Gm Global Technolgoy Operations, Inc.

Thomas E Fuhrman

Soheil Samii

Arnold W Millsap

Miroslawa A Supal

Massimo Osella

Sandeep Menon

Prathap Venugopal

Fan Bai

Markus Jochim

Rami I Debouk

Prachi Joshi

Lawrence E Peruski

Stephen Marc Baker

Jeffrey Joyce

Purnendu Sinha

Kevin M O′Dea

A system for data processing and storage in vehicles having a zone-based, central computing in-vehicle communications network architecture, includes a zone control unit (ZCU) that receives electronic messages from one or more sensors or electronic control units (ECUs) located within a zone of the vehicle, the ZCU comprising a protocol data unit (PDU) gating module that converts the electronic messages into a plurality of PDUs, and a switch-based Ethernet network that transmits the plurality of PDUs, using Ethernet protocol frames comprising the plurality of PDUs, to a central computing platform. The central computing platform includes an Ethernet handler module that decomposes the Ethernet protocol frames into individual PDUs for storage in a shared memory. The central computing platform further includes a plurality of parsing modules that are configured to access the individual PDUs from the shared memory and perform data processing on the individual PDUs.

Systems and methods for data processing and storage in vehicles having a zone-based, central computing in-vehicle communications network architecture

Method and system for interfacing a plurality of providers and a plurality of recipients that are independently located with a unified vehicle service framework having a quality of service filter and a broker module. A first cloud unit has at least one of the plurality of providers and the plurality of recipients. A first vehicle and a second vehicle each respectively have another at least one of the plurality of providers and the plurality of recipients. A second cloud unit has yet another at least one of the plurality of providers and the plurality of recipients. The unified vehicle service framework is configured to receive a subscription request and determine whether it is granted based in part on a quality of service score assigned by the quality of service filter. When the subscription request is granted, respective services from plurality of providers are routed through the broker module.

Unified vehicle service framework for interfacing independently located providers and recipients

A method for dynamically re-allocating controller functions based on minimizing utilization. A lookup table is generated based on functions and mode of operations. Each entry in the lookup table includes a number of executions required for a respective function in a respective mode of operation. Functions for execution to the controllers are assigned based on the number of executions for a function of an entry of a respective mode of operation. A utilization rate is determined for each controller in each mode of operation. Utilization rates of the various modes of operation are compared for each of the controllers. Matching utilization rates are identified between controllers of different modes of operations. A multi-mode re-allocation of function execution in the controller is coordinated by switching a set of pre-allocated functions between different controllers within a respective mode of operation to reduce the utilization rate of at least one controller.

Coordinated multi-mode allocation and runtime switching for systems with dynamic fault-tolerance requirements

A modified dual-duplex fail-operational control system. A primary controller includes a first processing unit and a second processing unit for executing a function. A first comparative module comparing the function results from the first and second processing unit to determine an error the first controller. A second controller includes a first processing unit and second processing unit. The first processing unit executes the function. The second processing unit operating in a non-redundant state and not executing the function while in the non-redundant state. A second comparative module determines whether an error is present in the second controller. A matching function result identified by the first comparative module of the first controller is input to second comparative module of the second controller to determine whether an error is present in the second controller utilizing only the matching function result identified by the first comparative module and the function result determined by the first processing unit of the second controller.

Hybrid dual-duplex fail-operational pattern and generalization to arbitrary number of failures

A method for fault tolerant controller readiness. Executing functions by a first controller operating in a primary status mode. Operating in a hot standby status mode by a second controller and mirroring the first controller by executing functions to operate as a redundant controller. Operating in a cold standby status mode by at least one backup controller under normal operating conditions. The second controller is reconfigured while operating under normal operating conditions from the hot standby status mode to the primary standby status mode if a failure occurs in the first controller. Reconfiguring the at least one backup controller operating under normal operating conditions from cold standby status mode to hot standby status mode to operate as a redundant controller in response to the reconfiguring the second controller from the hot standby status mode to the primary status mode.

Fault-tolerance pattern and switching protocol for multiple hot and cold standby redundancies

An integrated fail-silence and fail-operational control system includes a primary controller controlling features of devices while operating under non-fault operating conditions. A secondary controller includes a fail detector/decider module monitoring faults in the primary controller. The fail detector/decider module determines whether the fault in the primary controller is associated with a fail-silence requirement or a fail-operational requirement. If the fail detector/decider module determines the fault is a fail-silence requirement, then the fail detector/decider module actuates a shutdown command to the primary controller to shut down a feature affected by the fault where the feature becomes non-operational. If the fail detector/decider module determines that the feature associated with the fault is a fail-operational requirement, then the fail detector/decider module signals the primary controller to relinquish controls of the feature to the secondary controller. The secondary controller functions as a high assurance system for controlling the feature in a fail-operational mode.

