Abstract: In various examples, a safety decomposition architecture for autonomous machine applications is presented that uses two or more individual safety assessments to satisfy a higher safety integrity level (e.g., ASIL D). For example, a behavior planner may be used as a primary planning component, and a collision avoidance feature may be used as a diverse safety monitoring component—such that both may redundantly and independently prevent violation of safety goals. In addition, robustness of the system may be improved as single point and systematic failures may be avoided due to the requirement that two independent failures—e.g., of the behavior planner component and the collision avoidance component—occur simultaneously to cause a violation of the safety goals.

Abstract: Embodiments of the present disclosure relate to a method of detecting an error corresponding to a monitored system. The method may additionally include determining whether the error corresponds to a safety module associated with the monitored system that may have one or more operations that are deemed to affect safety or whether the error corresponds to a safety process associated with the monitored system that may have one or more operations that are deemed to affect safety. In some embodiments, the method may additionally include determining whether to continue operations of the monitored system, where the determination may be based at least on whether the error may correspond to a safety module associated with the monitored system or whether the error corresponds to a safety process associated with the monitored system.

Abstract: In various examples, a safety decomposition architecture for autonomous machine applications is presented that uses two or more individual safety assessments to satisfy a higher safety integrity level (e.g., ASIL D). For example, a behavior planner may be used as a primary planning component, and a collision avoidance feature may be used as a diverse safety monitoring component—such that both may redundantly and independently prevent violation of safety goals. In addition, robustness of the system may be improved as single point and systematic failures may be avoided due to the requirement that two independent failures—e.g., of the behavior planner component and the collision avoidance component—occur simultaneously to cause a violation of the safety goals.

Abstract: In various examples, a safety decomposition architecture for autonomous machine applications is presented that uses two or more individual safety assessments to satisfy a higher safety integrity level (e.g., ASIL D). For example, a behavior planner may be used as a primary planning component, and a collision avoidance feature may be used as a diverse safety monitoring component—such that both may redundantly and independently prevent violation of safety goals. In addition, robustness of the system may be improved as single point and systematic failures may be avoided due to the requirement that two independent failures—e.g., of the behavior planner component and the collision avoidance component—occur simultaneously to cause a violation of the safety goals.

Abstract: Methods and systems are provided for controlling an electrical system of a vehicle. Sensors are used to obtain first data for a first path of calculations and second data for a second path of calculations. The first path comprises a first plurality of calculations of generating a value of a parameter pertaining to the electrical system, and the second path comprises a second plurality of calculations of monitoring the electrical system with respect to the first path. A processor is coupled to the plurality of sensors, and is configured to determine whether a data frozen flag is active, perform the first plurality of calculations of the first path using the first data if the first data flag is inactive, and perform the second plurality of calculations of the second path if the first data flag is active.

Abstract: A method for monitoring an electrically-powered torque machine configured to generate torque in a hybrid powertrain system includes monitoring signal outputs of a resolver configured to monitor rotational position of the torque machine. Upon detecting a fault warning state associated with the signal outputs of the resolver, a motor torque capacity of the torque machine is derated. Upon a clearing of the fault warning state, a torque ramp-up state to increase the motor torque capacity of the torque machine is executed. Notice of an incidence of a fault associated with the signal outputs of the resolver is provided only when the motor torque capacity fails to achieve a threshold motor torque capacity within a threshold recovery time period while executing the torque ramp-up state.

Abstract: A method includes detecting a first event and executing a first procedure to identify a sensor offset in response to detecting the first event. The method further includes determining, via a computing device, whether the sensor offset was measured during the execution of the first procedure, scheduling a second procedure to execute in response to detecting a second event if the sensor offset was not measured during the first procedure, and scheduling the first procedure to execute in response to detecting a subsequent occurrence of the first event if the sensor offset was measured during the first procedure.

Abstract: An inhibit path diagnostic system includes a first control module. The first control module includes a message output and transmits a first message from the message output to a controller area network (CAN) via a message transmission path. An inhibit path circuit includes the message transmission path. A second control module transmits a disable control signal to the inhibit path circuit to disable the message transmission path. The first control module transmits a second message from the message output subsequent to and based on the transmitting of the disable control signal. At least one of the first control module and the second control module detects a fault of the inhibit path circuit subsequent to the transmitting of the second message and based on a feedback signal from the CAN.

Abstract: Methods and systems are provided for monitoring an electrical system of a vehicle. Data pertaining to the electrical system is obtained. Calculation modules are performed using the data to generate intermediate determinations. An aggregate calculation module is performed using each of the intermediate determinations to generate an aggregate determination pertaining to the electrical system. Redundant intermediate calculations are performed using the data to generate redundant intermediate determinations. Each of the redundant intermediate determinations is used for comparison with a respective intermediate determination.

