Abstract: A method for monitoring communications among a plurality of controllers signally linked to a communication bus of a controller area network includes monitoring bus communications including determining bus error counts for a plurality of execution cycles. When a bus error count associated with message transmission from one of the controllers exceeds a predetermined threshold, the one of the controllers is prohibited from communicating on the communications bus for a predetermined period of time and is included in a subset of candidate fault-active controllers. Any of the plurality of controllers included within the subset of candidate fault-active controllers that successfully transmits a message is removed from the subset of candidate fault-active controllers. A fault-active controller is isolated based upon the subset of candidate fault-active controllers and the bus error counts.

Abstract: A controller area network (CAN) on a mobile system has a plurality of CAN elements including a communication bus and nodes. A method for monitoring the CAN includes detecting inactive nodes of the CAN and employing an off-board controller to identify a candidate fault in the CAN based upon the inactive nodes of the CAN and a network topology for the CAN. A fault is isolated in the CAN based upon the candidate fault.

Abstract: A system and method for determining when to reset a controller in response to a bus off state. The method includes determining that the controller has entered a first bus off state and immediately resetting the controller. The method further includes setting a reset timer in response to the controller being reset, determining whether the controller has entered a subsequent bus off state, and determining whether a reset time. The method immediately resets the controller in response to the subsequent bus off state if the reset time is greater than the first predetermined time interval, and resets the controller in response to the subsequent bus off state after a second predetermined time interval has elapsed if the reset time is less than the first predetermined time interval.

Abstract: A method for message loss prevention in a CAN system. The CAN system includes a plurality of distributed nodes, such as electronic control unit nodes that communicate with each other through a CAN bus. The distributed nodes are categorized into a first type node or a second type node. Further, each distributed node has its own task period which is the time taken by a node to complete a task allocated to it. First, a synchronization frequency is determined. Synchronization frames are sent to the second type node by the first type node at the synchronization frequency. Hereafter, task activation synchronization is performed on the second type node based on information included in the synchronization frames where the task activation synchronization is performed by adjusting the task period of the second type node.

Abstract: A method for monitoring controller area network (CAN) on a mobile system includes identifying links and associated nodes between all the nodes of the CAN, and ranking all the links according to their order of connection to the monitoring controller, including assigning lower ranks to ones of the links proximal to the monitoring controller and assigning higher ranks to ones of the links distal to the monitoring controller. For each of said links, the associated node distal to the monitor is identified. The on-board monitoring controller determines a fault signature for each of the links starting with the link having the highest ranking, said fault signature comprising identified ones of the associated nodes distal to the monitor for each of the corresponding links.

Abstract: A controller area network (CAN) has a plurality of CAN elements including a communication bus and controllers. A method for monitoring the CAN includes identifying each of the controllers as one of an active controller and an inactive controller. A fault-active controller isolation process is executed to detect and isolate presence of a fault-active controller. A fault isolation process can be executed to detect and isolate presence of one of a wire open fault, a wire short fault and a controller fault when one of the controllers is identified as an inactive controller. Presence of a fault associated with a persistent bus disturbance in the CAN is detected when a bus error count is greater than a predetermined threshold continuously for a predetermined period of time.

Abstract: A controller area network (CAN) on a mobile system has a plurality of CAN elements including a communication bus and nodes. A method for monitoring the CAN includes detecting inactive nodes of the CAN and employing an off-board controller to identify a candidate fault in the CAN based upon the inactive nodes of the CAN and a network topology for the CAN. A fault is isolated in the CAN based upon the candidate fault.

Abstract: A controller area network (CAN) has a plurality of CAN elements including a communication bus and a plurality of controllers. A method for monitoring the CAN includes detecting occurrences of a first short-lived fault and a second short-lived fault within a predefined time window. A first fault set including at least one inactive controller associated with the first short-lived fault and a second fault set including at least one inactive controller associated with the second short-lived fault are identified. An intermittent fault is located in the CAN based upon the first and second fault sets.

Abstract: A controller area network (CAN) includes a plurality of CAN elements comprising a communication bus and a plurality of controllers. A method for monitoring includes periodically determining vectors wherein each vector includes inactive ones of the controllers detected during a filtering window. Contents of the periodically determined vectors are time-filtered to determine a fault record vector. A fault on the CAN is isolated by comparing the fault record vector and a fault signature vector determined based upon a network topology for the CAN.

Abstract: A vehicular distributed embedded real-time controller area network system includes ECUs functioning in an event-triggered mode for initiating transmission of a message to a communication bus. Each ECU includes a sending buffer for storing message. A bus controller interfaces with the ECUs and manages the transfer of messages to and from the communication bus. The transfer of messages onto the communication bus is executed by the bus controller on a periodic basis. The bus controller is unavailable to receive a message from an ECU when a previous message stored within a memory of the bus controller is awaiting transmission on the communication bus. The bus controller is available to receive a message from an ECU when the memory is empty. Messages are stored in the sender buffer when the bus controller is unavailable. A respective message within the sender buffer is transferred to the bus controller when the bus controller is available.

Abstract: A controller area network (CAN) has a plurality of CAN elements including a communication bus and controllers. A method for monitoring the CAN includes identifying each of the controllers as one of an active controller and an inactive controller. A fault-active controller isolation process is executed to detect and isolate presence of a fault-active controller. A fault isolation process can be executed to detect and isolate presence of one of a wire open fault, a wire short fault and a controller fault when one of the controllers is identified as an inactive controller. Presence of a fault associated with a persistent bus disturbance in the CAN is detected when a bus error count is greater than a predetermined threshold continuously for a predetermined period of time.

Abstract: A vehicular distributed embedded real-time controller area network system includes ECUs that function in an event-triggered mode to initiate a transmission of the message to the communication bus. Each ECU includes a sender buffer for storing the generated message. A bus controller interfaces with the ECUs and manages the transfer of messages to and from the communication bus. The transfer of messages onto the communication bus is executed by the controller area network controller on an interrupt basis. The bus controller being unavailable to receive a message from the ECU when a previous message stored within a memory of the bus controller is awaiting transmission on the communication bus. The bus controller is available to receive a message from the ECU when the memory is empty. The sender buffer stores messages received from the electronic control unit when the bus controller is unavailable.

Abstract: A method of detecting and mitigating an unintended active state of an in-vehicle communication network. The in-vehicle communication network includes a plurality of electronic control units (ECUs) communicating over a controller area network bus system. Each ECU includes both transmitting and receiving capabilities, and is configured with a communication protocol that provides guidelines for exchanging messages with other ECUs within the communication system. Each ECU enters a communication kernel active state for communicating on the bus. Virtual networks within the communication system are identified. Each virtual network includes a collection of signals involving respective ECUs whose transmission and reception are started and stopped collectively as a unit. Each respective virtual network that is active by fault is detected. Each faulty active virtual network is deactivated.

Abstract: A method for verifying the performance of a real-time system modeled as a timed automaton. An abstract model of the system is checked against an initial Linear Temporal Logic specification. If a path to an undesirable state is found, the counterexample is validated or invalidated using negative cycle detection. If a negative cycle is detected, optimization is undertaken to identify a minimal infeasible fragment in the negative cycle. The specification is then refined to eliminate usage of the minimal infeasible fragment, and the abstract model is then checked against the refined specification.

Abstract: A distributed embedded system that allows for the reconfiguration of tasks and messages. The system includes a system configuration manager and a plurality of electronic control units (ECU) each having an ECU configuration manager. Each ECU configuration manager stores the current configuration data for task scheduling and bus/network accessing/retrieving for the current schedule for that ECU. The system configuration manager includes a separate configuration data table for each ECU that can be reconfigured by programming signals sent on a system bus. The system configuration manager transmits the new configuration data from the data table on the bus to the ECU configuration manager if the scheduling of the tasks, message retrieval from the bus and message transmission on the bus changes for an ECU as a result of adding new tasks or new ECUs to the system.

Abstract: A method of detecting and mitigating an unintended active state of an in-vehicle communication network. The in-vehicle communication network includes a plurality of electronic control units (ECUs) communicating over a controller area network bus system. Each ECU includes both transmitting and receiving capabilities, and is configured with a communication protocol that provides guidelines for exchanging messages with other ECUs within the communication system. Each ECU enters a communication kernel active state for communicating on the bus. Virtual networks within the communication system are identified. Each virtual network includes a collection of signals involving respective ECUs whose transmission and reception are started and stopped collectively as a unit. Each respective virtual network that is active by fault is detected. Each faulty active virtual network is deactivated.

Abstract: A scheduling algorithm for scheduling messages on a time-triggered bus in a distributed real-time embedded system. The algorithm first determines an initial message schedule for assigning the messages to time slots on the bus so that predetermined precedent relationships are enforced. In one embodiment, the algorithm uses an earliest-deadline-first schedule to determine the initial message schedule. The algorithm then reallocates the messages in the time slots to provide unused time slots between the messages. In one embodiment, the reallocating the messages includes solving a quadratic optimization problem. Also, the messages are reallocated in the time slots so that they are substantially evenly spaced.

Abstract: A method of diagnosing a fault in an in-vehicle communication system. The in-vehicle communication system includes a transmitting node, at least one receiving node, and a network communication bus coupling the transmitting node to the at least one receiving node. A message is transmitted from the transmitting node to the at least one receiving node over the communication bus. A fault detection technique is applied within the transmitting node for detecting a fault within the transmitting node. A fault detection technique is applied to the at least one receiving node for detecting a fault within the at least one receiving node. A fault detection technique is applied within the network communication bus for detecting a fault within the communication bus. An analyzer collectively analyzes results from each respective detection technique for isolating a fault within the in-vehicle communication system.

Abstract: A method for verifying the performance of a real-time system modeled as a timed automaton. An abstract model of the system is checked against an initial Linear Temporal Logic specification. If a path to an undesirable state is found, the counterexample is validated or invalidated using negative cycle detection. If a negative cycle is detected, optimization is undertaken to identify a minimal infeasible fragment in the negative cycle. The specification is then refined to eliminate usage of the minimal infeasible fragment, and the abstract model is then checked against the refined specification.

Abstract: The present invention provides a method for verification of linear hybrid automaton by generation an initial abstract model based on an original Linear-Time Temporal Logic (LTL) specification, validating a counterexample using an approach of linear constraints, identifying a fragment in the counterexample by iteratively applying an approach of linear constraints satisfaction in a limited number of times, and refining the original LTL specification based on the fragment derived.