Multicore Engine Control Arbitration to Avoid Vehicle Immobilization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing engine control systems prioritize vehicle immobilization over mobility, leading to excessive downtime even when some mobility could be retained.
Innovation Solution
Implement a redundant and simplified engine control module running on a separate core of a multicore computer, arbitrating between commands from the primary and redundant modules to ensure reliable engine operation and minimize immobilization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single module L1 is used for primary engine control with module L2 for monitoring, then the system structure is simple, but the vehicle is excessively immobilized even when some mobility could be retained
Solution Approach 1:
The system segments the control functions by introducing a fourth module LM that runs on a different core C2 than the primary module L1. This segmentation allows independent operation of control functions, so that if L1 fails or produces erroneous commands, the system can switch to or arbitrate with LM's commands, thereby retaining vehicle mobility while maintaining safety monitoring through L2 and L3.
Solution Approach 2:
The arbitration mechanism dynamically changes the operational state by evaluating multiple parameters (command coherence between L1 and LM, monitoring status from L2 and L3) and switching between different operational modes (normal operation with L1, fallback to LM, or safety procedures). This parameter-based dynamic switching resolves the contradiction by adapting system behavior to actual operational conditions rather than following a fixed single-module approach.
2Productivity
If redundant modules are added to provide backup control commands, then vehicle mobility is maintained, but the device complexity increases
Solution Approach 1:
The fourth module LM is designed with multi-functionality: it can operate as a standalone control module providing simplified engine functions, serve as a backup to L1, and participate in arbitration with L1's commands. This universal design allows one additional module to fulfill multiple roles (backup controller, alternative command source, arbitration participant), thereby maintaining vehicle mobility without proportionally increasing system complexity.
3Reliability
If the second module L2 continuously evaluates commands from the first module L1, then safety is ensured, but the computational load and processing time increase
Solution Approach 1:
The fourth module LM performs preliminary action by continuously generating alternative engine control commands in parallel with L1's operation. These pre-computed commands from LM are ready for immediate use if L1's commands are found incoherent or if a failure is detected, thereby reducing the response time for safety interventions while maintaining continuous safety evaluation through L2.
Data Source
AI summary
The invention relates to a method for monitoring a vehicle engine comprising an electronic engine control unit, comprising a multicore computer (C), a first module (L1), a second module (L2), and a third module (L3) that is designed to implement a safety procedure command at the request of the second module or if a failure of the first module is detected, the first module being designed to run on a first core (C1) of the computer, the second module being designed to run on a second core (C2) of the computer, the electronic engine control unit comprising a fourth module (LM) that is designed, in a redundant manner, to provide the main functions for driving the engine of the vehicle, and to run under the monitoring of the second module and on the second core, the third module arbitrating between a command produced by the first module and a command produced by the fourth module.