Method and apparatus for monitoring software and signal integrity in a distributed control module system for a powertrain system

• US 8,428,816 B2
• Filed: 10/07/2008
• Issued: 04/23/2013
• Est. Priority Date: 10/27/2007
• Status: Active Grant

• Current Assignee: Bayerische Motoren Werke AG, Daimler AG (Mercedes-Benz Group AG), Chrysler Group LLC (Stellantis NV)
• Original Assignee: Bayerische Motoren Werke AG, GM Global Technology Operations LLC (General Motors Company), Daimler AG (Mercedes-Benz Group AG), Chrysler Group LLC (Stellantis NV)
• Inventors: Buur, Hanne, Cawthorne, William R., Haines, Trenton W., Wozniak, Leonard G., Park, Jeong J
• Primary Examiner(s): Nguyen, John
• Assistant Examiner(s): FEI, JORDAN S
• Application Number:
  US12/246,654
• Publication Number:
  US 20090112399A1
• Time in Patent Office: 1,659 Days
• Field of Search: 701/29, 701/33, 701/36, 701/54, 180/65, 180/265, 903/930, 342/357, 342/358
• US Class Current: 701/36
• CPC Class Codes: B60K 1/02 comprising more than one electric motor
• CPC Class Codes: B60K 6/365 with the gears having orbital motion
• CPC Class Codes: B60K 6/445 Differential gearing distribution type
• CPC Class Codes: B60K 6/547 the transmission being a stepped gearing
• CPC Class Codes: B60L 2220/18 Reluctance machines
• CPC Class Codes: B60L 2240/423 Torque
• CPC Class Codes: B60L 2240/441 Speed
• CPC Class Codes: B60L 2240/445 Temperature
• CPC Class Codes: B60L 2240/461 Speed
• CPC Class Codes: B60L 2240/465 Slip
• CPC Class Codes: B60L 2240/486 Operating parameters
• CPC Class Codes: B60L 2240/662 Temperature
• CPC Class Codes: B60L 50/16 with provision for separate direct mechanical propulsion
• CPC Class Codes: B60L 50/61 by batteries charged by engine-driven generators, e.g. series hybrid electric vehicles
• CPC Class Codes: B60L 58/24 for controlling the temperature of batteries
• CPC Class Codes: B60L 7/14 for vehicles propelled by ac motors
• CPC Class Codes: B60W 10/02 including control of driveline clutches
• CPC Class Codes: B60W 10/06 including control of combustion engines
• CPC Class Codes: B60W 10/08 including control of electric propulsion units, e.g. motors or generators
• CPC Class Codes: B60W 10/115 with planetary gears
• CPC Class Codes: B60W 20/11 : using model predictive control [MPC] strategies, i.e. control methods based on models predicting performance utilising navigation and traffic information in the control strategy B60W20/12
• CPC Class Codes: B60W 2050/0006 : Digital architecture hierarchy
• CPC Class Codes: B60W 2510/0638 : Engine speed
• CPC Class Codes: B60W 2510/0671 : Engine manifold pressure
• CPC Class Codes: B60W 2510/0676 : Engine temperature
• CPC Class Codes: B60W 2510/1005 : Transmission ratio engaged
• CPC Class Codes: B60W 2510/1015 : Input shaft speed, e.g. turbine speed
• CPC Class Codes: B60W 2510/104 : Output speed
• CPC Class Codes: B60W 2510/244 : Charge state
• CPC Class Codes: B60W 2510/246 : Temperature
• CPC Class Codes: B60W 2520/28 : Wheel speed
• CPC Class Codes: B60W 2540/10 : Accelerator pedal position
• CPC Class Codes: B60W 2540/12 : Brake pedal position
• CPC Class Codes: B60W 2540/16 : Ratio selector position
• CPC Class Codes: B60W 2555/20 : Ambient conditions, e.g. wind or rain
• CPC Class Codes: B60W 2710/027 : Clutch torque
• CPC Class Codes: B60W 2710/0605 : Throttle position
• CPC Class Codes: B60W 2710/0616 : Position of fuel or air injector
• CPC Class Codes: B60W 2710/0666 : Engine torque
• CPC Class Codes: B60W 2710/083 : Torque
• CPC Class Codes: B60W 50/0205 : Diagnosing or detecting failures; Failure detection models
• CPC Class Codes: B60W 50/04 : Monitoring the functioning of the control system
• CPC Class Codes: G05B 2219/23213 : Check validity of entered data
• CPC Class Codes: G05B 2219/23215 : Check data validity in ram, keep correct validity, compare rom ram
• CPC Class Codes: G06F 11/1492 : by run-time replication performed by the application software
• CPC Class Codes: G06F 11/1497 : Details of time redundant execution on a single processing unit
• CPC Class Codes: G06F 11/167 : Error detection by comparing the memory output
• CPC Class Codes: Y02T 10/62 : Hybrid vehicles
• CPC Class Codes: Y02T 10/64 : Electric machine technologies in electromobility
• CPC Class Codes: Y02T 10/70 : Energy storage systems for electromobility, e.g. batteries
• CPC Class Codes: Y02T 10/7072 : Electromobility specific charging systems or methods for batteries, ultracapacitors, supercapacitors or double-layer capacitors
• CPC Class Codes: Y02T 10/72 : Electric energy management in electromobility
• CPC Class Codes: Y02T 90/16 : Information or communication technologies improving the operation of electric vehicles

Abstract

A method to monitor integrity of a signal generated and communicated in a distributed control module system for a hybrid powertrain system includes generating and verifying signal within an originating control module. A message is generated based upon the signal. The message is transmitted and received at a receiving control module. The signal is extracted from the message and its integrity is verified.

