Primary controller designation in fault tolerant systems
First Claim
1. A fault tolerant controller strategy for a fail-operational vehicle system comprising the steps of:
- (a) providing a first controller and a second controller both generating control signals intended to control actuation devices on a vehicle under non-fault operating conditions, the first controller initially designated as a primary controller and the second controller initially designated as a secondary controller, the actuation devices being responsive only to the designated primary controller;
(b) detecting an error in one of the two controllers, wherein the respective controller detected with the error is initially identified as a faulty controller and the other controller is initially identified as a non-faulty controller, wherein detecting an error in one of the two controllers in step (b) includes self-detection of the error by the faulty controller;
(c) if a controller error is detected in step (b), then generating control signals by the non-faulty designated primary controller for controlling actuation of the actuation devices, the control signals including an identifier that identifies the non-faulty controller as the designated primary controller;
(d) in response to detecting the error in step (b), resetting the faulty controller to operate in a safe operating mode as the secondary controller, and actuating a first error message to a user alerting the user of the error detected in step (b); and
(e) transmitting a message from the faulty controller to the non-faulty controller identifying the error in response to detecting the error in one of the two controllers, wherein the non-faulty controller is subsequently designated as the primary controller.
3 Assignments
0 Petitions
Accused Products
Abstract
A fault tolerant controller system includes a first controller and a second controller. One of the first and second controllers designated as a primary controller for generating control signals intended to control actuation devices on a vehicle under non-fault operating conditions, and the other of the first and second controllers designated as a secondary controller generating control signals intended to control actuation devices on the vehicle. The actuation devices are responsive only to the designated primary controller. An error is detected in the primary controller and a message is transmitted from the faulty controller to the non-faulty controller identifying the error. The non-faulty controller is subsequently designated as the primary controller. The control signals including an identifier that identifies the non-faulty controller as the designated primary controller. In response to detecting the error, the faulty controller is reset to operate in a safe operating mode as the secondary controller.
67 Citations
18 Claims
-
1. A fault tolerant controller strategy for a fail-operational vehicle system comprising the steps of:
-
(a) providing a first controller and a second controller both generating control signals intended to control actuation devices on a vehicle under non-fault operating conditions, the first controller initially designated as a primary controller and the second controller initially designated as a secondary controller, the actuation devices being responsive only to the designated primary controller; (b) detecting an error in one of the two controllers, wherein the respective controller detected with the error is initially identified as a faulty controller and the other controller is initially identified as a non-faulty controller, wherein detecting an error in one of the two controllers in step (b) includes self-detection of the error by the faulty controller; (c) if a controller error is detected in step (b), then generating control signals by the non-faulty designated primary controller for controlling actuation of the actuation devices, the control signals including an identifier that identifies the non-faulty controller as the designated primary controller; (d) in response to detecting the error in step (b), resetting the faulty controller to operate in a safe operating mode as the secondary controller, and actuating a first error message to a user alerting the user of the error detected in step (b); and (e) transmitting a message from the faulty controller to the non-faulty controller identifying the error in response to detecting the error in one of the two controllers, wherein the non-faulty controller is subsequently designated as the primary controller. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11)
-
-
12. A fault tolerant controller system for a fail-operational vehicle system comprising:
-
a first controller generating control signals intended to control actuation devices on a vehicle under non-fault operating conditions, the first controller initially designated as a primary controller; a second controller generating control signals intended to control the actuation devices on the vehicle, the second controller initially designated as a secondary controller, the actuation devices being responsive only to the designated primary controller; wherein when an error is detected in one of the two controllers, a message is transmitted from the faulty controller to the non-faulty controller identifying the error, and wherein the non-faulty controller is subsequently designated as the primary controller; wherein control signals generated by the non-faulty designated primary controller for controlling actuation of the actuation devices include an identifier that identifies the non-faulty controller as the designated primary controller; wherein in response to detecting the error, the faulty controller is re-initialized to operate in a safe operating mode as the secondary controller; wherein if an error is subsequently detected in the non-faulty controller designated as the primary controller, then transmitting a message identifying the error from the designated primary controller to the secondary controller operating currently in the safe operating mode, the primary controller identified as having an error is designated as a succeeding secondary controller operating in safe operating mode; wherein the secondary controller currently operating in the safe operating mode generates control signals that include an identifier identifying the secondary controller currently operating in safe operating mode as the designated primary controller; and wherein a second error message is actuated to the user after errors are detected in both the first and second controllers, and wherein the second error message generated in response to the error detected in first and second controllers is of greater urgency relative to the first error message generated in response to the error detected in one of the two controllers. - View Dependent Claims (13, 14, 15, 16, 17, 18)
-
Specification