Abstract:
A system and method to determine the operating status of an electrical system includes a system controller and an actuator controller. The system controller determines if the actuator controller is operating properly and initiates a safe mode of operation if the actuator is not operating properly. In turn, the actuator controller determines if the system controller is operating properly and initiates a safe mode of operation if the system controller is not operating properly.

Description:
BACKGROUND 
       [0001]    1. Subject Matter of the Invention 
         [0002]    The invention relates to system and methods for determining the operating status of an electrical system having a system controller and an actuator controller. 
         [0003]    2. Description of the Known Art 
         [0004]    Vehicles, such as automobiles, have a variety of passive and active safety systems protecting the occupants of the vehicle if the vehicle is involved in a collision. Active safety systems work to prevent accidents; they selectively actuate controllers that assist the driver in steering and braking the automobile to help prevent accidents. If the controllers are not operating properly, they can degrade the ability for the driver to control the automobile, which may lead to an accident. 
         [0005]    Prior art solutions generally utilize a single electronic control unit for processing signals and controlling actuation. This relies on a single electronic control unit to failsafe itself by cross checking its control and signals. This electronic control unit typically will contain additional logic to make sure it is operating properly. This logic can become quite complex because the electronic control unit is often the only system processing this information in this context and relies on self-checks to insure proper operation. 
         [0006]    Further objects, features and advantages of this invention will become readily apparent to persons skilled in the art after a review of the following description, with reference to the drawings and claims that are appended to and form a part of this specification. 
       SUMMARY 
       [0007]    A system and method to determine the operating status of an electrical system includes a system controller and an actuator controller. Generally, the system controller determines if the actuator controller is operating properly and initiates a safe mode of operation if the actuator is not operating properly. In turn, the actuator controller determines if the system controller is operating properly and initiates a safe mode of operation if the system controller is not operating properly. 
         [0008]    In order to determine if the system controller is operating properly, the system controller generates a system key and transmits the system key from the system controller to the actuator controller. The actuator controller then determines if the system key is an expected system key value. If the system key is not an expected system key value, the actuator controller will ignore commands from the system controller. 
         [0009]    In order for the system controller to determine if the actuator controller is operating properly, the actuator controller first generates an actuator key, which may be based in part on the system key generated by the system controller. Thereafter, the actuator key is transmitted from the actuator controller to the system controller, wherein a determination is made by the system controller if the actuator key is an expected actuator key value. If the actuator key is not an expected actuator key value, the actuator controller will be disabled, which may include removing power from the actuator controller. 
         [0010]    Further objects, features and advantages of this invention will become readily apparent to persons skilled in the art after a review of the following description, with reference to the drawings and claims that are appended to and form a part of this specification. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0011]      FIG. 1  illustrates a vehicle having a system to determine the operating status of an electrical system having both a system controller and an actuator controller; 
           [0012]      FIG. 2  is a more detailed illustration of the system for determining the operating status of an electrical system having both a system controller and an actuator controller; and 
           [0013]      FIG. 3  illustrates a functional diagram of the method to determining the operating status of the electrical system having both a system controller and an actuator controller of  FIG. 2 . 
       
    
    
     DETAILED DESCRIPTION 
       [0014]    Referring to  FIG. 1 , a vehicle  10  incorporating a system  12  for determining the operating status of both a system controller and actuator controller is shown. The system  12  includes an actuator control system which actuates an actuator, which may be a vehicle safety system. For example, the actuator may be a steering system or brake system  14  or an occupant restraint system  16 , such as a pretension device for a vehicle safety belt system. 
         [0015]    While the illustration of  FIG. 1  shows the vehicle  10  as being an automobile, it should be understood that the system  12  can be incorporated in any number of different variations of vehicles capable of transporting occupants from one place to another. For example, the vehicle  10  may be a truck, car, sport utility vehicle, or construction/farming vehicle. Additionally, it should be understood that the system  12  could be equally incorporated in systems beyond those that are found in land based vehicles, such as aircraft and water craft. Finally, the system could be incorporated in devices that are not vehicles at all, such as medical equipment or consumer electronics. 
