GB2287802A - Fuel pump control system - Google Patents

Abstract

A fuel system for a vehicle engine includes a pumping apparatus (20) having actuators (24) and sensors (21). An electronic control system for the apparatus is divided in to two parts (25, 26). The part (25) is mounted on the apparatus (20) and controls the operation of the apparatus in response to signals provided by the other part (26) which is mounted on the vehicle. A harness (28) connects the two parts and includes a data exchange link. Each control part (25, 26) checks that the other part carries out its critical tasks correctly. If the data exchange link fails the engine is run at an idle speed; a high idle speed is selected if the vehicle was travelling at high speed. <IMAGE>

Description

CONTROL SYSTEM This invention relates to a fuel system for supplying fuel to a vehicle compression ignition engine and of the kind comprising a pumping apparatus including a high pressure fuel pump driven in synchronism with the associated engine, a rotary distributor member for distributing fuel delivered by the high pressure pump during successive delivery stroke to a plurality of outlet ports in turn, an electrically controlled spill valve operable to terminate the delivery of fuel through the outlets thereby to control the quantity of fuel supplied to the engine, and an electronic control system for controlling the operation of the spill valve.

The current practice is to mount the control system at a position removed from the engine and to connect the control system to the pumping apparatus by means of a wiring harness. The wiring harness in addition to cables carrying what can be considered as heavy current for the operation of the spill valve also includes further cables for carrying current to a timing control device and also a stop valve which is independent of the spill valve. In addition it will include cables which carry lighter currents such for exampie as signals from sensors mounted in the apparatus. It is known that problems arise due to corruption of the sensor and actuator signals by electromagnetic interference, connector contact resistance, open and short circuits and inductively coupled interference from other circuits.

The object of the present invention is to provide a fuel system of the kind specified in an improved form.

According to the invention in a system of the kind specified the control system is divided into two parts, one part hereinafter referred to as the PECU being mounted on the pumping apparatus and the other part herenafter referred to as the VECU being mounted on the vehicle, the PECU controlling the operation of the spill valve to ensure that the desired quantity of fuel is delivered to the engine, the VECU acting to determine the desired quantity of fuel to be delivered to the engine on the basis of various engine operating parameters and desired operating parameters and a data link connecting the VECU with the PECU.

In the accompanying drawings: Figure 1 shows in sectional side elevation one example of a pumping apparatus; Figure 2 shows in diagrammatic form part of the apparatus not seen in Figure 1; Figure 3 shows the layout of the fuel system in block form; Figure 4 is a diagram showing the functions of the two parts of the control system; Figure 5 shows the delivery envelope of the apparatus; Figure 6 shows the connections between the two parts of the control system; Figure 7 shows part of the data which is exchanged between the two parts of the control system, and Figure 8 is a diagram showing the relationship between engine speed and data transfer.

With reference to Figures 1 and 2 of the drawings, the pumping apparatus comprises a high pressure pump which is formed by two pairs of pumping plungers 14 housed within respective bores 13 formed in a rotary distributor member 10 which in use is driven in timed relationship with the associated engine. The plungers are moved inwardly at the same time by cam lobes 27A formed on the internal surface of an annular cam ring 27 and during successive inward plunger movements fuel is delivered to outlet ports 18 in turn, the outlet ports being connected to the inspection nozzles of the associated engine respectively. The apparatus includes a spill valve formed by a valve member 22 which is associated with a piston 23 and the opening of the spill valve is achieved by applying fuel under pressure to the piston by means of a control valve 32 which is operated by an electromagnetic actuator 33.The spill valve is opened to terminate delivery of fuel through an outlet after the plungers have started to move inwardly. The bore 13 is filled with fuel from a low pressure transfer pump 17B during the periods when the plungers are allowed to move outwardly by the cam lobes 27A. A full description of the mode of operation of the apparatus so far described is to be found in GB-A-2253445.

In order to control the start of fuel delivery the cam ring 27 is movable angularly by a spring biased fluid pressure operable piston 15 to one side of which is applied the outlet pressure of the transfer pump 17B. The pressure applied to the other side of the piston is controlled by an electromagnetically operable valve 16. In addition although not shown in the drawings a stop valve is provided intermediate the transfer pump 1 7B and the bore 13, the stop valve being spring biased to the closed position and being movable to the open position by an electromagnetic actuator. The apparatus is also provided with a number of sensors as will become apparent from the following description.

In Figure 3 the pumping apparatus is indicated at 20, the sensors at 21 and the electromagnetic actuators for the valves at 24. The PECU is shown at 25 and the VECU at 26, the two being connected by a simple harness indicated at 28. Associated with the engine 28 are further sensors 29 and actuators 30. The harness 28 includes an ECAN serial data link and also a power supply line and a synchronisation link.

