System and method for verifying the integrity of a safety-critical vehicle control system

• US 9,058,419 B2
• Filed: 05/01/2012
• Issued: 06/16/2015
• Est. Priority Date: 03/14/2012
• Status: Active Grant

• Current Assignee: GM Global Technology Operations LLC (General Motors Company)
• Original Assignee: GM Global Technology Operations LLC (General Motors Company)
• Inventors: Costin, Mark H., Zhao, Ming, Bauerle, Paul A., Balike, Mahesh, Kurnik, James T.
• Primary Examiner(s): MCCARTHY, CHRISTOPHER S
• Application Number:
  US13/461,056
• Publication Number:
  US 20130246866A1
• Time in Patent Office: 1,141 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: B60W 2050/0083 Setting, resetting, calibration
• CPC Class Codes: B60W 2050/0292 Fail-safe or redundant systems, e.g. limp-home or backup systems
• CPC Class Codes: B60W 2050/041 Built in Test Equipment [BITE]
• CPC Class Codes: B60W 50/04 Monitoring the functioning of the control system
• CPC Class Codes: G06F 1/24 Resetting means
• CPC Class Codes: G06F 11/3604 Software analysis for verifying properties of programs byte-code verification G06F9/44589

Abstract

A control system according to the principles of the present disclosure includes an operation control module, a fault detection module, a remedial action module, and a reset module. The operation control module controls operation of a vehicle system. The fault detection module detects a fault in the operation control module when the operation control module fails an integrity test. The remedial action module takes a remedial action when the fault is detected. The reset module resets the operation control module when the fault is detected and the remedial action is not taken.

Claims

1. A control system comprising:

an operation control module that controls operation of a vehicle system;

a fault detection module that detects a fault in the operation control module when the operation control module fails an integrity test;

a remedial action module that takes a remedial action when the fault is detected; and

a reset module that resets the operation control module when (i) the fault is detected and (ii) the remedial action is not taken, wherein the remedial action includes at least one of (i) activating a service indicator and (ii) disabling the vehicle system.

2. The control system of claim 1, wherein the remedial action includes activating the service indicator.

3. A control system comprising:

an operation control module that controls operation of a vehicle system;

a fault detection module that detects a fault in the operation control module when the operation control module fails an integrity test;

a remedial action module that takes a remedial action when the fault is detected; and

a reset module that resets the operation control module when (i) the fault is detected and (ii) the remedial action is not taken, wherein the remedial action includes disabling the vehicle system.

4. The control system of claim 3, further comprising a watchdog timer module that resets the operation control module when the operation control module does not service the watchdog timer module at a predetermined interval.

5. The control system of claim 4, wherein the operation control module, the fault detection module, the remedial action module, the reset module, and the watchdog timer module are integrated into a first chip.

6. The control system of claim 5, wherein the watchdog timer module includes a first watchdog timer module and a second watchdog timer module, the first watchdog timer module is integrated into the first chip, and the second watchdog timer module is integrated into a second chip that is separate from the first chip.

7. The control system of claim 4, wherein the reset module resets the operation control module by instructing the operation control module to stop servicing the watchdog timer module.

8. The control system of claim 4, wherein the reset module resets the operation control module by executing an internal reset.

9. The control system of claim 3, wherein the integrity test includes a program sequence watch test, a checksum test, a stack overflow test, an arithmetic logic unit test, and a configuration register test.

10. The control system of claim 3, wherein the operation control module controls the vehicle system by executing a first routine and the fault detection module performs the integrity test by executing a second routine in parallel with the first routine.

11. The control system of claim 10, wherein the reset module determines whether to reset the operation control module by executing a third routine in parallel with the first routine.

12. A method comprising:

controlling operation of a vehicle system using an operation control module;

detecting a fault in the operation control module when the operation control module fails an integrity test;

taking a remedial action when the fault is detected; and

resetting the operation control module when (i) the fault is detected and (ii) the remedial action is not taken, wherein the remedial action includes at least one of (i) activating a service indicator and (ii) disabling the vehicle system.

13. The method of claim 12, wherein the remedial action includes activating the service indicator.

14. A method comprising:

controlling operation of a vehicle system using an operation control module;

detecting a fault in the operation control module when the operation control module fails an integrity test;

taking a remedial action when the fault is detected; and

resetting the operation control module when (i) the fault is detected and (ii) the remedial action is not taken, wherein the remedial action includes disabling the vehicle system.

15. The method of claim 14, further comprising resetting the operation control module when the operation control module does not service a watchdog timer module at a predetermined interval.

16. The method of claim 14, further comprising resetting the operation control module by instructing the operation control module to stop servicing a watchdog timer module.

17. The method of claim 14, further comprising resetting the operation control module by executing an internal reset.

18. The method of claim 14, wherein the integrity test includes a program sequence watch test, a checksum test, a stack overflow test, an arithmetic logic unit test, and a configuration register test.

19. The method of claim 14, further comprising controlling the vehicle system by executing a first routine and performing the integrity test by executing a second routine in parallel with the first routine.

20. The method of claim 19, further comprising determining whether to reset the operation control module by executing a third routine in parallel with the first routine.