Methods and apparatus for isolating safety functions in a motion control system for a vehicle

1. A safety kernel system, for use in connection with motion control of a vehicle, comprising:

a processor configured and arranged for communication with a measurement system including a vehicle-system actuator and a sensor; and

a non-transitory computer-readable storage device comprising computer-executable instructions including a safety kernel software and a set of safety rules, wherein the instructions, when executed by the processor, cause the processor to perform operations comprising:

receiving, from distinct software being separate and independent of the safety kernel software, a request for a safety-critical function related to vehicle motion;

receiving, from the measurement system including the vehicle-system actuator and the sensor, using the safety kernel software, an actions signal containing an actions data set;

applying, using the safety kernel software, the set of safety rules to the actions data set, rendering a safety-kernel software response;

comparing the request for the safety-critical function to the safety-kernel software response rendered;

limiting, based on results of the comparing operation, the request for the safety-critical function, rendering a limited request, if the request for the safety-critical function is beyond a threshold parameter set by the safety kernel software; and

transmitting, by way of a status signal, the limited request for the safety-critical function to the vehicle-system actuator.

2. The system of claim 1 , wherein the distinct software includes an application software package.

3. A method, for use in connection with motion control of a vehicle, comprising:

receiving, by a system having a processor configured and arranged for communication with a measurement system including a vehicle-system actuator and a sensor, from an application software package, using a safety kernel software package of the system, a request for a safety-critical function related to vehicle motion;

receiving, by the system, from a measurement system including a vehicle-system actuator and a sensor, using the safety kernel software package, an actions signal containing an actions data set;

determining, by the system executing the safety kernel software package, whether an override command has been received;

detecting, by the system executing the safety kernel software package, whether there is a primary violation within a set of primary safeguards of the safety kernel software package;

detecting, by the system executing the safety kernel software package, whether there is a secondary violation within a set of secondary safeguards of the safety kernel software package;

limiting, by the system executing the safety kernel software package, the request for the safety-critical function, rendering a limited request, if the request is beyond a threshold parameter set by the safety kernel software package; and

transmitting, by way of a status signal, the limited request for the safety-critical function to the vehicle-system actuator.

4. The method of claim 3 , wherein the primary safeguards prescribe a process comprising:

detecting any failure within the vehicle-system actuator and the sensor; and

verifying that the initial request was transmitted by the application software package.

5. The method of claim 4 , further comprising blocking, by the system, the request received by the safety kernel software package in response to the safety kernel software package (a) detecting failure within the vehicle-system actuator and the sensor or (b) determining that the initial request was not transmitted by the application software package.

6. The method of claim 3 , wherein the secondary safeguards prescribe a deceleration routine comprising:

evaluating, if the vehicle has experienced an increase in acceleration based on a command state, the increase in acceleration as captured by the vehicle-system actuator and the sensor;

determining, by comparing the request for the safety-critical function to a deceleration request threshold, whether the request for the safety-critical function includes a hard brake; and

evaluating, if the vehicle is in a vicinity of a threat, the threat including analyzing a distance between the threat and the vehicle.

7. The method of claim 6 , further comprising:

determining, by the system, based on the command state, whether the vehicle has experienced an increase in acceleration; and

blocking, if the vehicle has experienced an increase in acceleration, the request for deceleration from being passed to the vehicle-system actuator being a braking actuator.

8. The method of claim 6 , further comprising blocking, by the system, the request for deceleration, when the request includes a hard brake.

9. The method of claim 6 , further comprising blocking, by the system, the request for deceleration when the vehicle speed is in the vicinity of the threat.

10. The method of claim 6 , further comprising:

adjusting, by the system, when the application software has generated a hard brake request, the request for deceleration to a modified level of deceleration; and

transmitting the modified level of deceleration to the vehicle-system actuator being a braking actuator.

11. The method of claim 6 , further comprising:

adjusting, by the system, when the vehicle is in the vicinity of the threat, the request for deceleration to the modified level of deceleration; and

transmitting the modified level of deceleration to the vehicle-system actuator being a braking actuator.

12. The method of claim 3 , wherein the secondary safeguards prescribe an acceleration routine comprising:

evaluating, if the vehicle has experienced a deceleration request based on a command state, the deceleration captured by the sensor and the vehicle-system actuator; and

comparing the vehicle speed to a threshold speed.

13. The method of claim 12 , further comprising:

determining, by the system, whether the vehicle has experienced a brake request; and

blocking, if the vehicle has experienced a brake request, the request for acceleration from being passed to the vehicle-system actuator being a propulsion actuator.

14. The method of claim 12 , further comprising blocking, by the system, the request for acceleration, when the vehicle speed is less than the threshold speed, from being passed to the vehicle-system actuator being a propulsion actuator.

15. The method of claim 12 , further comprising:

adjusting, by the system, when the vehicle speed is greater than the threshold speed, the request for acceleration to a modified level of acceleration; and

transmitting the modified level of acceleration to the vehicle-system actuator being a propulsion actuator.

16. The method of claim 3 , wherein the secondary safeguards prescribe an lateral acceleration routine comprising:

evaluating, if the vehicle has experienced at least one other blocked request based on a command state, and

comparing the vehicle speed to a threshold speed.

17. The method of claim 16 , further comprising:

determining, by the system, whether the vehicle has experienced at least one other blocked request; and

blocking, if the vehicle has experienced at least one other blocked request, the request for lateral acceleration from being passed to the vehicle-system actuator being a steering actuator.

18. The method of claim 16 , further comprising blocking, by the system, the request for lateral acceleration, when the vehicle speed is less than the threshold speed, from being passed to the vehicle-system actuator being a steering actuator.

19. The method of claim 16 , further comprising:

adjusting, by the system, when the vehicle speed is greater than the threshold speed, the request for lateral acceleration to a modified level of lateral acceleration; and

transmitting the modified level of lateral acceleration to the vehicle-system actuator being a steering actuator.

20. A method, for use in connection with motion control of a vehicle, comprising:

receiving, by a system having a processor configured and arranged for communication with a measurement system including a vehicle-system actuator and a sensor, a request for a safety-critical function to a safety kernel software package, the request originating from an application software package;

receiving, by the system, from the measurement system including the vehicle-system actuator and the sensor, using the safety kernel software package, an actions signal containing an actions data set;

determining, by the system, executing the safety kernel software package, whether an override command has been received;

detecting, by the system executing the safety kernel software package, whether there is a violation within a set of primary safeguards of the safety kernel software package;

blocking, when there is a violation within the set of primary safeguards of the safety kernel software package, the request from being passed to an actuator;

detecting, by the system executing the safety kernel software package, whether there is a violation within a set of secondary safeguards of the safety kernel software package;

blocking, when there is a violation within the set of secondary safeguards of the safety kernel software package, the request from being passed to the actuator;

limiting, by the system executing the safety kernel software package, the request for the safety-critical function, rendering a limited request, if the request is beyond a threshold parameter set by the safety kernel software package; and

transmitting, by the system executing the safety kernel software package, to the vehicle-system actuator, the limited request.