PECU Functions The PECU performs all the control functions which are required to deliver the desired mass of fuel into an engine combustion chamber at the desired time and the VECU performs all other engine control functions such as governing together possibly with drive train functions.

The demanded delivery and timing information is sent from the VECU through an interface in time for the PECU to carry out all control calculations prior to each injection. The PECU must carry out all calculations required to compensate for actuator and hydraulic non linearity, fuel viscosity, injector back leak variability etc, to ensure that the desired mass of fuel is delivered in both steady state and transient conditions. Calculations must also be carried out to ensure that the start of injection occurs at the correct time i.e. at the angle relative to the engine crank shaft demanded by the VECU via the interface. The pumping apparatus can vary delivery by any amount from one injection to the next, so that all dynamic delivery changes can be achieved.The start of injection timing is however determined by the angular relationship of the drive shaft of the apparatus and the cam ring so that changes can only be made by moving the cam within the housing. This means that a maximum slew rate is imposed on changes to the start of injection timing by the mechanical time constant of the advance control mechanism. The timing demand can be updated by the VECU and communicated to the PECU on each injection but the desired demand will not be achieved until the cam has moved to the correct position.

The PECU must also monitor and manage all critical failures of sensors and actuators or elements of the PECUNECU interface.

VECU The VECU is designed to be fitted under the bonnet or in the vehicle cabin. It will perform all engine fuel control functions and may also control other elements of the power train as required. The engine fuel control functions will include idle governor, pedal governor, max fuel envelope and start up. The desired fuel mass and start of injection time must be calculated and communicated to the PECU via the data link in time for the PECU to complete its calculations before the next injection.

The desired start of injection timing relative to the engine crank shaft must be calculated and communicated to the PECU. This can be done prior to each injection although the apparatus may take a number of injections to achieve the desired start of injection timing as described above. The engine crankshaft position sensor is connected to and decoded by the VECU. The PECU however needs to know the dynamic angular relationship between the crankshaft and the pump drive shaft in order to calculate the correct cam position and to achieve the demanded start of injection timing relative to the crank shaft. This requires that the VECU and PECU must be synchronised so that the crank shaft event time (in VECU time units) can be sent to the PECU prior to each injection and then compared by the PECU to a related pump drive shaft event.This will enable the PECU to carry out dynamic bolt up error and pump drive train stretch correction.

Interface Data Flows The critical functions detailed above require the interface from the VECU to the PECU to convey several data types as follows:a) Injection synchronous data prior to each injection from VECU to PECU e.g. demanded fuel mass for next injection, latest crank speed.

b) Time critical synchronisation data e.g. crank event time, VECU\PECU clock frequency comparison (watch dogging).

c) Non injection synchronous data at an update rate determined by various factors e.g. demanded start of injection angle relative to crank event. This could be sent with the injection synchronous data or by parameter request.

Further less critical data flows will be required as follows:d) Low priority VECU to PECU parameter request e.g. VECU can request a fuel temperature value or the fuel pump part number and serial number.

e) Low priority PECU to VECU parameter request e.g. PECU can request the engine operating status from the VECU.

f) Low priority VECU to PECU direct memory access e.g. VECU can read data from or write data to defined memory areas in the PECU for diagnostic, development or PECU set-up purposes e.g. PECU end of line programming during pump build.

Failure Modes and Recovery Actions The distributed nature of the control system allows some fundamental failure detection and recovery principles to be established, which were not possible with the previous single controller system as follows:a) Both the PECU and VECU microprocessors must be 'healthy' for the engine to run. Experience of current single controller systems shows that the processor failures are very rare and the effects may not be readily predictable. If the PECU detects an internal processor failure or detects the VECU processor failure via its ability to 'watchdog' the VECU then the PECU will stop the engine via all its actuators. If the VECU detects an internal processor failure or detects a PECU processor failure via its ability to 'watchdog' the PECU then the VECU will stop the engine via its control of the PECU actuator power supply.The PECU and VECU must both test their ability to stop the engine by toggling responsibility for stopping the engine during normal shut down after key off.

b) Any single line in the VECU\PECU interface can be open or short circuited without any impact on system performance i.e. the user (driver) should not be aware of any deterioration in the operation of the system These 'dormant' failures should where possible be detected and logged as historical faults so that repairs can be carried out at the next scheduled service.

c) Either data link (ECAN or synchronisation) can fail and the engine will continue to run but with a reduced level of functionally, forcing the user (driver) to seek immediate service assistance. This will allow for the case where the ECAN link is multi-dropped with other controllers, and will ensure that the engine does not suddenly stop due to an ECAN failure in some unrelated controller.

