Patent ID: 12217558

DETAILED DESCRIPTION

The following description is merely exemplary in nature and is not intended to limit the present disclosure, application, or uses.

Referring toFIG.1, an exemplary fault remediation system10for a vehicle12is illustrated. It is to be appreciated that the vehicle12may be any type of vehicle such as, but not limited to, a sedan, truck, sport utility vehicle, van, or motor home. The fault remediation system10includes one or more controllers20in electronic communication with one or more consumed interfaces22and one or more provided interfaces24. The one or more consumed interfaces22include any source of data that is consumed and analyzed by the one or more controllers20such as, for example, sensors and other controllers that are part of the vehicle12. The one or more provided interfaces24include systems and subsystems that are part of the vehicle12that consume data analyzed by the one or more controllers20. As explained below, the fault remediation system10addresses an active fault with one or more signals that are consumed by the one or more controllers20.

In one non-limiting embodiment, the one or more controllers20are part of a vehicle motion control system. In this embodiment, the one or more consumed interfaces22include, but are not limited to, an inertial measurement unit (IMU), a steering angle sensor, wheel speed sensors, wheel-to-body sensors, and a global positioning system (GPS). In the present example, the one or more provided interfaces24include, but are not limited to, an electronic all-wheel-drive (eAWD) system26and an electronic limited slip differential (eLSD) system28. It is to be appreciated that while the fault remediation system10is illustrated as part of a motion control system for the vehicle12,FIG.1is merely exemplary in nature and the fault remediation system10is not limited to vehicles. Indeed, the fault remediation system10may be implemented in any application that employs modular control system architecture such as, for example, aerospace and manufacturing applications.

FIG.2is a diagram of the one or more controllers20shown inFIG.1, where the one or more controllers20include a signal processing module42, a remediation module44, an arbitration module46, and a function module48. The function module48executes two or more subfunctions52that are part of a deconstructed function50. In one non-limiting embodiment, a nested subfunction structure may also be used as well. As explained below, the fault remediation system10includes a fault tolerant architecture that analyzes consumed signals60from the consumed interfaces22(FIG.1) that are received by the one or more controllers20for active faults. In response to detecting an active fault with the consumed signal60, the fault remediation system10selects a remediation state from a group of two or more prospective remediation states based on a significance analysis of the consumed signal60, where the selected remediation state addresses an active fault of the consumed signal60. Specifically, the selected remediation state may preserve at least a portion of the functionality of the motion control system, even after the one or more controllers20has consumed an active fault. The selected remediation system may also ensure that the active faults are not propagated to one or more downstream subfunctions52.

Referring toFIG.2, the signal processing module42of the one or more controllers20receives the consumed signals60from the one or more consumed interfaces22(seen inFIG.1). The signal processing module42filters and calibrates the consumed signal60and performs fault detection to determine if an active fault is present within the consumed signal60. Filtering the consumed signal60includes adjusting values of one or more filter coefficients based on a health of the consumed signal60. Specifically, the signal processing module42adjusts the value of a filter coefficient to increase a weight of the consumed signal60in response to determining the consumed signal60has robust health. Similarly, the signal processing module42decreases the weight of the consumed signal60in response to determining the health of the consumed signal60is compromised. The signal processing module42also calibrates the consumed signal60based on a target vehicle response. The target vehicle response is determined based on factors such as, but not limited to, driver mode selection, and traction mode state. For example, the consumed signal60may be calibrated to generate a target vehicle response that increases horsepower or speed when the driver mode selection is set to a performance mode.

After performing signal processing, the signal processing module42performs fault detection upon the consumed signal60to determine the presence of an active fault within the consumed signal60. In response to detecting an active fault with the consumed signal60, the signal processing module42sends the consumed signal60to the remediation module44. The remediation module44of the one or more controllers20selects a remediation state from a group of two or more prospective remediation states based on a significance analysis of the consumed signal60. The significance analysis of the consumed signal60is described below. The remediation state addresses the active fault of the consumed signal60. In one non-limiting embodiment, the group of prospective remediation states include a related interface state, a secondary interface state, a fault-tolerant logic state, a last known good value state, and a constant value state. However, it is to be appreciated that the group of prospective remediation states may include fewer prospective remediation states or additional prospective remediation states as well.

The related interface state includes transitioning the consumed signal60to a remediated signal80, where the remediated signal80is derived from a source that measures the same parameter as the consumed interface22(FIG.1) that generates the consumed signal60. For example, if the consumed signal60is generated by one of the wheel speed sensors that are part of the vehicle12(FIG.1), then the source would be another wheel speed sensor located on the same axle but at a different corner of the vehicle12. In the present example, the same parameter measured by the consumed signal60and the remediated signal80is rotational speed. It is to be appreciated that the remediation module44may employ various filtration techniques to manage the transition between the consumed signal60to the remediated signal80.

