System and method to determine the operating status of an electrical system having a system controller and an actuator controller

• US 8,847,535 B2
• Filed: 11/08/2011
• Issued: 09/30/2014
• Est. Priority Date: 11/08/2011
• Status: Active Grant

• Current Assignee: Veoneer US Safety Systems LLC
• Original Assignee: Autoliv ASP Incorporated (Autoliv Incorporated)
• Inventors: Mills, Robert Duane, Carpenter, Jeffrey Michael
• Primary Examiner(s): Olszewski, John R
• Assistant Examiner(s): Cass, Jean-Paul
• Application Number:
  US13/291,686
• Publication Number:
  US 20130113406A1
• Time in Patent Office: 1,057 Days
• Field of Search: None
• US Class Current: 318/454
• CPC Class Codes: B60L 3/0023 Detecting, eliminating, remedying or compensating for drive train abnormalities, e.g. failures within the drive train
• CPC Class Codes: B60L 3/0084 relating to control modules
• CPC Class Codes: B60L 3/04 Cutting off the power supply under fault conditions protective devices and circuit arrangements in general H01H; H02H
• CPC Class Codes: G05B 19/0428 Safety, monitoring G05B19/0423 takes precedence
• CPC Class Codes: G05B 2219/14106 Reconfiguration of components or graceful degradation, degrade
• CPC Class Codes: G05B 2219/25158 Watchdog
• CPC Class Codes: G06F 11/0739 in a data processing system embedded in automotive or aircraft systems
• CPC Class Codes: G06F 11/0757 by exceeding a time limit, i.e. time-out, e.g. watchdogs

Abstract

A system and method to determine the operating status of an electrical system includes a system controller and an actuator controller. The system controller determines if the actuator controller is operating properly and initiates a safe mode of operation if the actuator is not operating properly. In turn, the actuator controller determines if the system controller is operating properly and initiates a safe mode of operation if the system controller is not operating properly.

Claims

1. A method to determine an operating status of an electrical system having a system controller configured to send commands to several actuator controllers subordinate to the system controller, each of the several actuator controllers controlling an actuator of a vehicle, the method comprising the steps of:

generating a system key by the system controller for the several actuator controllers;

transmitting the system key from the system controller to a respective one of the several actuator controllers;

evaluating the system key by the respective one of the several actuator controllers to determine whether the system controller is operating properly or improperly;

initiating a first safe mode operation upon determining by the respective one of the actuator controllers that the system controller is operating improperly, the first safe mode operation causing the respective one of the several actuator controllers to ignore all subsequent commands received from the system controller while allowing the system controller continues to send new commands to the respective one of the several actuator controller controllers;

generating an actuator key by the actuator controller;

transmitting the actuator key from the actuator controller to the system controller upon

determining that the system controller is operating properly;

comparing the actuator key by the system controller with an expected actuator key value;

determining by the system controller that the actuator controller is operating improperly upon determining that the actuator key is an unexpected actuator key value; and

initiating a second safe mode operation upon determining that the actuator controller is operating improperly, the second safe mode operation causing the system controller to remove power from the actuator controller.

2. The method of claim 1 further comprising the steps of:

comparing, by the actuator controller, the system key with an expected system key value; and

initiating the first safe mode upon determining that system key is an unexpected system key value.

3. The method of claim 1, wherein the actuator key value is based on a system rate of the actuator controller.

4. The method of claim 1, wherein the actuator key value is based on system checks of at least one logic unit of the actuator controller.

5. The method of claim 4, wherein the at least one logic unit of the actuator controller is a read only memory, a random access memory, or an arithmetic logic unit.

6. The method of claim 1, further comprising the steps of:

comparing, by the system controller, a rate at which the actuator key was generated with an expected rate; and

removing power from the actuator controller upon determining that the actuator key was generated at an unexpected rate.

7. The method of claim 2, further comprising the step of transmitting from the actuator controller to the system controller information regarding an operating state of the system controller.

8. The method of claim 2, wherein the system key value is based on a system rate of the system controller.

9. The method of claim 2, wherein the system key value is based on system checks of at least one logic unit of the system controller.

10. The method of claim 9, wherein the at least one logic unit of the system controller is a read only memory, a random access memory, or an arithmetic logic unit.

11. The method of claim 2, further comprising the steps of:

comparing, by the actuator controller, a rate at which the system key was generated with an expected rate; and

ignoring commands from the system controller by the actuator controller upon determining that the system key was generated at an unexpected rate.

12. The method of claim 11, further comprising the step of transmitting from the actuator controller to the system controller information regarding an operating state of the system controller.

13. The method of claim 2, further comprising the steps of:

determining by the actuator controller if the system controller is capable of determining if the actuator key is the expected actuator key value; and

ignoring commands from the system controller by the actuator controller upon determining that the system controller is incapable of determining if the actuator key is the expected actuator key value.

14. The method of claim 1, further comprising the steps of:

determining by the system controller if the actuator controller is capable of determining if the system key is the expected system key value; and

removing power from the actuator controller upon determining that the actuator controller is incapable of determining if the system key is the expected system key value.