Processor 'Health' Checks The PECU and VECU processors are clocked by oscillators which are used to determine all time related calculations. The accuracy of fuel delivery and engine speed calculations both depend on the basic clock frequencies being correct. A large shift in clock frequency could cause a large change in maximum fuel delivery, or maximum engine speed which cannot be detected by the system. It is thus very important that any error in the clock frequency of the PECU or VECU should be detected and recovery action taken. It would be possible to fit a watchdog device with its own clock to the PECU but this would be in a similar environment to the main PECU clock.Alternatively the VECU and PECU can be used to watchdog each other, with the benefit that the two clocks which are being compared are located in very different environments i.e. one in the extreme temperature and vibration environment of the pumping apparatus and the other in the relatively friendly environment of the VECU installation. Both the VECU and the PECU must have the ability to shut down the engine independently of each other in the event of a failure.

A further essential feature of the 'health' check process is for each controller to check that the other controller is carrying out all its critical tasks at the correct rate and in the correct sequence. This is intended to ensure that critical software tasks are always scheduled at the correct rate and in the correct sequence to avoid undefined function in cases of multiple reset, program memory corruption etc.

In order to detect small changes, the clock frequencies must be compared to a very high tolerance, necessitating a discrete synchronisation link from VECU to PECU, rather than using message interrupt timing on the ECAN link. This link should carry pulses generated by one controller which can be measured by the other controller. The pulses should follow a defined sequence and length so that any relative drift in clock frequency can be detected.

Interface Redundancy Principles b) & c) above require two levels of redundancy and recovery from interface failures. The first level of recovery from any single line failing requires no deterioration in system performance. The ECAN link already fulfils this requirement by its 3 wire redundant nature. The ECAN link consists of 2 twisted lines normally operating in a balanced mode and a dedicated signal ground line. If either of the balanced lines fails then the remaining 'good' line is referenced to the signal ground, maintaining full data transfer with reduced noise immunity. If the signal ground fails, then data transfer is maintained by the balanced lines.

The synchronisation link consists of 2 wires, each carrying pulses in one direction only and referenced to the ma n power ground. One line carries pulses generated by the VECU and measured by the PECU and the other line operates in the opposite airection. All processor 'healthy' check and synchronisation functions can be achieved by one line only, provided that the ECAN link is still functioning. The power supply consists of 4 lines, 2 in parallel for ground connections and 2 in parallel for battery positive voltage connection. The ground lines are both connected directly to the main vehicle battery negative terminal, while the positive supply is controlled by the VECU via a relay.

Failures to either synchronisation line can readily be detected by the VECU or PECU. Failures to either positive supply line can be detected if they are routed via series diodes within the PECU (which will also provide reverse supply protection), and the direct inputs are sensed i.e. a diode will be reverse biased if its line is open circuited or grounded etc, and this can be detected by the PECU. It may be possible to apply a similar principle to the 2 ground connection lines, but series diodes may be detrimental to the function of the ground connection. Failures to any of the ECAN lines could be detected by either the VECU or PECU with appropriate hardware.

The second level of recovery from complete failure to either the ECAN or synchronisation link will involve a deterioration of the system performance in order to force the user (driver) to seek immediate service action, due to the reduced level of safety related failure detection. In the case of the synchronisation link completely failing, then clock frequencies can no longer be compared, and time critical data can no longer be transferred reliably. The start of injection timing will have to be calculated from pump drive shaft position, however a fixed bolt up trim value learned prior to the failure and stored in non volatile memory in the PECU can be used to correct any static timing errors. The possibility of substantial clock drift being undetected means that a reduced power and max speed mode must be entered. This will also encourage the user (driver) to seek service action.If the ECAN link fails then all normal data transfer will be lost. In this case the synchronisation link can be used to transfer sufficient data to maintain delivery and timing control The VECU will still be able to stop the engine in the event of a speed threshold being exceeded via its control of the PECU power supply. A similar reduced power mode to that detailed above should be entered. If the ECAN link is multi-dropped with other controllers, then a failure to a non power train controller could completely fail the ECAN link. In this case a reduced power function is preferable to immediate engine stop or idle.

If both the ECAN and synchronisation links fail, then the PECU can run the engine at an idle speed, determined from the engine and vehicle speed prior to failure i.e. if the vehicle was travelling at high speed, then a high idle speed can be selected to allow the vehicle to be manoeuvred off the road, while a stationary vehicle should fail to a normal idle speed.

The VECU can still stop the engine via the PECU power supply.

