second key value from a table using the first key value as an index value. The table is stored in a memory that is accessible by the first software program. The method includes executing at least one mathematical operation in the first software program using at least the second key value to obtain a third key value. The method further includes sending the first and third key values from the first controller to the second controller. The method further includes determining a first validation value based on the first key value utilizing the second controller. The method further includes comparing the third key value to the first validation value using the second controller and indicating that the first software program has executed until completion when the third key value is equal to the first validation value.

Claims

1. A method for validating operation of a control system, the control system having a first controller operably communicating with a second controller, the first and second controllers having first and second read-only memories, respectively, the method comprising:

executing a first software program in the first controller that retrieves a first key value from the second controller;

retrieving a second key value from a table using the first key value as an index value, the table being stored in a memory that is accessible by the first software program;

executing at least one mathematical operation in the first software program using at least the second key value to obtain a third key value;

sending the first and third key values from the first controller to the second controller;

determining a first validation value based on the first key value utilizing the second controller; and

comparing the third key value to the first validation value using the second controller and indicating that the first software program has executed until completion when the third key value is equal to the first validation value.

2. The method of claim 1, wherein performing at least one mathematical operation in the first software program using at least the second key value to obtain the third key value, comprises:

executing a plurality of mathematical operations in a predetermined sequence in a plurality of software subroutines of the first software program using at least the second key value to obtain the third key value.

3. The method of claim 1, further comprising indicating that the first software program has not executed until completion when the third key value is not equal to the first validation value.

4. The method of claim 3, further comprising disabling an output signal from the first controller when the first software program has not executed until completion.

5. The method of claim 1, wherein the mathematical operation comprises at least one of a multiplication operation, a division operation, an addition operation, and a subtraction operation.

6. The method of claim 1, further comprising:

calculating a first checksum value based on stored values in the first read-only memory using the first controller;

transmitting the first checksum value from the first controller to the second controller;

comparing the first checksum value to a first predetermined value using the second controller; and

indicating the first read-only memory is not corrupted when the first checksum value is equal to the first predetermined value.

7. The method of claim 6, further comprising:

calculating a second checksum value based on stored values in the second read-only memory using the second controller;

transmitting the second checksum value from the second controller to the first controller;

comparing the second checksum value to a second predetermined value using the first controller;

indicating the second read-only memory is not corrupted when the second checksum value is equal to the second predetermined value.

8. The method of claim 1, wherein the first and second controllers further comprise first and second analog-to-digital converters, respectively, the method further comprising:

sampling a first analog signal on a first signal line using the first analog-to-digital converter to obtain a first plurality of digital values;

sampling the first analog signal on the first signal line using the second analog-to-digital converter to obtain a second plurality of digital values; and

indicating the first and second analog-to-digital converters are operating as desired when the first plurality of digital values are substantially similar to the second plurality of digital values.

9. The method of claim 8, wherein the step of indicating the first and second analog-to-digital converters are operating as desired comprises determining whether each digital value of the first plurality of digital values is within a predetermined range of each corresponding digital value of the second plurality of digital values.

10. The method of claim 1, further comprising:

transmitting a first signal from the first controller to an output controller;

generating a second signal using the output controller based on the first signal, the second signal being transmitted to an actuator device, the second signal inducing the actuator device to move a moveable member;

generating a third signal using a sensor that monitors movement of the moveable member, the third signal being transmitted to the second controller, the third signal being indicative of an operational parameter of the actuator device;

querying the first controller to induce the first controller to transmit the first signal to the second controller; and

comparing the first signal to the third signal using the second controller to determine whether the third signal is a desired output signal.

11. The method of claim 10, wherein comparing the first signal to the third signal comprises determining whether the third signal is within a predetermined range of the first signal.

12. The method of claim 1, further comprising:

querying the first controller for peripheral control register configuration values stored therein, using a second controller;

transmitting the peripheral control register configuration values from the first controller to the second controller; and

comparing the peripheral control register configuration values with predetermined peripheral control register configuration values stored in the second controller to determine whether the peripheral control register configuration values are corrupted.

13. The method of claim 12, wherein the peripheral control register configuration values are not corrupted when the peripheral control register configuration values are identical to the predetermined peripheral control register data.

14. The method of claim 1, further comprising:

transmitting a first message from the first controller to the second controller;

transmitting a second message from the second controller to an output controller in response to the first message, the second message instructing the output controller to remove an energization signal from a load line;

monitoring the load line using the first controller to determine whether the energization signal is removed from the load line; and

indicating a fault condition if the energization signal is not removed from the load line within a predetermined time period.

15. The method of claim 14, further comprising:

transmitting a third message from the second controller to the first controller;

transmitting a fourth message from the first controller to the output controller in response to the third message, the fourth message instructing the output controller to remove the energization signal from the load line;

monitoring the load line using the second controller to determine whether the energization signal is removed from the load line; and

indicating the fault condition if the energization signal is not removed from the load line within the predetermined time period.

16. A control system, comprising:

a first controller configured to execute a first software program; and

a second controller configured to operably communicate with the first controller, the first software program configured to retrieve a first key value from the second controller, the first software program further configured to retrieve a second key value from a table using the first key value as an index value, the table being stored in a memory that is accessible by the first software program, the first software program further configured to execute at least one mathematical operation using at least the second key value to obtain a third key value, the first software program further configured to send the first and third key values from the first controller to the second controller, the second controller further configured to determine a first validation value based on the first key value, the second controller further configured to compare the third key value to the first validation value and to indicate that the first software program has executed until completion when the third key value is equal to the first validation value.

17. The control system of claim 16, wherein the first software program comprises a plurality of software subroutines, the first software program being configured to perform a plurality of mathematical operations in a predetermined sequence in the plurality of software subroutines using at least the second key value to obtain the third key value.

18. The control system of claim 16, wherein the first controller is further configured to calculate a first checksum value based on stored values in the first read-only memory, the first controller further configured to transmit the first checksum value to the second controller, the second controller further configured to compare the first checksum value to a first predetermined value, the second controller further configured to indicate that the first read-only memory is not corrupted when the first checksum value is equal to the first predetermined value.

19. The control system of claim 16, wherein the first and second controllers further have first and second analog-to-digital converters, respectively, the first analog-to-digital converter configured to sample a first analog signal on a first signal line to obtain a first plurality of digital values, the second analog-to-digital converter configured to sample the first analog signal on the first signal line to obtain a second plurality of digital values, the first controller is further configured to indicate the first and second analog-to-digital converters are operating as desired when the first plurality of digital values are substantially similar to the second plurality of digital values.

20. The control system of claim 16, further comprising:

an output controller operably coupled to the first and second controllers;

an actuator device operably coupled to the output controller, the actuator device having a moveable member;

a first sensor configured to monitor movement of the moveable member;

the first controller further configured to transmit a first signal to the output controller, the output controller configured to generate a second signal based on the first signal, the second signal being transmitted to the actuator device, the second signal inducing the actuator device to move the moveable member; and

the first sensor configured to generate a third signal indicative of an operational parameter of the actuator device, the third signal being transmitted to a second controller, the second controller further configured to query the first controller to induce the first controller to transmit the first signal to the second controller, the second controller further configured to compare the first signal to the third signal to determine whether the third signal is a desired output signal.

21. The control system of claim 16, wherein the second controller is further configured to query the first controller for the peripheral control register configuration values stored therein, the first controller configured to transmit the peripheral control register configuration values to the second controller in response to the query, the second controller further configured to compare the peripheral control register configuration values with predetermined peripheral control register configuration values stored in the second controller to determine whether the peripheral control register configuration values are corrupted.

22. The control system of claim 21, wherein the peripheral control register configuration values are not corrupted when the peripheral control register configuration values are identical to the predetermined peripheral control register configuration values.

23. The control system of claim 16, further comprising:

an output controller operably communicating with the first and second controllers, the output controller operably coupled to a load line, the first controller further configured to transmit a first message to the second controller, the second controller further configured to transmit a second message to the output controller in response to the first message, the second message instructing the output controller to remove an energization signal from the load line, the first controller further configured to monitor the load line to determine whether the energization signal is removed from the load line, the first controller further configured to indicate a fault condition if the energization signal is not removed from the load line within a predetermined time period.