MXPA01004018A - Fault tolerant architecture for a personal vehicle - Google Patents

Abstract

A motorized vehicle capable of fault detection and of operation after a fault has been detected. The vehicle has a plurality of control components coupled to a motorized drive and a comparator for comparing the output of each of the control components with outputs of other control components so that failures may be identified. The vehicle may have multiple processors coupled to a plurality of control channels by means of a bus and a decision arrangement that suppresses the output of any processor for which a failure has been identified.

Description

STRUCTURATOLERANTE A FAULTS FOR A PERSONAL VEHICLE TECHNICAL FIELD The present invention relates to the structure of a system for a motor vehicle, and very particularly to the redundant characteristics of the structure of the system.

BACKGROUND OF THE INVENTION Personal vehicles such as those used by people with disabilities, for example, may be self-driven and guided by the user, and may also involve stabilization in one or more of the anterior-posterior or left-right planes, such as the case, when more than two wheels are not in contact with the ground at the same time. More particularly, said vehicle is described in Figure 1, where it is generally designated by the number 10. The vehicle 10 for transporting a subject 12 or other type of load, may include one or more wheels 16 or gears 14 of the wheels 16 , wherein each wheel and / or gear is driven by a motor, in combination or independently. Such vehicles are included among those described in the U.S.A. 5,701, 965, and in the patent application E.U.A. serial number 08 / 384,705, which are incorporated in the present invention by reference. The vehicles of this • A% L "&k & class can be operated more efficiently and safely when they employ system structure features in addition to those described in the prior art.

BRIEF DESCRIPTION OF THE INVENTION According to a preferred embodiment of the present invention, a vehicle for ground locomotion is provided, which has the ability to detect faults. The vehicle has a support structure for supporting a load, a module for contacting the ground to provide the locomotion capacity to the support structure, and a motorized transmission arrangement for allowing controllable movement of the element contacting the vehicle. floor. Additionally, the vehicle has a variety of control components, each control component has an output, and a comparator to compare the output of a first control component with the output of another of the control components and thus identify a fault, since either the first or the other control component. The control components may include a sensor for detecting at least one position and orientation of the vehicle, a variety of redundant control channels, each control channel having the ability to independently control the arrangement of the motorized transmission, or a diversity of processors coupled to each of the redundant control channels by means of a system driving circuit. Each processor has an output and each user has the ability to receive user access commands, a signal from the sensor, and the output of each of the other processors. According to the alternative embodiments of the invention, control components can be chosen from a variety of sensors to sensitize the position or orientation of the vehicle and a variety of control channels, each control channel having the ability to control independently the motorized transmission. The control components may also include a variety of processors coupled to the channels of control by means of a driving circuit of the system, and the system driving circuit can couple the diversity of processors in at least one set of user accesses, a battery capacity indicator, a temperature indicator, a seat height controller, and a shock protection driver. The output of any of the control components can be provided at a speed that exceeds the mechanical response speed of the motorized transmission. Each processor can have the ability to receive access commands from the user, a signal from the sensor, and the output from each of the other processors, and the comparator can compare the outputs of the processors to identify a fault of any of the processors, it can also include a disconnect circuit to remove a defective processor from the system's conduction circuit, and can suppress the output of any processor for which a fault has been identified in such a way that the continuous operation of the Vehicle is allowed using all other processors. According to still further embodiments of the invention, a vehicle having a support structure for supporting a load and a contact element with the ground is provided to provide the locomotion capacity to the support structure, the contact element with the ground can be moved around an arrow with respect to a local axis, and a motorized transmission to allow the controllable movement of the element that makes contact with the ground around an arrow and to allow the movement of the arrow in such a way that move the local axis with respect to the support structure. A sensor is provided to detect at least one position and orientation of the vehicle, as it was. A variety of control channels, each control channel has the ability to independently control the motorized transmission. The vehicle has a variety of processors coupled to the control channels by means of a system driving circuit, each processor has an output, each processor has the ability to receive user access commands, a sensor signal, and the output of each of the other processors, and a comparator to compare the output of the 20 processors to each other to identify a failure of any of the processors. The vehicle can have a motorized transmission that has a variety of redundant windings.

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^ MeuU ??. A-SiE &safat., According to another embodiment of the invention, a fail-safe joystick is provided. The joystick has a centering mechanism that restores the joystick to a central position when released by the user and a sensor to detect the joystick in the center position.

BRIEF DESCRIPTION OF THE DRAWINGS The invention will be better understood by the references to the following description, considered together with the accompanying drawings, in which: Figure 1 is a side view of a personal vehicle of the prior art of the type of which the embodiment of the invention is can use conveniently; Figure 2 is a block diagram of the control structure for controlling a personal vehicle according to a preferred embodiment of the present invention; and Figure 3 is a perspective view of a failsafe control lever, according to one embodiment of the present invention.

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^ DETAILED DESCRIPTION OF THE SPECIFIC MODALITIES With reference to Figure 1, the fundamental parts of the vehicle 10 can be considered, without any limitation, to include a support 18 for supporting a subject 12, a module for contacting the ground 20 for transporting the support 18, one or more drive mechanisms (not shown) for driving the wheels 16 and / or the gears 14, and one or more controllers for regulating the drive mechanisms according to the user's desired access parameters and the physical position 10, and the configuration of the vehicle 10 as well as the measured time rates of change of position and configuration of the vehicle. The physical position and / or configuration of the vehicle are recorded, in periodic or continuous pass, by a group of sensors (not shown), the outputs of which are used by one or more controllers. As an example, the 15 sensors provide the displacement and tilt information that allows the controller to calculate the torque that will be applied to the wheels or gears of a vehicle, in accordance with the control laws that are specified and described in the patent E.U.A. 5,701, 965 and in the patent application E.U.A. series number 08 / 384,705. In order to provide a more detailed explanation, the term "floor" as used in the expression "floor contact module 20" or in other references to the surface on which the vehicle 10 can be operated, can be any surface, interior or exterior to buildings Lj O ^ _L__LtlJÍ. ^ ______ i i § ^ gp * ~ £ * - ** - ~ > "-jftüft-" ^^ ~. ^^ A ', .. ^ aw ^ > closed, which can be traversed by the vehicle 10. The term "personal transporter" is used in the present invention interchangeably with the term "vehicle". Additionally, the term "wheels" may equivalently include curved or curved elements or other elements that make contact with the ground that have the ability to drive a vehicle 10 on the ground. The "position" of the vehicle refers to a certain fixed reference point with respect to the ground, while "configuration" refers to the arrangement of vehicle components with respect to the other and includes, without limitation, such attributes as the height of the seat, the inclination of the structure, etc; as well as the settings made in the software, such as speed, acceleration, sensitivity of the joystick specified, etc. In particular, according to a preferred embodiment of the invention, the wheels 16 rotate around the arrows 22 which can likewise be rotated near the gear arrow 24 which constitutes the axis of rotation of the gear. In turn, the support 18 may be raised or lowered with respect to the gear 14. Other internal degrees of freedom in the vehicle 10 may be present that similarly include within the scope of the term "configuration" as used herein and in any of the appended claims. Similarly, the angular orientation, or The inclination of the vehicle 10 with respect to gravity is also included within the scope of the term "configuration". The access by the user can be provided by the subject transported by the vehicle, or by means of a hand lever or Líft-bA .JