Abstract:
A method of verifying the integrity of an arithmetic logic unit (ALU) of a control module includes inputting a first test value into one of a plurality of registers of the ALU and inputting a second test value into remaining registers of the plurality of registers. A first set of operations is performed between the one of the plurality of registers and each of the remaining registers to produce a first set of results. A fault is indicated when one of the first set of results varies from a first predetermined result.

Description:
FIELD OF THE INVENTION 
     The present invention relates to control modules, and more particularly to a method of verifying the integrity of an arithmetic logic unit (ALU) of a control module. 
     BACKGROUND OF THE INVENTION 
     Control modules are implemented in a variety of systems to process data and provide control signals. For example, vehicle control modules generate control signals that direct the operation of vehicle components. The control module receives signals from various sensors and other devices that monitor operating characteristics (e.g., engine speed, temperature, pressure, gear ratio and the like). The control signals are based on the signals received from the various sensors. More particularly, the control module processes signal information using an arithmetic logic unit (ALU). The control module processes the control signals based on a pre-programmed control strategy. 
     In some applications, control modules generate safety critical control signals. That is to say, the control signals direct component operation that can effect vehicle performance. For example, in a vehicle having a shift-by-wire system, the control module generates control signals that regulate shifting of a transmission. Inaccuracy in the control signals can result in damage to the components of the transmission and/or improper operation of the transmission. 
     A defective ALU and/or memory registers can effect control signal accuracy. Therefore, integrity checks have been developed to determine whether the ALU and/or memory registers are functioning properly. Traditional ALU integrity checks, however, fail to check all operations that the ALU performs. 
     SUMMARY OF THE INVENTION 
     Accordingly, the present invention provides a method of verifying the integrity of an arithmetic logic unit (ALU) of a control module. The method includes inputting a first test value into one of a plurality of registers of the ALU and inputting a second test value into remaining registers of the plurality of registers. A first set of operations is performed between the one of the plurality of registers and each of the remaining registers to produce a first set of results. A fault is indicated when one of the first set of results varies from a first predetermined result. 
     In other features, the method further includes inputting the first test value into the remaining registers and performing a second set of operations between the one of the plurality of registers and each of the remaining registers to produce a second set of results. A fault is indicated when one of the second set of results varies from a second predetermined result. 
     In other features, the first set of operations includes logic operations. The logic operations include at least one logic operation from a group consisting of AND, OR, XOR and NOT. 
     In other features, the second set of operations include logic operations. The logic operations include at least one logic operation from a group consisting of AND, OR, XOR and NOT. 
     In still other features, the first set of operations include comparison operations. The comparison operations include at least one comparison operation from a group consisting of equal to (=), not equal to (≠), less than (&lt;), less than or equal to (≦), greater than (&gt;) and greater than or equal to (≧). 
     In yet other features, the second set of operations include comparison operations. The comparison operations include at least one comparison operation from a group consisting of equal to (=), not equal to (≠), less than (&lt;), less than or equal to (≦), greater than (&gt;) and greater than or equal to (≧). 
     Further areas of applicability of the present invention will become apparent from the detailed description provided hereinafter. It should be understood that the detailed description and specific examples, while indicating the preferred embodiment of the invention, are intended for purposes of illustration only and are not intended to limit the scope of the invention. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       The present invention will become more fully understood from the detailed description and the accompanying drawings, wherein: 
         FIG. 1  is a schematic illustration of a control module that includes a processor having an arithmetic logic unit (ALU); 
         FIG. 2  is a flowchart illustrating a comparison integrity check for the ALU; 
         FIG. 3  is a flowchart illustrating an AND logic integrity check for the ALU; 
         FIG. 4  is a flowchart illustrating an OR logic integrity check for the ALU; 
         FIG. 5  is a flowchart illustrating an XOR logic integrity check for the ALU; 
         FIG. 6  is a flowchart illustrating a NOT logic integrity check for the ALU; 
         FIG. 7A  is a flowchart illustrating a first portion of an exemplary seed and key based ALU check for comparison operations according to the present invention; and 
         FIG. 7B  is a flowchart illustrating a second portion of the exemplary seed and key based ALU check for comparison operations according to the present invention. 
     
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 
     The following description of the preferred embodiment is merely exemplary in nature and is in no way intended to limit the invention, its application, or uses. For purposes of clarity, the same reference numbers will be used in the drawings to identify similar elements. As used herein, the term operation refers to comparison operations and logic operations. Comparison operations include, but are not limited to, equal to (=), not equal to (≠), less than (&lt;), less than or equal to (≦), greater than (&gt;) and greater than or equal to (≧). Logic operations include, but are not limited to, AND, OR, XOR and NOT. 
     Referring now to  FIG. 1 , an exemplary control module  10  is schematically illustrated. The control module includes a processor  12 , random access memory (RAM)  14  and a data link  16  that enables communications between the processor  12  and the RAM  14 . The processor  12  includes an algorithmic logic unit (ALU)  18  and the RAM includes data storage registers  20  (R 1  to R N ). Although the data storage registers  20  are illustrated as part of the RAM  14 , it is appreciated that the location of the data storage registers  20  can vary based on the particular control module architecture. The number of registers  20  can vary and the number of storage bits per register can vary. 
     The ALU  18  controls the transfer of data to and from the registers  20  and manipulates the data stored within the registers  20 . More particularly, the ALU  18  performs calculations using the stored data to determine control signals for operating a system, such as a vehicle system. Some of the calculations performed by the ALU  18  are considered safety-critical. Therefore, proper functioning of the ALU  18  is necessary to ensure the resultant control signals safely operate system components. For example, in a vehicle having a shift-by-wire system, the control module  10  generates control signals that regulate shifting of a transmission. A defective ALU  18  may generate incorrect control signals for the current vehicle operating conditions. As a result, components of the transmission may be damaged and/or the transmission may improperly function. 
     The ALU integrity checks of the present invention determine whether all logic functions and tests performed by the ALU  18  are accurate, thereby ensuring the integrity of the ALU  18 . It is appreciated that not all of the ALU integrity checks need be performed for a particular control module  10 . For example, if the control module  10  does not execute all of the logic functions and tests, only the ALU integrity checks that correspond to the logic functions and tests is does perform. The ALU integrity checks are periodically executed by the control module  10  and can run based on a standard processing loop or intermittently between processing loops. One ALU integrity check evaluates the comparison operations performed by the ALU including, but not limited to, equal to (=), not equal to (≠), less than (&lt;), less than or equal to (≦), greater than (&gt;) and greater than or equal to (≧). Another ALU integrity check evaluates the logic operations performed by the ALU including, but not limited to, AND, OR, XOR and NOT. 
     The ALU integrity checks of the present invention use test values that are stored in the registers  20 . Comparison and logic operations are performed on the test values. If the results of the operations are valid, the registers  20  and the ALU  18  are deemed to be operating properly. If a result of the operations is invalid, the specific register  20  and/or the ALU  18  are deemed to be operating improperly and remedial action is taken. The type of remedial action may vary based on system type (e.g., engine control, transmission control and the like). For example, in the case of an engine control system, the remedial action can include, but is not limited to, shutting down the engine or limiting engine speed. In the case of a transmission control system, the remedial action can include, but is not limited to, holding the transmission in park or limiting the gears available. Other remedial actions are also anticipated including, but not limited to, initiating a visual and/or audible fault indicator. 
     The ALU  18  performs signed and unsigned operations on the test values. A byte can take values of 0 to 255, which is $00 to $FF in hexadecimal (hex) or 0000 0000 to 111 1111 in binary. In unsigned operations, the values of the byte are interpreted as integers 0 to 255. In typical signed operations, called 2&#39;s complement, the left most bit indicates the sign. For example, 0 indicates a positive number and 1 indicates a negative number. As a result, the byte values $00 to $7F (i.e., 0000 0000 to 0111 1111) are integer values 0 to 127. Alternatively, the byte values $FF to $80 (i.e., 1111 1111 to 1000 0000) are integer values −1 to −128. Although the ALU check discussed in detail below are designed for 2&#39;s complement operations, each can be modified by those skilled in the art for other representations of negative numbers (e.g., 1&#39;s complement). 
     The exemplary test values implemented in the foregoing discussion include $AAAA and $5555, each comprised of 2-bytes, $AA and $55, respectively. The hex value $AA (i.e., 1010 1010) is equal to 170 unsigned and −86 signed. The hex value $5555 (i.e., 0101 0101) is equal to 85 signed and unsigned. Therefore, $AA is greater than $55 (i.e., 170&gt;85) for unsigned operations and $AA is less than $55 (i.e., −86&lt;85) for signed operations. It should also be noted that $AAAA has an opposite bit pattern as $5555. It is appreciated, that the test values and the number of bytes thereof are exemplary in nature. More particularly, the exemplary test values each include 2-bytes consisting of 16-bits. The test values can be larger or smaller based upon the size of the registers. For example, if each register can store only 1-byte, the test values $AA and $55 can be used. If each register can store 3-bytes, the test values $AAAAAA and $555555 can be used. 
     Referring now to  FIG. 2 , an ALU comparison check ensures the integrity of the ALU  18  with respect to comparison operations. In step  200 , i is set equal to 1. In step  202 , the hex test value $AAAA is stored in register R[i]. In step  204 , j is set equal to i+1. The hex test value $5555 is stored in register R[j] in step  206 . In step  208 , the ALU check determines whether R[i]. is less than R[j] using an unsigned operation. If R[i] is less than R[j], a fault is indicated in step  210 . If R[i] is not less than R[j], the ALU check determines whether R[i] is less than or equal to R[j] using an unsigned operation in step  212 . If R[i] is less than or equal to R[j], a fault is indicated in step  210 . If R[i] is not less than or equal to R[j], the ALU check continues in step  214 . In step  211 , remedial action is initiated and the ALU check ends. 
     In step  214 , the ALU check determines whether R[i] is greater than R[j] using a signed operation. If R[i] is greater than R[j], a fault is indicated in step  210 . If R[i] is not greater than R[j], the ALU check determines whether R[i] is greater than or equal to R[j] using a signed operation in step  216 . If R[i] is greater than or equal to R[j], a fault is indicated in step  210 . If R[i] is not greater than or equal to R[j], the ALU check continues in step  218 . In step  218 , the ALU check determines whether R[i] is equal to R[j]. If R[i] is equal to R[j], a fault is indicated in step  210 . If R[i] is not equal to R[j], the ALU check determines whether R[i] is not equal to R[j] in step  220 . If R[i] is equal to R[j], a fault is indicated in step  210 . If R[i] is not equal to R[j], R[j] is set equal to $AAAA in step  222 . In step  224 , the ALU check determines whether R[i] is equal to R[j]. If R[i] is not equal to R[j], a fault is indicated in step  210 . If R[i] is equal to R[j], the ALU check determines whether R[i] is not equal to R[j] in step  226 . If R[i] is not equal to R[j], a fault is indicated in step  210 . If R[i] is equal to R[j], the ALU check continues in step  228 . 
     In step  228 , the ALU check determines whether j is equal to N. If j is not equal to N, j is incremented by 1 and the ALU check loops back to step  206 . In this manner, the ALU check is performed between R[i] and all of the other registers above R[i] (i.e., R[i+1] to R[N]). If j is equal to N, the ALU check determines whether i is equal to N−1 in step  232 . If i is not equal to N−1, i is incremented by 1 in step  234  and the ALU check loops back to step  202 . In this manner, the ALU check is performed between all of the registers. If i is equal to N−1, all of the registers have been checked and the ALU check ends. 
     Referring now to  FIG. 3 , an ALU logic check ensures the integrity of the ALU  18  with respect to the AND logic operation. In step  300 , the i is set equal to 1. In step  302 , the ALU check stores $AAAA in R[i]. In step  304 , the ALU check determines whether R[i] AND $5555 is not equal to $0000. If R[i] AND $5555 is not equal to $0000, a fault is indicated in step  306 . If R[i] AND $5555 is equal to $0000, the ALU check determines whether R[i] AND $AAAA is not equal to $AAAA in step  308 . If R[i] AND $AAAA is not equal to $AAAA, a fault is indicated in step  306 . If R[i] AND $AAAA is equal to $AAAA, the ALU check determines whether R[i] AND $FFFF is not equal to $AAAA in step  310 . If R[i] AND $FFFF is not equal to $AAAA, a fault is indicated in step  306  and remedial action is initiated in step  307 . If R[i] AND $FFFF is equal to $AAAA, the ALU check determines whether R[i] AND $0000 is not equal to $0000 in step  312 . If R[i] AND $0000 is not equal to $0000, a fault is indicated in step  306 . If R[i] AND $0000 is equal to $0000, the ALU check continues in step  314 . 