         [0016]    Referring to  FIG. 2 , a more detailed illustration of the system  12  is shown. As its primary components, the system  12  includes a system controller  18  and an actuator controller  20 . The system controller  18  generally includes a system microprocessor  22 . The system microprocessor  22  is in electrical communication with an actuator enabling device  24  and a system communication handler  26 . The actuator enabling device  24  is configured to send a signal to the actuator controller  20  to either enable or disable the actuator controller  20 . The system communication handler  26  is configured to transmit signals from the system microprocessor  22  to the actuator controller  20 . 
         [0017]    The system microprocessor  22  further includes a system control logic  28 , a system internal check  30  and a system watchdog controller  32 . The system control logic  28  is in communication with both the system communication handler  26  and the system internal check  30 . The system control logic  28  is configured to provide a series of control signals that will eventually be sent to the actuator controller  20 . In addition, the system control logic  28  is used to determine when to actuate a vehicle safety system, such as a steering system or brake system, by actuating an actuator controlled by the actuator controller  20 . 
         [0018]    The system watch dog controller includes an actuator watchdog check  34  and a system key generator  36 . The actuator watchdog check  34  receives an actuator key from the actuator controller  20  and determines if the actuator controller  20  is operating properly, as will be described in more detail in the paragraphs that follow. The system key generator  36  performs the function of generating a system key which will be eventually sent to the actuator controller  20 , so that the actuator controller  20  can confirm that the system controller  18  is operating properly. 
         [0019]    The system key may be based on system checks of the system control logic  28  and/or the system microprocessor  22 , which may include read-only memory, a random access memory, or an arithmetic logic unit. Further, the system key value may be based in part on the actuator key generated by the actuator controller  20 . The system controller watchdog  32  also provides actuator watchdog status to the system internal check  30  as part of the overall logic tests. 
         [0020]    The actuator watchdog check  34 , after receiving the actuator key value, will make a determination if the actuator key value is the expected actuator key value. Generally, the actuator key value may be based on a system rate of the actuator controller  20 , system checks of a logic unit of the actuator controller  20 , wherein the logic unit of the actuator controller  20  may be a read-only memory, a random access memory, or an arithmetic logic unit. Additionally, as will be explained later, the actuator key value may be based in part on the system key value generated by the system key generator  36 . 
         [0021]    In either case, the actuator watchdog check  34  will send a signal to the system internal monitor  30 , which will then relay the signal to the system control logic  28 . From there, the system control logic  28  will communicate with the actuator enabling device  24 , which can then disable the actuator controller  20  if the actuator key value is not the expected actuator key value. This disabling of the actuator controller  20  may include not sending any signals to the actuator or may include powering off of the actuator controller  20 . 
         [0022]    The actuator controller  20  includes a power control  38 , an actuator  40 , an actuator communication handler  42 , and an actuator microprocessor  44 . The actuator microprocessor  44  is in communication with the actuator communication handler  42  which communicates with the system controller communication handler  26 . The actuator microprocessor  44  is also in communication with the actuator  40 . Essentially, the actuator microprocessor can activate or deactivate the actuator  40 . The power control  38  provides power to the actuator  40 , allowing the actuator  40  to activate or deactivate based on signals received from the actuator microprocessor  44 . 
         [0023]    The actuator microprocessor  44  includes an actuator control logic  46 , a driver  48 , an actuator internal check  50 , and an actuator controller watchdog  52 . The driver  48  is in communication with the actuator control logic  46  and receives signals from the actuator control logic  46  to provide a signal to the actuator  40 , thereby activating or deactivating the actuator  40 . As stated before, the actuator  40  may interact with the safety device such as a steering system or brake system  14  of  FIG. 1 . 