The secondary interface state includes transitioning from the consumed signal60to a remediated signal80, where the remediated signal80is derived from one or more sources that measure another parameter than the consumed signal60. In the present example, if the consumed signal60is generated by one of the wheel speed sensors that are part of the vehicle12, then the remediated signal80would be generated based on an estimated wheel or axle torque value from the same axle as the wheel speed sensor.

The fault-tolerant logic state includes transitioning from the consumed signal60to a remediated signal80, where the remediated signal80is derived by combining two or more signals together. The two or more signals are each generated by a source that is not the consumed interface22(FIG.1) that generates the consumed signal60. For example, if the consumed signal60measures yaw rate, then the remediated signal80is created by combining two or more signals that each measure a different parameter when compared to the consumed signal60. For example, if the consumed signal60is a yaw rate signal and the consumed interface22is a yaw rate sensor, then the remediated signal80is derived by combining a lateral acceleration, a tire position measured by one or more wheel-to-body sensors, position data collected by the GPS, a steering angle, and vehicle speed.

The last known good value state includes latching a last known value of the consumed signal60prior to detecting the active fault, where the last known value is the remediated signal80. For example, if the consumed signal60is yaw rate, then the last known value prior to detecting the active fault for the yaw rate may be used as the remediated signal80. Finally, the constant value state includes converging from the consumed signal60to a constant value in response to detecting the active fault, where the constant value is the remediated signal80. The calibrated constant value is a predetermined value that does not interfere with the remaining subfunctions52that are executed by the function module48.

The remediation module44selects the remediation state from the group of two or more prospective remediation states based on the significance analysis. The significance analysis selects the remediation state based on one or more of the following: an importance of the consumed signal60upon a relevant subfunction52, a driving state of the vehicle12(FIG.1), and the presence of one or more alternative signals utilized to calculate the remediation signal80. The relevant subfunction52is executed by the function module48and relies upon the consumed signal60.

The importance of the consumed signal60upon a relevant subfunction52is determined based on the specific function that the consumed signal60instructs the vehicle12to execute, where some specific functions are of greater importance than other functions. For example, if the consumed signal60indicates a total loss of wheel slip control function, then the specific function is wheel slip control, and the remediation module44selects a remediation state that addresses the wheel slip. In contrast, if the consumed signal60indicates a partial loss of lateral control, then the remediation module44would select a remediation state that address the partial loss of lateral control. The driving state of the vehicle12indicates a behavior of the vehicle12during operation. In an embodiment, the driving states of the vehicle12are selected from steady-state conditions and dynamic conditions. The dynamic conditions may vary in degree, where a highly dynamic condition indicates the vehicle12travels at high speed and/or the vehicle12executes maneuvers in a relatively short period of time. When the driving state indicates steady-state conditions, the remediation module44selects a remediation state that retains the current control state of the vehicle12such as the last known good value state or the constant value state. When the driving state indicates a highly dynamic condition, then the remediation module44selects a remediation state that retains the current control state of the vehicle such as the last known good value state for a predetermined amount of time. For example, the lateral acceleration during a highly dynamic condition would be held for a predetermined period of time. The one or more alternative signals are used in place of the consumed signal60, however, it is to be appreciated that alternative signals may not always be available. For example, if one or more alternative signals are available, then the remediation module44may select the related interface state, the secondary interface state, or the fault-tolerant logic state as the remediation state. However, if no alternative signals are available, then the remediation module44may select either the last known good value state or the constant value state as the remediation state.

The remediation module44then sends the remediated signal80as well as the active fault that corresponds to the consumed signal60that the remediated signal80addresses to the arbitration module46. The arbitration module46of the one or more controllers20evaluates the relevant subfunction52that corresponds to the consumed signal60that the remediation state addresses for remediation tolerance and generates arbitration instructions82based on the remediation tolerance. When the relevant subfunction52is unable to tolerate any remediation, the arbitration module46determines remediation tolerance is absent in the relevant subfunction52, and the arbitration module46generates arbitration instructions82that instruct the function module48of the one or more controllers20to deactivate the relevant subfunction52. In contrast, when the relevant subfunction52tolerates remediation, the arbitration module46determines remediation tolerance is present in the relevant subfunction52. Specifically, remediation tolerance indicates the remediated signal80affects but does not compromise operation of the relevant subfunction52. In response to determining the remediated signal80tolerate remediation, the arbitration module46generates arbitration instructions82instructing the function module48of the one or more controllers20to consume the remediated signal80in place of the consumed signal60.