     In step  314 , the ALU check stores $5555 in R[i]. In step  316 , the ALU check determines whether R[i] AND $5555 is not equal to $5555. If R[i] AND $5555 is not equal to $5555, a fault is indicated in step  306 . If R[i] AND $5555 is equal to $5555, the ALU check determines whether R[i] AND $AAAA is not equal to $0000 in step  318 . If R[i] AND $AAAA is not equal to $0000, a fault is indicated in step  306 . If R[i] AND $AAAA is equal to $0000, the ALU check determines whether R[i] AND $FFFF is not equal to $5555 in step  320 . If R[i] AND $FFFF is not equal to $5555, a fault is indicated in step  306 . If R[i] AND $FFFF is equal to $5555, the ALU check determines whether R[i] AND $0000 is not equal to $0000 in step  322 . If R[i] AND $0000 is not equal to $0000, a fault is indicated in step  306 . If R[i] AND $0000 is equal to $0000, the ALU check continues determines whether i is equal to N in step  324 . If i is not equal to N, i is incremented by 1 in step  326  and the ALU check loops back to step  302 . If i is equal to N, the ALU check ends. 
     Referring now to  FIG. 4 , an ALU logic check ensures the integrity of the ALU  18  with respect to the OR logic operation. In step  400 , the i is set equal to 1. In step  402 , the ALU check stores $AAAA in R[i]. In step  404 , the ALU check determines whether R[i] OR $5555 is not equal to $FFFF. If R[i] OR $5555 is not equal to $FFFF, a fault is indicated in step  406 , remedial action is initiated in step  407  and the ALU check ends. If R[i] OR $5555 is equal to $FFFF, the ALU check determines whether R[i] OR $AAAA is not equal to $AAAA in step  408 . If R[i] OR $AAAA is not equal to $AAAA, a fault is indicated in step  406 . If R[i] OR $AAAA is equal to $AAAA, the ALU check determines whether R[i] OR $FFFF is not equal to $FFFF in step  410 . If R[i] OR $FFFF is not equal to $FFFF, a fault is indicated in step  406 . If R[i] OR $FFFF is equal to $FFFF, the ALU check determines whether R[i] OR $0000 is not equal to $AAAA in step  412 . If R[i] OR $0000 is not equal to $AAAA, a fault is indicated in step  406 . If R[i] OR $0000 is equal to $AAAA, the ALU check continues in step  414 . 
     In step  414 , the ALU check stores $5555 in R[i]. In step  416 , the ALU check determines whether R[i] OR $5555 is not equal to $5555. If R[i] OR $5555 is not equal to $5555, a fault is indicated in step  406 . If R[i] OR $5555 is equal to $5555, the ALU check determines whether R[i] OR $AAAA is not equal to $FFFF in step  418 . If R[i] OR $AAAA is not equal to $FFFF, a fault is indicated in step  406 . If R[i] OR $AAAA is equal to $FFFF, the ALU check determines whether R[i] OR $FFFF is not equal to $FFFF in step  420 . If R[i] OR $FFFF is not equal to $FFFF, a fault is indicated in step  406 . If R[i] OR $FFFF is equal to $FFFF, the ALU check determines whether R[i]. OR $0000 is not equal to $5555 in step  422 . If R[i] OR $0000 is not equal to $5555, a fault is indicated in step  406 . If R[i] OR $0000 is equal to $5555, the ALU check determines whether i is equal to N in step  424 . If i is not equal to N, i is incremented by 1 in step  426  and the ALU check loops back to step  402 . If i is equal to N, the ALU check ends. 