Spill Valve Over Fuel Checks Delivery control via the spill valve is open loop i.e. no fuel feedback signal is available to confirm that the spill angle schedule has actually caused the correct volume of fuel to be pumped and delivered into the combustion chamber. Under normal conditions pre-determined functions are used to achieve the correct delivery from a nominal system, or trim functions specific to a pump which are measured and stored in the PECU during end of line test. If fault conditions when correct spill angle is scheduled but the delivery is grossly inaccurate (due to a stuck actuator, etc,) then a gross over fuelling check is applied by comparing the demanded delivery and spill time to the instantaneous speed change of the pump drive shaft and cam loading.Any gross over fuelling error can be detected and recovered from by closing the engine shut off (ESO) valve and stopping the engine.

Engine Speed Sensor Checks Three engine speed sensors are used to determine engine crank and pump drive shaft speed and position. The crank position sensor is connected to and decoded by the VECU. It is used by the VECU to calculate engine speed for all engine control functions. The latest firing cycle speed (averaged over the last 180 crank degrees) and the time of the latest crank firing event (TDC time) is sent from the VECU to the PECU prior to each injection. The PECU compares the average speed to its locally sensed and calculated value for the same firing cycle to check for sense errors, etc. The same data is calculated by the PECU from its sensors and returned to the VECU on each injection for checking by the VECU.The PECU takes inputs from two local speed sensors, one of which senses pump drive shaft rotation relative to the cam ring known as the cam speed sensor (CSS) and the other known as the pump speed sensor (PSS) senses pump drive shaft rotation relative to the pump housing. Both of these sensors detects edges machined on a gear wheel fitted to the pump drive shaft (at one tooth, i.e. two edges per 5 degrees of pump rotation). In normal operation the pumps local speed and TDC events are calculated from the PSS (and sent to the VECU for comparison with the crank sensor).

The CSS and PSS read the same profile on the drive shaft but view it from different angles. The CSS can move through 20 degrees as the cam ring moves, giving a variation from 25 to 45 degrees lead in the profile seen by the CSS relative to the PSS. The gear profile cut on the drive shaft is based on a 72 tooth gear, with a missing tooth section for start of firing cycle identification (to enable rapid sync during start up), cylinder identification and reverse running detection.

Both the VECU and PECU carry out corruption checks on their local sensors for impossible acceleration or deceleration, missing or extra events, peak speed exceeded, incorrect event sequence, etc. Either controller may fail its local sense input if it considers that the signal is corrupted and carry on running using the speed calculated by the other controller but with an impaired level of system function (due to extra phase lags, possibility of a second failure, etc.). Under normal operating conditions, both controllers will compare their locally calculated speed with that received from the other controller and will consider their own speed to be in error if it is more than a margin lower i.e. a high-wins will be applied if the speeds differ by more than the margin.Under this condition, the local speed will continue to be calculated (assuming it appears error free) and will be used again if the error is corrected i.e. a fault will be latched when the error margin is exceeded and un-latched if the error is corrected. This should ensure that the speed used by both controllers when a difference exists, is always the highest one, giving the safest governing condition.

The speed sensor firing cycle event times will be used by the PECU to correct bolt up errors, (statically or dynamically) and may be used by the VECU to over check pump drive phasing. The current cylinder number (in firing sequence starting at 1 with the cylinder furthest from the engine flywheel) will also be sent back by the PECU to the VECU on each firing cycle for use by the VECU in cylinder dependant strategies e.g. idle cylinder balancing.

Control System Design The distributed nature of the control system requires a clear function split between the two controllers. The PECU is directly connected to all sensors and actuators within the fuel pump. It follows therefore that all 'pump' related control functions should be carried out by the PECU. All engine sensors are directly connected to the VECU, including the crank position sensor which is the primary sensor for engine governing. Thus it follows that all 'engine' control function should be carried out by the VECU. Both controllers have their own independent local engine speed sensing mechanisms which can be used for fault checking (with each other via the interface) and for clocking (scheduling) engine synchronous control processes.

In order to minimise fuel control phase lags, the demanded delivery mass data must be sent as late as possible in each firing cycle, but early enough for the PECU to carry out hydraulic correction and spill valve control calculations. The system partition shown in Figure 4 allows the pumping apparatus to be treated as a 'black box' which will manage the delivery of fuel into the engine. The VECU engine control processes do not need to compensate for hydraulic variability in the pumping apparatus. The PECU will maintain fuel delivery and timing for a defined time in the event that the demands are not updated by the VECU, to avoid 'glitches' due to late VECU processing etc.

