Methods and apparatus for isolating safety functions in a motion control system for a vehicle

Patent metadata

Field	Value
Publication number	US-9244460-B2
Application number	US-201314144987-A
Country	US
Kind code	B2
Filing date	Dec 31, 2013
Priority date	Dec 31, 2013
Publication date	Jan 26, 2016
Grant date	Jan 26, 2016

Abstract

The present disclosure relates to an automated system for use in connection with longitudinal deceleration, longitudinal acceleration, and lateral acceleration functions. The system includes an interface receiving signals from and transmitting signals to a controller. The system also includes a safety kernel system comprising safety kernel software and a set of safety rules. Also disclosed are methods for use in a motion control system in connection with vehicle deceleration, acceleration, and lateral acceleration. The methods in some cases include receiving an initial request into a safety kernel software and determining whether the safety kernel software has received an override. The methods can also include detecting a violation of any primary safeguards defined by the safety kernel software, detecting a violation within a set of secondary safeguards defined by the safety kernel software, and adjusting the initial request to a modified level; and transmitting the modified level to an actuator.

First claim

What is claimed is:

1. A safety kernel system, for use in connection with motion control of a vehicle, comprising:
a processor configured and arranged for communication with a measurement system including a vehicle-system actuator and a sensor; and
a non-transitory computer-readable storage device comprising computer-executable instructions including a safety kernel software and a set of safety rules, wherein the instructions, when executed by the processor, cause the processor to perform operations comprising:
receiving, from distinct software being separate and independent of the safety kernel software, a request for a safety-critical function related to vehicle motion;
receiving, from the measurement system including the vehicle-system actuator and the sensor, using the safety kernel software, an actions signal containing an actions data set;
applying, using the safety kernel software, the set of safety rules to the actions data set, rendering a safety-kernel software response;
comparing the request for the safety-critical function to the safety-kernel software response rendered;
limiting, based on results of the comparing operation, the request for the safety-critical function, rendering a limited request, if the request for the safety-critical function is beyond a threshold parameter set by the safety kernel software; and
transmitting, by way of a status signal, the limited request for the safety-critical function to the vehicle-system actuator.

2. The system of claim 1 , wherein the distinct software includes an application software package.

3. A method, for use in connection with motion control of a vehicle, comprising:
receiving, by a system having a processor configured and arranged for communication with a measurement system including a vehicle-system actuator and a sensor, from an application software package, using a safety kernel software package of the system, a request for a safety-critical function related to vehicle motion;
receiving, by the system, from a measurement system including a vehicle-system actuator and a sensor, using the safety kernel software package, an actions signal containing an actions data set;
determining, by the system executing the safety kernel software package, whether an override command has been received;
detecting, by the system executing the safety kernel software package, whether there is a primary violation within a set of primary safeguards of the safety kernel software package;
detecting, by the system executing the safety kernel software package, whether there is a secondary violation within a set of secondary safeguards of the safety kernel software package;
limiting, by the system executing the safety kernel software package, the request for the safety-critical function, rendering a limited request, if the request is beyond a threshold parameter set by the safety kernel software package; and
transmitting, by way of a status signal, the limited request for the safety-critical function to the vehicle-system actuator.

4. The method of claim 3 , wherein the primary safeguards prescribe a process comprising:
detecting any failure within the vehicle-system actuator and the sensor; and
verifying that the initial request was transmitted by the application software package.

5. The method of claim 4 , further comprising blocking, by the system, the request received by the safety kernel software package in response to the safety kernel software package (a) detecting failure within the vehicle-system actuator and the sensor or (b) determining that the initial request was not transmitted by the application software package.

6. The method of claim 3 , wherein the secondary safeguards prescribe a deceleration routine comprising:
evaluating, if the vehicle has experienced an increase in acceleration based on a command state, the increase in acceleration as captured by the vehicle-system actuator and the sensor;
determining, by comparing the request for the safety-critical function to a deceleration request threshold, whether the request for the safety-critical function includes a hard brake; and
evaluating, if the vehicle is in a vicinity of a threat, the threat including analyzing a distance between the threat and the vehicle.

7. The method of claim 6 , further comprising:
determining, by the system, based on the command state, whether the vehicle has experienced an increase in acceleration; and
blocking, if the vehicle has experienced an increase in acceleration, the request for deceleration from being passed to the vehicle-system actuator being a braking actuator.

8. The method of claim 6 , further comprising blocking, by the system, the request for deceleration, when the request includes a hard brake.

9. The method of claim 6 , further comprising blocking, by the system, the request for deceleration when the vehicle speed is in the vicinity of the threat.

10. The method of claim 6 , further comprising:
adjusting, by the system, when the application software has generated a hard brake request, the request for deceleration to a modified level of deceleration; and
transmitting the modified level of deceleration to the vehicle-system actuator being a braking actuator.

11. The method of claim 6 , further comprising:
adjusting, by the system, when the vehicle is in the vicinity of the threat, the request for deceleration to the modified level of deceleration; and
transmitting the modified level of deceleration to the vehicle-system actuator being a braking actuator.

12. The method of claim 3 , wherein the secondary safeguards prescribe an acceleration routine comprising:
evaluating, if the vehicle has experienced a deceleration request based on a command state, the deceleration captured by the sensor and the vehicle-system actuator; and
comparing the vehicle speed to a threshold speed.

13. The method of claim 12 , further comprising:
determining, by the system, whether the vehicle has experienced a brake request; and
blocking, if the vehicle has experienced a brake request, the request for acceleration from being passed to the vehicle-system actuator being a propulsion actuator.

14. The method of claim 12 , further comprising blocking, by the system, the request for acceleration, when the vehicle speed is less than the threshold speed, from being passed to the vehicle-system actuator being a propulsion actuator.

15. The method of claim 12 , further comprising:
adjusting, by the system, when the vehicle speed is greater than the threshold speed, the request for acceleration to a modified level of acceleration; and
transmitting the modified level of acceleration to the vehicle-system actuator being a propulsion actuator.

16. The method of claim 3 , wherein the secondary safeguards prescribe an lateral acceleration routine comprising:
evaluating, if the vehicle has experienced at least one other blocked request based on a command state, and
comparing the vehicle speed to a threshold speed.

17. The method of claim 16 , further comprising:
determining, by the system, whether the vehicle has experienced at least one other blocked request; and
blocking, if the vehicle has experienced at least one other blocked request, the request for lateral acceleration from being passed to the vehicle-system actuator being a steering actuator.

18. The method of claim 16 , further comprising blocking, by the system, the request for lateral acceleration, when the vehicle speed is less than the threshold speed, from being passed to the vehicle-system actuator being a steering actuator.

Assignees

• Gm Global Tech Operations Inc

Inventors

• Debouk Rami I
• Fuhrman Thomas E
• Baker Stephen M
• O′Dea Kevin M
• Joyce Jeffrey

Classifications

• G05D1/0055 Primary

  with safety arrangements · CPC title

• B60W50/02

  Ensuring safety in case of control system failures, e.g. by diagnosing, circumventing or fixing failures · CPC title

• B60W50/045

  Monitoring control system parameters · CPC title

• G05D2201/0213

  Physics · mapped topic

• B60W50/0098

  Details of control systems ensuring comfort, safety or stability not otherwise provided for · CPC title