     Referring now to  FIG. 5 , an ALU logic check ensures the integrity of the ALU  18  with respect to the XOR logic operation. In step  500 , the i is set equal to 1. In step  502 , the ALU check stores $AAAA in R[i]. In step  504 , the ALU check determines whether R[i] XOR $5555 is not equal to $FFFF. If R[i] XOR $5555 is not equal to $FFFF, a fault is indicated in step  506 , remedial action is initiated in step  507  and the ALU check ends. If R[i] XOR $5555 is equal to $FFFF, the ALU check determines whether R[i] XOR $AAAA is not equal to $0000 in step  508 . If R[i] XOR $AAAA is not equal to $0000, a fault is indicated in step  506 . If R[i] XOR $AAAA is equal to $0000, the ALU check determines whether R[i] XOR $FFFF is not equal to $5555 in step  510 . If R[i] XOR $FFFF is not equal to $5555, a fault is indicated in step  506 . If R[i] XOR $FFFF is equal to $5555, the ALU check determines whether R[i] XOR $0000 is not equal to $AAAA in step  512 . If R[i] XOR $0000 is not equal to $AAAA, a fault is indicated in step  506 . If R[i] XOR $0000 is equal to $AAAA, the ALU check continues in step  514 . 
     In step  514 , R[i] the ALU check stores $5555 in R[i]. In step  516 , the ALU check determines whether R[i] XOR $5555 is not equal to $0000. If R[i] XOR $5555 is not equal to $0000, a fault is indicated in step  506 . If R[i] XOR $5555 is equal to $0000, the ALU check determines whether R[i] XOR $AAAA is not equal to $FFFF in step  518 . If R[i] XOR $AAAA is not equal to $FFFF, a fault is indicated in step  506 . If R[i] XOR $AAAA is equal to $FFFF, the ALU check determines whether R[i] XOR $FFFF is not equal to $AAAA in step  520 . If R[i] XOR $FFFF is not equal to $AAAA, a fault is indicated in step  506 . If R[i] XOR $FFFF is equal to $AAAA, the ALU check determines whether R[i] XOR $0000 is not equal to $5555 in step  522 . If R[i] XOR $0000 is not equal to $5555, a fault is indicated in step  506 . If R[i] XOR $0000 is equal to $5555, the ALU check determines whether i is equal to N in step  524 . If i is not equal to N, i is incremented by 1 in step  526  and the ALU check loops back to step  502 . If i is equal to N, the ALU check ends. 
     Referring now to  FIG. 6 , an ALU logic check ensures the integrity of the ALU  18  with respect to the NOT logic operation. In step  600 , the ALU check sets i equal to 1. In step  602 , the ALU check stores $AAAA in R[i]. In step  604 , the ALU check determines whether NOT R[i] is not equal to $5555. If NOT R[i] is not equal to $5555, a fault is indicated in step  606 , remedial action is initiated in step  607  and the ALU check ends. If NOT R[i] is equal to $5555, $5555 is stored in R[i] in step  608 . In step  610 , the ALU check determines whether NOT R[i] is not equal to $AAAA. If NOT R[i] is not equal to $AAAA, a fault is indicated in step  606 . If NOT R[i] is equal to $AAAA the ALU check continues in step  612 . In step  612 , the ALU check determines whether i is equal to N. If i is not equal to N, i is incremented by 1 in step  614  and the ALU check loops back to step  602 . If i is equal to N, the ALU check ends. 
     Referring now to  FIGS. 7A and 7B , a seed and key check can be developed based on the ALU checks described above. It is appreciated that a second processor can be implemented to generate the seeds and verify the key, as explained in further detail below.  FIGS. 7A and 7B  illustrate an exemplary seed and key based ALU check developed for the comparison operations. The exemplary test values (e.g., $AAAA and $5555) are replaced by two seed values, SEED 1  and SEED 2 , respectively. The key is an expected value. The ALU check performs comparison operations between SEED 1  and SEED 2  and assigns a value to individual bits of a result value (RESULT) for each comparison operation performed. The exemplary ALU check of  FIGS. 7A and 7B  include eight comparison operations. Therefore, RESULT for the exemplary ALU check includes 8-bits, B A  through B H . If each of the comparison operations is valid, B A  through B H  are each equal to 1 and RESULT is equal to 1111 1111. In this case, KEY would also be equal to 1111 1111, and no fault would be indicated because RESULT is equal to KEY. If any of the comparison operations is invalid, one or more of the bits B A  through B H  will be equal to 0 and RESULT will include a 0. Because RESULT includes a 0, RESULT is not equal to KEY, which includes all 1&#39;s, and a fault is indicated. 