Delivery Envelope The demanded delivery mass received by the PECU will first be limited by the delivery envelope process as shown in Figure 5. This is intended to ensure that the delivery requested is within the maximum delivery specified at the current engine speed as measured by the PECU. Figure 5 shows a typical maximum fuel delivery envelope, with excess fuel only available for engine starting. The solid line indicates the limit as set by the PECU and the dash line the limit as set by the VECU.

Hydraulic Correction This process ensures that the mass of fuel demanded by the VECU is delivered in the next injection, both transiently and in steady state. Fuei viscosity, temperature, high pressure leakage variability (back leak trim) and transient and steady state spill actuator linearisation will be carried out. This should enable the complete hydraulic system to be passed off as a 'black box' on a test rig capable of varying all the above parameters, without any engine control factors being taken into account. Corrections to compensate for system to system variability can be included by means of pump end of line test corrections stored in non-volatile memory in the PECU and on engine corrections such as back leak trim. Repeatable transient hydraulic trends can be characterised and corrected by this process.

Spill Control The delivery of the pumping apparatus is varied by 'spilling' off a proportion of the total fuel pumped, instead of injecting it. The volume of fuel delivered is determined by an angle between the drive shaft and cam ring at which the spill valve is opened i.e. early spill gives low delivery. The start of injection is not controlled by the spill valve. The spill control valve 32 sends a hydraulic 'control' signal to the spill valve 22 located in the distributor 10 via drillings in the housing and the distributor. This introduces a considerable time delay between the spill actuator drive being turned off and the fuel delivery ceasing. This delay is variable with speed (instantaneous and average), load, temperature and from pump to pump.Corrections for all of these factors will be applied, including end of pump line corrections and are stored in a non volatile memory in the PECU. Some of these correction functions may be commonised with those mentioned above in relation to hydraulic correction.

Delivery Control Phase Lag The phase lag between calculating a new delivery quantity as the engine speed changes in the VECU and changing the spill angle in the PECU must be kept to a minimum for good governor control. The time at which the demanded delivery is passed from the VECU to the PECU will be determined by the spill actuator propagation delays and the calculation time required for the processes above. The spill edge time will also need to be calculated early enough to allow for any possible instantaneous increases in engine speed which may occur shortly before or during pumping.The crank angle at which the demand is passed is likely to vary with average speed i.e. a late angle could be used at idle speed where phase lags are more critical and more time is available between injections, and an earlier angle could be used at higher speeds, possibly running back more than one firing cycle at high speed.

Advance Control The advance control system is used to move the cam ring within the pump housing to vary the start of injection timing. The apparatus starts to inject fuel shortly after the rollers reach the pumping sections of the cam profile, and so moving the cam ring is the only method of timing control. The cam ring can be moved through 20 degrees by the piston 15. The piston is moved by hydraulic pressure controlled by the valve 16 which is proportionally controlled by the PECU's drive circuits. The cam position feedback is calculated by comparing the angular relationship of the two pump speed sensors, one of which senses pump drive shaft rotation relative to the cam ring (for accurate spill valve control) and the other senses pump drive shaft rotation relative to the pump housing (for redundance when the crank speed sensor fails).

The cam will be moved by the PECU to an angular position which will achieve the injection start angle relative to the engine crank shaft requested prior to each injection by the VECU. The injection start event is timed relative to the crank to allow for static and dynamic errors in pump drive shaft phasing relative to the engine crank shaft i.e. bolt up error and drive stretch.

Pump Speed Sensor Processing The PECU takes inputs from two speed sensors fitted to the apparatus, c"'e of which senses drive shaft rotation re!ative to the cam ring known as cam speed sensor (CSS) and the other known as the pump speed sensor (PSS) senses drive shaft rotation relative to the pump housing.

Both of these sensors detect edges machined on a gear wheel fitted to the drive shaft (at one tooth, i.e. two edges per 5 degrees of pump rotation). The primary use of the CSS is to schedule spill valve actuator pulses, relative to the pumping event, to accurately control delivery. The PSS provides pump (and engine) speed and position information. Its primary use is to provide cylinder identification and a reference (integral to the pump) for cam position feedback. It also provides speed calculation redundancy if the engine crank speed sensor fails.

The missing tooth section at the start of each firing cycle must be detected before the spill valve can be triggered i.e. no fuel can be delivered before synchronisation has occurred. This means that the first pumping cycle during cranking may not be able to deliver fuel but the second cycle will, giving a rapid start. The spill trigger pulse is scheduled at a particular CSS angle and speed calculated by counting teeth from the end of the missing tooth section (so the end of this section must be at the same angle in each firing cycle). During start up the firing cycles do not need to be synchronised to the engine cylinder number, but once the engine has started, the long missing tooth section can be used to synchronise the PECU to the engine firing cycle (the VECU cannot identify this because the crank shaft sensor sees two rotations of the crank for one complete cycle of the engine and pump i.e. the pump rotates at half crank speed). The tooth pattern can also be used to identify a reverse running condition, in case the engine tries to start backwards so that the fuelling can be disabled.

