Dual core architecture of a control module of an engine

• US 9,207,661 B2
• Filed: 07/20/2007
• Issued: 12/08/2015
• Est. Priority Date: 07/20/2007
• Status: Active Grant

• Current Assignee: GM Global Technology Operations LLC (General Motors Company)
• Original Assignee: GM Global Technology Operations LLC (General Motors Company)
• Inventors: Costin, Mark H., Bauerle, Paul A.
• Primary Examiner(s): Tran, Khoi
• Assistant Examiner(s): MOYER, DALE S
• Application Number:
  US11/880,449
• Publication Number:
  US 20090024775A1
• Time in Patent Office: 3,063 Days
• Field of Search: 701/1, 701/29, 701 33- 35
• US Class Current: 1/1
• CPC Class Codes: B60G 2600/086 Redundant systems
• CPC Class Codes: B60G 2600/187 Digital Controller Details and Signal Treatment
• CPC Class Codes: B60W 50/02 Ensuring safety in case of control system failures, e.g. by diagnosing, circumventing or fixing failures
• CPC Class Codes: G05B 19/0428 Safety, monitoring G05B19/0423 takes precedence
• CPC Class Codes: G05B 2219/24187 Redundant processors run identical programs
• CPC Class Codes: G05B 2219/24195 Compare data in channels at timed intervals, for equality
• CPC Class Codes: G05B 2219/24198 Restart, reinitialize, boot system after fault detection, hanging up, stalling
• CPC Class Codes: G06F 11/1637 using additional compare functionality in one or some but not all of the redundant processing components
• CPC Class Codes: G06F 11/1641 where the comparison is not performed by the redundant processing components
• CPC Class Codes: G06F 11/1654 where the output of only one of the redundant processing components can drive the attached hardware, e.g. memory or I/O
• CPC Class Codes: G06F 11/1683 at instruction level
• CPC Class Codes: G06F 11/1687 at event level, e.g. by interrupt or result of polling
• CPC Class Codes: G06F 11/2236 to test CPU or processors

Abstract

A control system for a control module of a vehicle includes a first integrated circuit (IC) core of a primary processor that generates a first control signal using a central processing unit (CPU). A second IC core of the primary processor generates a second control signal using a second CPU and generates a remedial control signal based on the first control signal and the second control signal.

Claims

1. A control system for a control module of a vehicle, comprising:

a first integrated circuit (IC) core of a primary processor that generates a first control signal using first a central processing unit (CPU); and

a second IC core of said primary processor that generates a second control signal using a second CPU, and said second IC core generating a remedial control signal based on said first control signal and said second control signal, wherein said second IC core generates said second control signal in response to said second IC core receiving a notification signal from said first IC core indicating that said first IC core has generated said first control signal.

2. The system of claim 1 wherein said second IC core generates said remedial control signal when said second control signal is not equivalent to said first control signal.

3. The system of claim 1 wherein said second IC core commands a remedial action when said second IC core fails to receive said notification signal within a calibrated period.

4. The system of claim 1 wherein said remedial control signal includes at least one of signaling a resynchronization of a data path of said first IC core and a redundant data path of said second IC core to a predetermined state and signaling a running reset of said first IC core and said second IC core.

5. The system of claim 1 wherein said first IC core and said second IC core independently process data.

6. The system of claim 1 further comprising:

memory; and

an error correction coding (ECC) module, wherein said first IC core and said second IC core share said memory and said ECC module verifies said memory.

7. The system of claim 6 wherein one of said first IC core and said second IC core verify an operation of said ECC module.

8. The system of claim 1 wherein:

said first IC core generates said first control signal using a first data path;

said second IC core generates a second control signal using a second data path; and

said second data path is redundant relative to said first data path.

9. The system of claim 1 wherein said first and second control signals are associated with controlling an actuator of said vehicle.

10. The system of claim 9 wherein said actuator includes at least one of a brake actuator and a steering actuator.

11. A method for operating a control module of a vehicle, comprising:

generating a first control signal using a first CPU of a first IC core on a primary processor;

generating a second control signal using a second CPU of a second IC core on the primary processor in response to said second IC core receiving a notification signal from said first IC core indicating that said first IC core has generated said first control signal; and

generating a remedial control signal using the second IC core based on said first control signal and said second control signal.

12. The method of claim 11 further comprising generating said remedial control signal when said second control signal is not equivalent to said first control signal.

13. The method of claim 11 further comprising commanding a remedial action when said second IC core fails to receive said notification signal within a calibrated period.

14. The method of claim 11 wherein said remedial control signal includes at least one of signaling a resynchronization of a data path of said first IC core and a redundant data path of said second IC core to a predetermined state and signaling a running reset of said first IC core and said second IC core.

15. The method of claim 11 wherein said first IC core and said second IC core independently process data.

16. The method of claim 11 wherein one of said first IC core and said second IC core verify an operation of an error correction coding (ECC) module of said control module.

17. The method of claim 11 further comprising:

generating said first control signal using a first data path of said first IC core; and

generating a second control signal using a second data path of said second IC core, wherein said second data path is redundant relative to said first data path.

18. The method of claim 11 wherein said first and second control signals are associated with controlling an actuator of said vehicle.

19. The method of claim 18 wherein said actuator includes at least one of a brake actuator and a steering actuator.