Claims

1. Method to monitor signal integrity in a distributed control module system operative to control a hybrid powertrain system, the method comprising:

establishing a single communications link between an originating control module and a receiving control module;

generating a signal in the originating control module;

verifying integrity of the signal within the originating control module including capturing primary and redundant signals based upon the signal, executing diagnostics on each of the primary and redundant signals, and comparing the primary signal with the redundant signal to validate the primary signal;

dual storing the primary signal as the primary signal and a secondary signal;

generating a message including the primary and secondary signals;

transmitting the message to the receiving control module using the single communications link;

receiving the message at the receiving control module;

decoding the primary and secondary signals from the message within the receiving control module; and

comparing the primary and secondary signals to verify integrity of the primary signal within the receiving control module.

2. The method of claim 1, wherein the signal comprises one of an operator command signal, an input signal, and an actuator control signal.

3. The method of claim 1, wherein dual storing the primary signal as the primary signal and the secondary signal comprises verifying integrity of each of first and second memory locations and then storing the primary signal in the first memory location and storing the primary signal in the second memory location as the secondary signal.

4. The method of claim 3, further comprising dual storing the primary signal as the primary signal and the secondary signal in the first and second memory locations only when the primary signal is valid and the integrity of each of the first and second memory locations is verified.

5. The method of claim 1, wherein generating the message including the signal comprises:

including a first word consisting of the primary signal;

including a second word consisting of a sequentially incrementing digital word value; and

including a third word consisting of a logic complement of a sum of the secondary signal and the second word.

6. The method of claim 1, wherein decoding the primary and secondary signals from the message comprises:

capturing a first word from the message comprising the primary signal;

capturing a second word from the message;

capturing a third word from the message and taking a logic complement of the third word and subtracting the second word therefrom to determine a resultant comprising the secondary signal; and

validating the first word based upon the resultant.

7. The method of claim 1, further comprising:

verifying integrity of each of first and second memory locations in the receiving control module; and

dual storing the first word in both the first and second memory locations in the receiving control module.

8. The method of claim 7, further comprising dual storing the first word in both the first and second memory locations in the receiving control module only when the first word is validated and the integrity of each of the first and second memory locations in the receiving control module is verified.

9. The method of claim 1, further comprising executing remedial action when the integrity of the signal is not verified within the originating control module.

10. The method of claim 1, further comprising executing remedial action when the integrity of the signal is not verified within the receiving control module.

11. Method to monitor integrity of a signal for controlling a torque actuator communicated between an originating control module and a receiving control module in a distributed control module system for a powertrain system including a plurality of torque actuators, the method comprising:

establishing a single communications link between the originating control module and the receiving control module;

generating a signal in the originating control module;

verifying integrity of the signal within the originating control module including capturing primary and redundant signals based upon the signal, executing diagnostics on each of the primary and redundant signals, and comparing the primary signal with the redundant signal to validate the primary signal;

dual storing the primary signal as the primary signal and a secondary signal;

generating a message including the primary and secondary signals;

transmitting the message to the receiving control module using the single communications link;

receiving the message at the receiving control module;

decoding the primary and secondary signals from the message within the receiving control module;

comparing the primary and secondary signals to verify integrity of the primary signal within the receiving control module; and

operating one of the torque actuators based upon the primary signal.

12. The method of claim 11, wherein the torque actuators include an engine, a transmission and a torque generating machine, the transmission operative to transfer power between the engine and the torque generating machine and an output member.

13. Method to monitor integrity of a signal communicated between an originating control module and a torque actuator control module in a distributed control module system for a powertrain system including a plurality of torque actuators, the method comprising:

generating a signal in the originating control module;

capturing the signal as a primary and a redundant signal;

executing diagnostics on each of the primary and redundant signals;

validating the primary signal based upon the redundant signal;

verifying integrity of each of first and second memory locations in the originating control module;

storing the primary signal in both the first and second memory locations when the primary signal is valid and the integrity of each of the first and second memory locations is verified;

establishing a single communications link to transmit the primary signal between the originating control module and the torque actuator control module;

generating a message including the primary signal stored in both the first and second memory locations; and

transmitting the message to the torque actuator control module.

14. The method of claim 13, further comprising receiving the message at the torque actuator control module;

decoding and validating the primary signal from the received message within the torque actuator control module;

verifying integrity of first and second memory locations in the torque actuator control module; and

storing the primary signal in the first and second memory locations in the torque actuator control module when the primary signal is validated and the integrity of the first and second memory locations in the receiving control module are verified.

15. The method of claim 13, further comprising;

receiving the message at the torque actuator control module;

decoding the primary signal from the received message within the torque actuator control module;

verifying integrity of the decoded primary signal within the torque actuator control module; and

operating one of the torque actuators based upon the verified primary signal.

16. The method of claim 13, wherein verifying integrity of each of the first and second memory locations in the originating control module comprises determining whether contents of the first and second memory locations are identical prior to storing the primary signal therein.