The average pump speed across each firing cycle will be calculated at the end of each cycle and converted to engine speed units for hand shaking with the VECU as previously described.

ECAN Data Link The primary communication between the VECU and the PECU is via an ISO standard ECAN link as specified in the draft ISO spec ISO/DIS 11898 + amendments. This link will carry packets of data in both directions on each firing cycle to transfer data as defined below and other non-firing cycle synchronous data. The link will initially run at 250 kBaud but may be operated at the higher rate of 500 kBaud with standard format messages, giving a bus occupancy of 432 jim for a maximum size packet containing 8 bytes of data i.e. a maximum data transfer rate of -18500 byte per second. It is intended that one 8 data byte packet will be sent each way on every firing cycle at the highest priority, giving a worst case bus occupancy of -20% at 7000 eRPM (the system will not deliver fuel above -5000 eRPM, but may be over-speeded up to 7000 eRPM worst case).The remaining bus capacity will be used to transfer data at a lower update rate, asynchronously to the engine firing cycle.

Message: VECU to PECU Length: 8 data bytes Date content: byte 1,2 Demanded injection mass for next injection byte 3,4 Demanded start of injection angle byte 5,6 Engine PCS speed averaged over last firing cycle byte 7,8 VECU timer reading at last crank TDC event Power Supply The PECU contains two main electronic elements with very different power supply requirements. One element carries out all low power functions such as an on-pump sensor interfaces, digital functions (including micro-processor) VECU/PECU interface and actuator drive signal generation. The other element carries out all high power functions for actuator control. The low power element requires a low current supply (-1 amp or less) direct from the main vehicle battery and will contain its own internal sleep function.The high power element will require a high current and low impedance supply (-20 amp) from the main vehicle battery via a high current switching device (relay) under the control of the VECU to enable engine shut down from the VECU in PECU fault conditions. This high current supply is likely to carry considerable switching transients due to the inability of high capacity charge storage devices to survive in the PECU environment.

The operating specification of the pumping apparatus requires that any single line in the VECU/PECU interface can be open or short circuited without any impact on system performance i.e. the user (drive) should not be aware of any deterioration in the operation of the system. These 'dormant' failures should where possible be detected and logged as historical faults so that repairs can be carried out at the next scheduled service. To achieve this, all power connections must be doubled up and sense circuits must be included in the PECU to detect single line failures.

Figure 6 shows the wiring between the VECU, PECU and vehicle battery.

The thick wiring is intended to be high current wire and will require high current terminals in the OPC. The remaining wiring is low current and could have low current terminals in the OPC. The ECAN data lines and sync/digital supply lines are twisted to minimise the loop area of noise coupling.

The actuator power relay provides reverse battery protection for the PECU to avoid voltage drops in the PECU. The PECU digital power supply is normally taken from Dig Batt + Dig Gnd, but if either of these lines fails then the supply is taken via a diode network from the actuator supply, with a slight reduction in low voltage performance and noise rejection. The ECAN data lines normally operate in a balanced mode but if either line fails then the Dig Gnd is used as a reference for the remaining good line.

Further advantages of independent PECU supplies are as follows: - The PECU processor supply will not be subject to voltage drop during start due to actuator supply resistance, improving the protection against resets with low battery starts.

- The PECU processor can keep running in the event that the VECU shuts down the engine via the stop valve. This will enable a faulty shut down by the VECU to be detected and logged by the PECU to aid diagnostics.

- Cross talk from the actuator switching transients into the PECU digital supply will be reduced.

Synchronisation Interface The synchronisation interface normally carries out two main functions PECUNECU clock frequency corn" an son and software timer synchronisation. If the ECAN link completely fails, then the synchronisation link can be used tO communicate fuel delivery and timing information from the VECU to the PECU and pump status information from the PECU to the VECU. Two wires are used sending pulses from the VECU to the PECU and the other sending pulses from the PECU to the VECU. These pulses are generated and measured by timer compare and interrupt logic under software control. The edges sent on the line have no direct hardware link to any PECU or VECU function and the pulse trains sent follow a pre-defined pattern, allowing software noise filtering to be employed to detect and correct corrupted pulse trains.