         [0024]    The actuator controller watchdog  52  includes a system watchdog check  54  and an actuator key generator  56 . The system watchdog check  54  receives the system key from the system controller  18  and determines if the system key is the expected system key. The actuator key generator  56  generates an actuator key which is then provided to the communication handler  42  of the actuator controller  20 . The actuator key may be based on system checks of the actuator control logic  46  and/or the actuator microprocessor  44  which may include read-only memory, a random access memory, or an arithmetic logic unit. Further, the actuator key value may be based in part on the system key generated by the system controller  18 . The actuator controller watchdog  52  also provides system watchdog status to actuator internal check  50  as part of the overall logic tests. 
         [0025]    The actuator internal check  50  receives information from the system watchdog check regarding if the system is operating properly based on a previous determination if the received system key is the expected system key. If the actuator internal check  50  receives information from the system watchdog check  54  that the system controller  20  is operating properly, the actuator internal check  50  then enables the driver  48  and the actuator control logic  46 , by informing the driver  48  and the actuator control logic  46  that the system controller  20  is operating properly. After the determination is made by the actuator controller watchdog  52  that the system controller  20  is not operating properly, the actuator controller can communicate to the actuator control logic  46  via the actuator internal check  50  of the status. In case that the system controller  18  is not operating properly, the actuator controller  20  can simply ignore commands from the system controller  18 , as the system controller  18  is not operating properly. 
         [0026]    Referring to  FIG. 3 , a flow diagram  60  of the method for determining the operating status of an electrical system is shown. It should be understood that the method  60  is shown in a flow chart form but makes reference to components previously mentioned in  FIG. 2 . 
         [0027]    The method  60  includes the system watchdog controller  32  and the actuator watchdog controller  52 . The system internal monitor  30  sends a monitor status signal  62  to a sequence generator  64  (which is the same as key generator  36 ). The sequence generator  64  creates the system key value and provides a system key value to the actuator key generator  56  and a control sequence monitor  66  (which is the same as system watchdog check  54 ) of the actuator watchdog controller  52 . The system watchdog check is accomplished by the checking the sequence of keys. Thereafter, the actuator key generator  56  sends an actuator key value  68  to the key evaluation unit  70  (which is the same as watchdog check  34 ) that verifies the correct actuator key value was generated from the system key, essentially using the system key value as a seed value. 
         [0028]    The controller key sequence monitor  66  determines if the system controller key value is the expected system controller key value and sends signals to the actuator internal monitor  50  which then relays monitor status information to the actuator key generator  56  and an actuator enable logic  72 . The actuator enable logic  72  then sends a signal to an actuator enable logic  74 , enables the actuator  40 . 
         [0029]    In other embodiments, dedicated hardware implementations, such as application specific integrated circuits, programmable logic arrays and other hardware devices, can be constructed to implement one or more of the methods described herein. Applications that may include the apparatus and systems of various embodiments can broadly include a variety of electronic and computer systems. One or more embodiments described herein may implement functions using two or more specific interconnected hardware modules or devices with related control and data signals that can be communicated between and through the modules, or as portions of an application-specific integrated circuit. Accordingly, the present system encompasses software, firmware, and hardware implementations. 
         [0030]    In accordance with various embodiments of the present disclosure, the methods described herein may be implemented by software programs executable by a computer system. Further, in an exemplary, non-limited embodiment, implementations can include distributed processing, component/object distributed processing, and parallel processing. Alternatively, virtual computer system processing can be constructed to implement one or more of the methods or functionality as described herein. 
         [0031]    Further, the methods described herein may be embodied in a computer-readable medium. The term “computer-readable medium” includes a single medium or multiple media, such as a centralized or distributed database, and/or associated caches and servers that store one or more sets of instructions. The term “computer-readable medium” shall also include any medium that is capable of storing, encoding or carrying a set of instructions for execution by a processor or that cause a computer system to perform any one or more of the methods or operations disclosed herein. 
         [0032]    As a person skilled in the art will readily appreciate, the above description is meant as an illustration of the principles of the invention. This description is not intended to limit the scope or application of the invention in that the invention is susceptible to modification, variation and change, without departing from spirit of the invention, as defined in the following claims.