Architecture for scalable fault tolerance in integrated fail-silent and fail-operational systems

The present disclosure relates to an automated system for use in connection with longitudinal deceleration, longitudinal acceleration, and lateral acceleration functions. The system includes an interface receiving signals from and transmitting signals to a controller. The system also includes a safety kernel system comprising safety kernel software and a set of safety rules. Also disclosed are methods for use in a motion control system in connection with vehicle deceleration, acceleration, and lateral acceleration. The methods in some cases include receiving an initial request into a safety kernel software and determining whether the safety kernel software has received an override. The methods can also include detecting a violation of any primary safeguards defined by the safety kernel software, detecting a violation within a set of secondary safeguards defined by the safety kernel software, and adjusting the initial request to a modified level; and transmitting the modified level to an actuator.

Methods and apparatus for isolating safety functions in a motion control system for a vehicle

A method of dynamically reconfiguring a distributed computing architecture having a plurality of processing nodes, where each processing node hosts a respective plurality of virtual machines, includes detecting a fault condition on a first processing node, assessing the criticality of a software function performed by each of the respective virtual machines on the first processing node, and reassigning at least one of the plurality of virtual machines on the first processing node to a second processing node if the at least one virtual machine is deemed critical.

Distributed computing architecture with dynamically reconfigurable hypervisor nodes

A method of dynamically allocating a task or a signal on a statically allocated and embedded software architecture of a vehicle includes identifying a faulty component. The faulty component may include a software component, a hardware component or a signal or communications link between components. Once the faulty component is identified, any tasks performed by or signals associated with the faulty component are identified, and the tasks performed by or the signals associated with the faulty component are re-allocated to an embedded standby component so that performance of the re-allocated task and/or signal for future system operations is performed by the standby component.

Method of dynamic allocation on a statically allocated and embedded software architecture

Systems and methods for reconfiguring ECU tasks for ensuring that a vehicle is operational upon failure of a task or an ECU. A first on-board reconfiguration strategy is generated and executed by an on-board unit of the vehicle to bring the vehicle to a safe state and a second off-line reconfiguration strategy is generated by a remote center unit and then executed by the on-board unit.

Systems and methods for ECU task reconfiguration

A computer program product includes a storage medium that stores instructions for execution by a processing circuit for practicing a method for synchronous communication in a control system. Within a first time interval, a first source task is executed to broadcast a first destination task, within a second sequential time interval, the first destination task is communicated over a channel to a first destination, and within a third sequential time interval, the first destination task is consumed. Within the first time interval, a second source task may be executed to broadcast a second destination task, within the second sequential time interval, the second destination task may be communicated over the channel to a second destination, and within the third sequential time interval, the second destination task may be consumed. The first source task is allowed to be scheduled ahead of the second source task, and the second source task is allowed to be scheduled ahead of the first source task.

Method and apparatus for communication within control systems

A drive-by-communication-signal vehicle includes a driver interface subsystem having a sensor responsive to an operational characteristic of the driver interface subsystem, a controller responsive to the sensor, a vehicle subsystem responsive to the controller, and a communication channel in signal communication with the driver interface subsystem, the controller, and the vehicle subsystem. The controller includes a storage medium, a processing circuit, and a clock synchronization mechanism defining synchronous communication cycles, with each communication cycle defining at least one time interval. The storage medium, being readable by the processing circuit, stores instructions for execution by the processing circuit for executing and communicating ordered tasks within defined time intervals with flexible task scheduling.

A method and apparatus for synchronous communication in a control system is disclosed. Within a first time interval, a first source task is executed to broadcast a first destination task, within a second sequential time interval, the first destination task is communicated over a channel to a first destination, and within a third sequential time interval, the first destination task is consumed. Within the first time interval, a second source task may be executed to broadcast a second destination task, within the second sequential time interval, the second destination task may be communicated over the channel to a second destination, and within the third sequential time interval, the second destination task may be consumed. The first source task is allowed to be scheduled ahead of the second source task, and the second source task is allowed to be scheduled ahead of the first source task.

Growing community of inventors

Shelby Township, MI, United States of America

Thomas E Fuhrman