Synchronisation Interface Hardware Specification The pulses on the two lines are generated and sensed relative to the PECU Dig Gnd. The signal lines are switched between Gnd and vehicle battery voltage, and are sensed ratiometrically to battery voltage. Less than 30% of battery voltage is seen as a logic low signal and greater than 60% is seen as a logic high signal by a sensing controller. The sensing controller has a nominal input impedance of 1KOhm to Dig Gnd.

Normal Operation Figure 7 shows the waveform sent from VECU to PECU and PECU to VECU. During normal operation the waveforms labelled t1 and t5 are sent. The length of the pulses must conform to Table 1 below. If an error is seen, then the controller which detects the error will stop the engine if a clock error is detected or enter a recovery mode if the signal is corrupted. The waveforms sent in each direction run asynchronous to each other i.e. t3 can vary infinitely and they must start within a time after reset or wakeup defined in Table 1. A data packet is sent on the ECAN link by the transmitting controller after the health check pulse has been sent. The packet p1 is sent from VECU to PECU after the pulse t2 has been sent and the packet p2 is sent from PECU to VECU after the pulse t4 has been sent.These packets must be sent within a window from 0 to 5 mS after the falling edge of the pulse. The data contained within the packets is detailed in Table 2 and Table 3 below.

Both controllers will use a leaky bucket method to determine when the engine should be stopped. All the actions in Table 1 which result in engine stop will cause the fault bucket to be incremented by 2, and only decremented by 1 if the same test is passed. If the fault bucket reaches 10, the engine will be stopped i.e. a fault must be seen five times in 100 mS before the engine is stopped.

If either of the synchronisation lines is interrupted and pulses ceased to be received, then the engine will not be stopped as long as the one remaining line still passes all tests and the sending controller receives back correct data from the receiving controller in the returned data packet. If both synchronisation lines fail and clock frequency checking cannot be carried out, then the driver must be warned by means of the malfunction indicate lamp and the engine fuelling envelope must be reduced to limit power and speed to below half their normal peak values (to allow for a worst case doubling of clock speed). A line will be failed if no pulses are received for a period of 100 mS and will only be reenabled if a correct sequence is seen for 100 mS.

Period Label: Measured By: Period: Tolerance: Action: t 1 VECU 20 mS +/- 1 S t t 1 PECU 20 mS +/-1 % PECU Engine Stop t2 VECU 1500 S +/- 1 S t2 PECU 1500 S +/- 5 % PECU Engine Stop t3 not defined not defined t4 PECU 1500 S +/- 1 S t4 VECU 1500 S +/- 5% VECU Engine Stop t 5 PECU 20 mS +/-1 S t t 5 VECU 20 mS +/-1% VECU Engine Stop reset to first edge PECU or VECU 50 mS +/-50 mS Table 1

Message: | VECU to PECU - p1 Resolution: Range: Length: 8 data bytes Data Content: byte 1,2 VECU timer &commat; rising edge of t2 1 S 0 to 65535 S byte 3,4 VECU timer &commat; falling edge of t2 1 s 0 to 65535 S byte 5,6 VECU timer &commat; rising edge of last received t4 1 S 0 to 65535 S byte 7,8 VECU timer &commat; falling edge of last received t4 1 S 0 to 65535 S Table 2

Message: PECU to VECU - p2 Resolution: Range: Length: 8 data bytes Data Content: byte 1,2 PECU timer &commat; rising edge of t4 1 S 0 to 65535 S byte 3,4 PECU timer &commat; falling edge of t4 1 S 0 to 65535 S byte 5,6 PECU timer &commat; rising edge of last received t2 1 S 0 to 65535 S byte 7,8 PECU timer &commat; falling edge of last received t2 1 S 0 to 65535 S Table 3 Recovery from ECAN Failure If the ECAN link has failed completely then the PWM waveform labelled t, to t,0 is superimposed on the health check waveform in order to transfer data between the controllers. The position of the dotted edge is moved within the window marked t8 to vary the mark/space ratio and thereby transfer the data. 12 bytes can be transferred each way during each 20 mS period, numbered 1 to 12 starting from the health check pulse i.e. t7 relates to byte 1 and t10 to byte 2 etc.

Data = Limit 0 to 255 [(768 * t, . (t, + t8)) -256] ECAN Data Link The primary communication between the VECU and the PECU is via an ISO standard ECAN link as specified in the draft ISO spec ISO/DIS 11898 + amendments. This link will carry packets of data in both directions on each firing cycle to transfer data as defined in Table 4 and Table 5 below and other non-firing cycle synchronous data as defined in Table 6 to Table 11.

The link will initially run at 250 kBaud with standard format messages, giving a bus occupancy of 432,uS for a maximum size packet containing 8 bytes of data i.e. a maximum data transfer rate of x18500 byte per second. It is intended that one 8 data byte packet will be sent each way on every firing cycle at the highest priority, giving a worst case bus occupancy of 20% at 7000 eRPM (the system will not deliver fuel above 5600 eRPM, but may be over-speeded up to 7000 eRPM worst case). The remaining bus capacity will be used to transfer data at a slower update rate, asynchronously to the engine firing cycle.

Figure 8 shows the latest crank shaft angle at which the firing cycle synchronous data packet defined in Table 4 must be sent from VECU to PECU, against engine speed. If this packet is sent late then the injection mass from the previous packet will be used for the current injection, and the late data packet will be used to determine the injection quantity of the following injection. The PECU will send the packet defined in Table 5 in response.

Message: VECU to PECU - p3 Resolution: Range: Length: 8 data bytes Data Content: byte 1,2 Demanded injection mass for next injection 1/32 mg 0 to ? mg byte 3,4 Demanded start of injection angle relative to 1/1280 crank TDC Crank byte 5,6 Engine CPS speed averaged over last firing cycle 0.25 eRPM 0 to 7000 eRPM byte 7,8 ~ VECU timer reading at last crank TDC event 1 1 PS O to 65535 Ps Table 4

Message PECU to VECU - p4 Resolution: Range: Length: 8 data bytes Data Content: byte 1,2 Pump status word byte 3,4 byte 5,6 Pump speed averaged over last firing cycle 0.25 eRPM 0 to 7000 eRPM byte 7,8 PECU timer reading at last nominal pump TDC 1 s 0 to 65535 S event Table 5 The PECU and VECU can be requested by any node on the ECAN bus to respond with a parameter update message. A pre-defined table of parameters of up to six bytes each can be accessed. A single response can be made or a regular response with a requester defined update rate can be specified. Packets specified in Table 6 to Table 9 are used. The PECU memory space can be accessed for read or write via the ECAN bus for use in pump production and development via messages in Table 10 to Table 13.

Message: Any node to PECU - p5 Resolution: Range: Length 4 data bytes Data Content: byte 1,2 Requested Parameter ID number 1 per PID 0 to 7fffh byte 3,4 Desired repeat rate 500 S 1 to 65535 (0 = no repeat) Table 6

Message: Any node to VECU - p6 Resolution: Range: Length 4 data bytes Data Content: byte 1,2 Requested Parameter ID number 1 per PID 8000h to ffffh byte 3,4 Desired repeat rate 500 PS 1 to 65535 (0 - no repeat) Table 7

Message: PECU to Requesting node - p7 Resolution: Range: Length 8 data bytes Data Content: byte 1,2 Requested Parameter ID number 1 per PID O to 7fffh byte 3 to 8 PID data (unused bytes set to 00h) Table 8

Message: VECU to Requesting node - p8 Resolution: Range: Length 8 data bytes Data Content: byte 1,2 Requested Parameter ID number 1 per PID 8000h to ffffh byte 3 to 8 PID data (unused bytes set to 00h) Table 9

Message: Any node to PECU - p9 Resolution: Range: Length 6 data bytes Data Content: byte 1,2 Requested data from PECU address 0 to ffffh byte 3,4 Desired repeat rate 500 P5 1 to 65535 (0 = no repeat) Table 10

Message: PECU to Requesting node - p10 Resolution: Range: Length 8 data bytes Data Content: byte 1,2 PECU data address 0 to ffffh byte 3 to 8 Requested data (6 byte block starting at address) Table 11

Message: Any node to PECU - pi 1 Resolution: Range Length: 3 to 8 data bytes Data Content: byte 1,2 PECU data address 0 to ffffh byte 3 to 8 Download data (1 to 6 bytes starting at address) Table 12

Message: PECU to downloading node - p12 Resolution: Range: Length: 3 to 8 data bytes (confirms writes to PECU memory) Data Content: byte 1,2 PECU data address 0 to ffffh byte 3 to 8 Echo of download data read from PECU memory after write (1 to 6 bytes starting at address) Table 13

Claims (3)

1. CLAIMS 1. A fuel system of the kind specified in which the control system is divided into two parts, one part being mounted on the pumping apparatus and hereinafter being referred to as the PECU and the other part being mounted on the vehicle and hereinafter being referred to as the VECU, the PECU controlling the operation of the spill valve to ensure that the desired quantity of fuel is delivered to the engine, the VECU acting to determine the desired quantity of fuel to be delivered to the engine on the basis of various engine operating parameters and desired operating parameters and a data link connecting the VECU with the PECU.
2. 2. A fuel system according to Claim 1 in which the data link transmits data in both directions.
3. 3. A fuel system according to Claim 1 in which the VECU controls the supply of power to the PECU.