Dual processor supervisory control system for a vehicle

• US 7,467,029 B2
• Filed: 02/09/2005
• Issued: 12/16/2008
• Est. Priority Date: 12/15/2004
• Status: Active Grant

• Current Assignee: GM Global Technology Operations LLC (General Motors Company)
• Original Assignee: General Motors Corporation (Motors Liquidation Co. GUC Trust)
• Inventors: Katrak, Kerfegar K., Forest, Thomas M.
• Primary Examiner(s): To; Tuan C
• Application Number:
  US11/054,571
• Publication Number:
  US 20060126256A1
• Time in Patent Office: 1,406 Days
• Field of Search: 701/33, 701/31, 701/29, 701/32, 701/1, 340/439, 340/459, 340/507, 340/508, 340/531, 340/532, 340/3.43, 369/44.29, 369/53.37, 369/53.28
• US Class Current: 701/1
• CPC Class Codes: B60W 50/0098 Details of control systems ensuring comfort, safety or stability not otherwise provided for
• CPC Class Codes: B60W 50/029 Adapting to failures or work around with other constraints, e.g. circumvention by avoiding use of failed parts
• CPC Class Codes: B60W 50/045 Monitoring control system parameters

Abstract

A vehicle control module for controlling an actuator unit in response to an input having a first processor, a first communication link coupled to the first processor, and a second processor coupled to the first processor via the first communication link. The first processor is configured to generate a first value based on the input, transmit the first value to the actuator unit, and receive a second value from the actuator unit based on a data received by the actuator unit from the first processor. The first communication link is configured to transfer the input and the second value to the second processor. The second processor is configured to determine a third value based on the input, and verify the first value based on a comparison of the second value with the third value.

Claims

1. A vehicle control module for controlling an actuator unit in response to an input, the vehicle control module comprising:

a first processor configured to;

generate a first value based on said input;

transmit said first value to the actuator unit; and

receive a second value generated by the actuator unit, said second value comprising a signature based on a data received by the actuator unit from said first processor;

first and second communication links coupled to said first processor; and

a second processor coupled to said first processor via said first communication link, said first communication link configured to transfer said input and said second value to said second processor, said first processor is further configured to transmit said first value to said second processor via said second communication link and transfer said second value to said second processor, said second processor configured to;

determine a third value based on said input;

verify said first value based on a comparison of said second value with said third value;

disable said first processor when at least one of;

no data is received by said second processor from said first processor for a pre-determined amount of time,

said second value and said third value do not match, and

said signature and said first value received by said second processor from said first processor do not match; and

switch the vehicle control system to a second operation mode when said second value is outside of said third value, wherein said first processor comprises;

a first control path capable of being coupled to said actuator unit via said first communication link and coupled to said second processor via said second communication link, said first control path configured to generate said first value based on said input;

a third communication link coupled to said first control path;

a second control path coupled to said first control path via said third communication link, said second control path configured to;

generate a fourth value based on said system input; and

verify said first value based on a comparison of said fourth value with said second value; and

a fourth communication link coupling said second control path with said second processor.

2. A vehicle control module according to claim 1, wherein said signature is a mathematical function of said data received by the actuator unit from said first processor.

3. A vehicle control module according to claim 1, wherein said second value further comprises said data received by the actuator unit from said first processor;

and

wherein said second processor is further configured to disable said first processor when said signature and said data received by the actuator unit from said first processor do not match.

4. A vehicle control module according to claim 1, wherein said second processor is an independent computational path in said first processor.

5. A vehicle control module according to claim 3, wherein said third value comprises a range of values;

and

wherein said second processor is further configured to reset said first processor when said second value is outside of said range of values.

6. A vehicle control module according to claim 1, wherein the actuator unit is coupled to said first processor via a second communication link and configured to generate said signature without duplication by said first processor.

7. A vehicle control module according to claim 1, wherein said first processor is configured to transfer said second value to said second processor without alteration of said second value.

8. A vehicle control system comprising:

an actuator unit;

a first communication link coupled to said unit;

a first processor coupled to said actuator unit via said first communication link, said first processor configured to generate a first value based on a system input, said first value corresponding to a first operation mode of the vehicle control system, said actuator unit configured to generate a second value based on a data received from said first processor corresponding to said first value, said second value comprising a signature;

a second communication link coupled to said first processor; and

a second processor coupled to said first processor via said second communication link, said second processor configured to;

determine a third value based said system input;

verify said first based on a comparison of said value with said third value, and

switch the vehicle control system to a second operation mode when at least one of;

no data is received from said first processor by said second processor for a first amount of time;

said second value and said third value do not match; and

said signature does not correspond with said first value, wherein said first processor comprises;

a first control path coupled to said actuator unit via said first communication link and coupled to said second processor via said second communication link, said first control path configured to generate said first value based on said system input;

a third communication link coupled to said first control path;

a second control path coupled with said first control path via said third communication link, said second control path configured to;

generate a fourth value based on said system input; and

verify said first value based on a comparison of said fourth value with said second value; and

a fourth communication link coupling said second control path with said second processor.

9. A vehicle control system according to claim 8, wherein said signature is a mathematical function of said data received by said actuator unit corresponding to said first value.

10. A vehicle control system according to claim 8, wherein said second value further comprises said data received by said actuator corresponding to said first value;

and

wherein said second processor is further configured to switch the vehicle control system to said second operation mode when said signature does not correspond with said data.

11. A vehicle control system according to claim 8, wherein said second processor is further configured to switch the vehicle control system to said second operation mode when at least one of:

no data is received from said first control path by said second control path for a pre-determined amount of time;

said signature does not correspond with said fourth value; and

said first value and said fourth value do not match.

12. A vehicle control system according to claim 8, wherein said third value comprises a range of values;

wherein said first processor is further configured to transmit said first value to said second processor via said second communication link; and

wherein second processor is further configured to switch the vehicle control system to a second operation mode when said second value is outside of said third value.

13. A vehicle control system according to claim 8, wherein said fourth value comprises a range of values;

and

wherein said second processor is further configured to switch the vehicle control system to said second operation mode when said first value is outside of said fourth value.

14. A vehicle control system according to claim 8, wherein said actuator unit is configured to generate said signature without duplication by said first processor.

15. A vehicle control system according to claim 8, wherein said second operation mode comprises one of:

said second processor disabling said first processor for a second amount of time sufficient for a remedial action by said actuator unit; and

said second processor resetting said first processor for a third amount of time sufficient for a remedial action by said actuator unit.