     With particular reference to  FIG. 7A , i is set equal to 1 in step  700 . In step  702 , SEED 1  is stored in R[i]. In step  704 , j is set equal to i+1. SEED 2  is stored in R[j] in step  706 . In step  708 , the ALU check determines whether R[i] is less than R[j] using an unsigned operation. If R[i] is less than R[j], the comparison operation is deemed valid and B A  is set equal to 1 in step  710 . If R[i] is not less than R[j], the comparison operation is deemed invalid and B A  is set equal to 0 in step  712 . In step  714 , the ALU check determines whether R[i] is less than or equal to R[j] using an unsigned operation. If R[i] is less than or equal to R[j], the comparison operation is deemed valid and BB is set equal to 1 in step  716 . If R[i] is not less than or equal to R[j], the comparison operation is deemed invalid and BB is set equal to 0 in step  718 . 
     In step  720 , the ALU check determines whether R[i] is greater than R[j] using a signed operation. If R[i] is greater than R[j], the comparison operation is deemed valid and Bc is set equal to 1 in step  722 . If R[i] is not greater than R[j], the comparison operation is deemed invalid and Bc is set equal to 0 in step  724 . In step  726 , the ALU check determines whether R[i] is greater than or equal to R[j] using a signed operation. If R[i] is greater than or equal to R[j], the comparison operation is deemed valid and BD is set equal to 1 in step  728 . If R[i] is not greater than or equal to R[j], the comparison operation is deemed invalid and BD is set equal to 0 in step  730 . 
     In step  732 , the ALU check determines whether R[i] is equal to R[j]. If R[i] is not equal to R[j], the comparison operation is deemed invalid and BE is set equal to 1 in step  734 . If R[i] is equal to R[j], the comparison operation is deemed valid and BE is set equal to 0 in step  736 . In step  738 , the ALU check determines whether R[i] is not equal to R[j]. If R[i] is not equal to R[j], the comparison operation is deemed valid and BF is set equal to 1 in step  740 . If R[i] is equal to R[j], the comparison operation is deemed invalid and BF is set equal to 0 in step  742 . 
     SEED 1  is stored in R[j] in step  744 . In step  746 , the ALU check determines whether R[i] is equal to R[j]. If R[i] is equal to R[j], the comparison operation is deemed valid and B G  is set equal to 1 in step  748 . If R[i] is not equal to R[j], the comparison operation is deemed invalid and B G  is set equal to 0 in step  750 . In step  752 , the ALU check determines whether R[i] is not equal to R[j]. If R[i] is equal to R[j], the comparison operation is deemed valid and B H  is set equal to 1 in step  754 . If R[i] is not equal to R[j], the comparison operation is deemed invalid and B H  is set equal to 0 in step  756 . From this point, the flowchart continues at point X in  FIG. 7B . 
     In step  758 , the ALU check determines whether RESULT is equal to KEY. If RESULT is not equal to KEY, a fault is indicated in step  760 , remedial action is initiated in step  761  and the ALU check ends. If RESULT is equal to KEY, the ALU check determines whether j is equal to N in step  762 . If j is equal to N, the ALU check continues in step  764 . If j is not equal to N, j is incremented by 1 in step  766  and the ALU check continues at point Y in  FIG. 7A , looping back to step  706 . In step  764 , the ALU check determines whether i is equal to N−1. If i is equal to N−1, the ALU check ends. If i is not equal to N−1, i is incremented by 1 in step  770  and the ALU check continues at point Z in  FIG. 7A , looping back to step  702 . 
     Those skilled in the art can now appreciate from the foregoing description that the broad teachings of the present invention can be implemented in a variety of forms. Therefore, while this invention has been described in connection with particular examples thereof, the true scope of the invention should not be so limited since other modifications will become apparent to the skilled practitioner upon a study of the drawings, the specification and the following claims.