Gm Global Technology Operations LLC

Lg Chem, Ltd

Fort Robotics, Inc.

Lg Energy Solution, Ltd.

Kerfegar Khurshed Katrak

Paul Alan Bauerle

Kunal Tipnis

John Norman Stockbridge

Mehdi Rexha

Thomas M Forest

Mark Henry Costin

Barbara A Shuler

James K Thomas

Su Hyuk Jang

Nathan Bivans

Robert R Bolio

Donovan L Dibble

James L Worthing

Joseph M Stempnik

Andrew H Leutheuser

Alfred E Spitza, Jr

Bruce A Rogers

Mark A Seifert

Donald A Eveleth

Sagar V Nagaluru

Thaddeus Steyskal

Steven D Palazzolo

Kevin C Wong

Timothy John Hartrey

Patrick J O'Leary

Kevin J Storch

Chieh-Kai Chang

Robert J Schaller

Colin A Roberts

Theresa M Kondel

Scott A Martin

Edward J Tully

David T Proefke

Allen B Rayl, Jr

Hualin Tan

Robert Charles Simon, Jr

David M Sidlosky

Todd R Shupe

Thomas E Utter

Michael Paul Turski

Vivek Mehta

Bahram Younessi

Ross Feller

Hugh S Bauer

Scott A McCullough

Nitin Bharane

Matthew Squire

Kevin T Sharples

James T Purcell

Alan H Canavan

Monica E Dykas

Michael B Mero

Hans Chandra

Timothy A Wellsand

Carol L Daprai

Michael J Kachman

Loren E Majersik

An application processor receives first and safety state information from first and second microcontrollers, and respective first and second sets of bytes forming a first identifier of the first microcontroller and a second identifier of the second microcontroller. The processor concatenates a safety message including the first and second safety state information, the safety message including the first set of bytes and the second set of bytes. The processor transmits the safety message to a second application processor of a safety controller, which separates, the first set of bytes and the second set of bytes, compares at least one of the first set of bytes and the second set of bytes to a data structure of known microcontroller identifiers, and verifies the safety state information based on identifying a match.

Ensuring functional safety requirement satisfaction using fault-detectable microcontroller identifiers

A method includes, storing a set of valid codewords including: a first valid functional codeword representing a functional state of a controller subsystem; a first valid fault codeword representing a fault state of the controller subsystem and characterized by a minimum hamming distance from the first valid functional codeword; a second valid functional codeword representing a functional state of a controller; and a second valid fault codeword representing a fault state of the controller; in response to detecting functional operation of the controller subsystem, storing the first valid functional codeword in a first memory; in response to detecting a match between contents of the first memory and the first valid functional codeword, outputting the second valid functional codeword; in response to detecting a mismatch between contents of the first memory and every codeword in the first set of valid codewords, outputting the second valid fault codeword.

Method for encoded diagnostics in a functional safety system

A feedback-diverse, dual-controller-architecture functional safety system includes: a first module; a second module; and an inter-module logic.

Feedback-diverse, dual-controller-architecture functional safety system

A safety module having a plurality of microcontrollers receives an analog input and determines a value of the analog input. The microcontrollers each determine a respective ternary state of the device by identifying, from three candidate ranges of values, a range of values in which the value falls, wherein at least two of the plurality of microcontrollers uses different candidate ranges of values, determining, based on the identified range, a ternary state corresponding to the range, and assigning the determined ternary state as the respective ternary state. The safety module determines whether the ternary states from the two microcontrollers map to a fault state, and, where they do, cause a command a command to be output to the device to enter a safe state.

Determining functional safety state using software-based ternary state translation of analog input

A method includes, storing a set of valid codewords including: a first valid functional codeword representing a functional timeout state of a second controller; a first valid fault codeword representing a fault timeout state of the second controller and characterized by a minimum hamming distance from the first valid functional codeword; a second valid functional codeword representing a functional state of a system; and a second valid fault codeword representing a fault state of the system; in response to detecting receipt of a safety message from the second controller within a predefined time quantum, storing the first valid functional codeword in a first memory; in response to detecting a match between contents of the first memory and the first valid functional codeword, outputting the second valid functional codeword; in response to detecting a mismatch between contents of the first memory and every codeword in the first set of valid codewords, outputting the second valid fault codeword.