The function module48of the one or more controllers20receives the remediated signal80and the arbitration instructions82as input and executes the relevant subfunction52based on the remediated signal80and the arbitration instructions82. Specifically, the function module48determines a level of operation for the relevant subfunction52based on the arbitration instructions82and executes the relevant subfunction52based on the level of operation. In an embodiment, the level of operation for the relevant subfunction52is selected from the following: a fully functional level, a remediated level, and a deactivated level. When the arbitration instructions82indicate the fully functional level as the level of operation, the function module48determines that no active faults exist for signals consumed by the relevant subfunction52, and the relevant subfunction52is executed based on the consumed signal60. When the arbitration instructions82indicate the remediated level, the function module48executes the relevant subfunction52based on the remediated signal80. When executed at the remediated level, the relevant subfunction52maintains core functionality, however, it is to be appreciated that the relevant subfunction52may abstain from generating a final output depending on the circumstances. When the arbitration instructions82indicate the deactivated level, the function module48does not execute the relevant subfunction52based on the consumed signal60or the remediated signal80. Instead, the function module48outputs a value that will not interfere with the execution of the remaining downstream subfunctions52.

In one non-limiting example, the one or more controllers20are part of the (eAWD) system26shown inFIG.1. In the present example, the one or more subfunctions52include four subfunctions52that are directed to feedforward control, lateral control, wheel control, and core arbitration. In the event the steering sensor experiences a fault, instead of deactivating the entire eAWD controller, specific nested subfunctions52are deactivated instead. For example, the subfunction52directed towards feedforward control includes two nested subfunctions, open loop command generation and feedforward tractive limit calculation. In this example, the open loop command generation nested subfunction is executed at the fully functional level, and the feedforward tractive limit calculation nested subfunction is executed at the deactivated level. The subfunction52directed towards lateral control includes two nested subfunctions, total torque reduction and front/rear torque split determination. In this example, the total torque reduction nested subfunction is executed at the fully functional level, and the front/rear torque split determination nested subfunction is executed at the deactivated level.

FIG.3is an exemplary process flow diagram illustrating a method200for addressing an active fault by the fault remediation system10. Referring generally toFIGS.1-3, the method200may begin at block202. In block202, the signal processing module42of the one or more controllers20receives the consumed signal60from the one or more consumed interfaces22(seen inFIG.1). The method200may then proceed to block204.

In block204, the signal processing module42of the one or more controllers20filters and calibrates the consumed signal60. The method200may then proceed to decision block206.

In decision block206, the signal processing module42of the one or more controllers20performs fault detection upon the consumed signal60to determine the presence of an active fault within the consumed signal60. Specifically, if no active fault is detected, then the method200may terminate. However, in response to detecting an active fault with the consumed signal60, the method200may then proceed to block208.

In block208, the remediation module44of the one or more controllers20select the remediation state from the group of two or more prospective remediation states based on the significance analysis of the consumed signal60, where the remediation state addresses the active fault of the consumed signal60. The method200may then proceed to block210.

In block210, the arbitration module46of the one or more controllers20evaluates the relevant subfunction52that corresponds to the consumed signal60that the remediation state addresses for remediation tolerance and generates arbitration instructions82based on the remediation tolerance. The method200may then proceed to block212.

In block212, the arbitration module46of the one or more controllers20generates arbitration instructions82based on the remediation tolerance. The method200may then proceed to block214.

In block214, function module48of the one or more controllers20executes the relevant subfunction52that corresponds to the consumed signal60that the remediation state addresses based on the arbitration instructions82. The method200may then terminate.

Referring generally to the figures, the disclosed fault remediation system provides various technical effects and benefits. Specifically, the fault remediation system addresses active faults that are consumed by one or more controllers based on a significance analysis. The fault remediation system also intelligently arbitrates specific subfunctions that are executed by the system to preserve at least some functionality and to minimize the impact on downstream subfunctions. In contrast, some conventional systems may allow for corrupted sensor data to propagate throughout a controller to downstream functions, which results in the controller preemptively aborting a control function.

The controllers may refer to, or be part of an electronic circuit, a combinational logic circuit, a field programmable gate array (FPGA), a processor (shared, dedicated, or group) that executes code, or a combination of some or all of the above, such as in a system-on-chip. Additionally, the controllers may be microprocessor-based such as a computer having a at least one processor, memory (RAM and/or ROM), and associated input and output buses. The processor may operate under the control of an operating system that resides in memory. The operating system may manage computer resources so that computer program code embodied as one or more computer software applications, such as an application residing in memory, may have instructions executed by the processor. In an alternative embodiment, the processor may execute the application directly, in which case the operating system may be omitted.

The description of the present disclosure is merely exemplary in nature and variations that do not depart from the gist of the present disclosure are intended to be within the scope of the present disclosure. Such variations are not to be regarded as a departure from the spirit and scope of the present disclosure.