Abstract: A method for operating a powertrain system including a torque machine coupled to a drive wheel of a vehicle includes determining a regenerative braking capacity of the powertrain system. In response to a net operator torque request including a braking torque request, a friction braking torque command to operate a friction brake system and a regenerative braking torque request for the torque machine are coincidentally generated, a torque command is generated for controlling operation of the torque machine in response to the regenerative braking torque request, and the friction braking torque command is adjusted by an amount corresponding to a difference between the braking torque request and the regenerative braking torque request.

Abstract: A method to monitor integrity of a signal generated and communicated in a distributed control module system for a hybrid powertrain system includes generating and verifying signal within an originating control module. A message is generated based upon the signal. The message is transmitted and received at a receiving control module. The signal is extracted from the message and its integrity is verified.

Abstract: A diagnostic system for a hybrid vehicle comprises a processor module and a motor control module. The processor module outputs a seed value. The motor control module controls torque output by an electric motor of the hybrid vehicle, receives the seed value, generates a final key value based on the seed value, and outputs the final key value to the processor module.

Abstract: A system for robust fault detection in an electrically variable, hydraulically controlled transmission includes independently monitoring hydraulic pressure within a hydraulic control circuit and electric machine rotation for detecting clutch state faults.

Abstract: Methods and systems are provided for monitoring an automotive electrical system including an inverter having at least one switch. First and second voltage commands corresponding to respective first and second components of a commanded voltage vector on a synchronous frame of reference coordinate system are received. A plurality of duty cycles for operating the at least one switch are calculated based on the first and second voltage commands. First and second actual voltages are calculated based on the plurality of duty cycles. The first and second actual voltages correspond to respective first and second components of an actual voltage vector on the synchronous frame of reference coordinate system. An indication of a fault is generated based on the difference between the first components of the commanded voltage vector and the actual voltage vector and the difference between the second components of the commanded voltage vector and the actual voltage vector.

Abstract: A method for monitoring a main control module operative to command first and second motor control processors of a hybrid powertrain system includes signally connecting a programmable logic device to the main control module and the first and second motor control processors, communicating a first seed signal from the programmable logic device to the main control module, and determining an invalid key signal in the main control module in response to the first seed signal. The invalid key signal is communicated to the programmable logic device.

Abstract: A method for monitoring an electrically-powered torque machine configured to generate torque in a hybrid powertrain system includes monitoring signal outputs of a resolver configured to monitor rotational position of the torque machine. Upon detecting a fault warning state associated with the signal outputs of the resolver, a motor torque capacity of the torque machine is derated. Upon a clearing of the fault warning state, a torque ramp-up state to increase the motor torque capacity of the torque machine is executed. Notice of an incidence of a fault associated with the signal outputs of the resolver is provided only when the motor torque capacity fails to achieve a threshold motor torque capacity within a threshold recovery time period while executing the torque ramp-up state.

Abstract: A hybrid powertrain system includes torque generative devices to transfer power to an output member. An operator torque request, a rotational direction and speed of the output member, and a signal output from a transmission range selector are monitored. When a change in a direction of intended motion is determined, the powertrain system can change rotational direction of the output member when the speed of the output member is less than a threshold. The powertrain can inhibit a change in the rotational direction of the output member.

Abstract: A method to monitor integrity of a signal output from an operator-manipulable transmission range selector for a powertrain system includes equipping the transmission range selector with a range encoder and a direction encoder, determining a range state and a direction state based upon signals from the range encoder and the direction encoder, determining a discrete position of the transmission range selector based upon the range state and the direction state, and performing back rationality to verify the discrete position of the transmission range selector.

Abstract: An inhibit path diagnostic system includes a first control module. The first control module includes a message output and transmits a first message from the message output to a controller area network (CAN) via a message transmission path. An inhibit path circuit includes the message transmission path. A second control module transmits a disable control signal to the inhibit path circuit to disable the message transmission path. The first control module transmits a second message from the message output subsequent to and based on the transmitting of the disable control signal. At least one of the first control module and the second control module detects a fault of the inhibit path circuit subsequent to the transmitting of the second message and based on a feedback signal from the CAN.

Abstract: A method for operating a powertrain system including a torque machine coupled to a drive wheel of a vehicle includes determining a regenerative braking capacity of the powertrain system. In response to a net operator torque request including a braking torque request, a friction braking torque command to operate a friction brake system and a regenerative braking torque request for the torque machine are coincidentally generated, a torque command is generated for controlling operation of the torque machine in response to the regenerative braking torque request, and the friction braking torque command is adjusted by an amount corresponding to a difference between the braking torque request and the regenerative braking torque request.