A battery management system includes a microcontroller having a first diagnostic handler application and first and second applications. The first application sets a first non-recoverable diagnostic flag to a first encoded value having each nibble thereof selected from an odd Karnaugh set of binary values. The second application sets a second non-recoverable diagnostic flag to a second encoded value having each nibble thereof selected from an even Karnaugh set of binary values. The first diagnostic handler application sets a first master non-recoverable diagnostic flag to a first encoded fault value if the first non-recoverable diagnostic flag is equal to a second encoded fault value, or the second non-recoverable diagnostic flag is equal to a third encoded fault value.

Battery management system

A diagnostic system for a vehicle electrical system having first and second voltage regulators outputting first and second voltages, respectively, is provided. The diagnostic system includes a microcontroller having an analog-to-digital converter, a first application, and a first diagnostic handler application. The first application sets a first analog-to-digital converter status flag equal to a first fault value when a difference between a first corrected voltage value and a second corrected voltage value is greater than a threshold difference value indicating that the analog-to-digital converter is malfunctioning. The first diagnostic handler application commanding a digital input-output device to generate control signals if the first analog-to-digital converter status flag is equal to the first fault value.

Diagnostic system for a vehicle electrical system having first and second voltage regulators

A diagnostic system for a vehicle electrical system is provided. The diagnostic system includes a microcontroller having microcontroller core components. A first diagnostic handler application sends a first index value to the microcontroller core component diagnostic safety application. The microcontroller core component diagnostic safety application accesses a microcontroller core component diagnostic flag in a first table in the RAM if the first index value is equal to a valid index value in a first table. The microcontroller core component diagnostic safety application sends the microcontroller core component diagnostic flag to the first diagnostic handler application.

Diagnostic system for a vehicle electrical system

A diagnostic system for a DC-DC voltage converter includes a microcontroller having a first diagnostic handler application and first and second applications. The first application sets a first non-recoverable diagnostic flag associated with the DC-DC voltage converter to a first encoded value having each nibble thereof selected from an odd Karnaugh set of binary values. The second application sets a second non-recoverable diagnostic flag to a second encoded value having each nibble thereof selected from an even Karnaugh set of binary values. The first diagnostic handler application sets a first master non-recoverable diagnostic flag to a first encoded fault value if the first non-recoverable diagnostic flag is equal to a second encoded fault value, or the second non-recoverable diagnostic flag is equal to a third encoded fault value.

Diagnostic system for a DC-DC voltage converter

A battery cell management system includes a microcontroller having first and second applications and first and second memory buffers. The first and second memory buffers have first and second overvoltage fault bits, respectively, associated with a first battery cell. The first application sets a first encoded overvoltage fault indicator equal to a first fault value if the first overvoltage fault bit of the first memory buffer is equal to a first binary value. The first application receives a second encoded overvoltage fault indicator from the second application. The first application commands a digital input-output device to generate control signals to transition a contactor to an open operational state if either the first encoded overvoltage fault indicator is equal to the first fault value or the second encoded overvoltage fault indicator is equal to a second fault value.

Battery cell management system

A diagnostic system for a battery management system is provided. The diagnostic system includes a microcontroller having application-specific components. A first BMS diagnostic handler application sends a first index value to an application-specific component diagnostic safety application. The application-specific component diagnostic safety application accesses an application-specific component diagnostic flag in a first table in a RAM if the first index value is equal to a valid index value in a first table. The application-specific component diagnostic safety application sends the application-specific component diagnostic flag to the first BMS diagnostic handler application.

Diagnostic system for a battery management system

A battery management system having a microcontroller with first and second applications and first and second tables is provided. The first table has a first record with a first encoded channel index and a first battery cell voltage value associated with a first battery cell. The second table has a first record with a first encoded channel index and a first battery cell overvoltage flag associated with the first battery cell. The first application sends the first encoded channel index from the first table to the second application. The second application transitions a contactor to an open operational position, when the first encoded channel index from the first table is not equal to a first predetermined encoded channel index indicating a data misalignment of the first battery cell voltage value and the first battery cell overvoltage flag.

Battery cell management system that detects data misalignment between battery cell voltage values and battery cell overvoltage flags

A diagnostic system includes a microcontroller having a first A/D converter, first and second applications, and a first analog multiplexer electrically between a first voltage regulator and the first A/D converter. The first application sets a first overvoltage diagnostic flag to a first fault value if a first voltage of the first voltage regulator that is measured by the first A/D converter is greater than a first voltage, and in response further transitions a contactor to an open operational state. The second application sets a second overvoltage diagnostic flag to a second fault value if a second voltage of the first voltage regulator that is measured by the first A/D converter is greater than a second voltage, and in response further transitions the contactor to the open operational state.

Growing community of inventors

Fenton, MI, United States of America

Kerfegar Khurshed Katrak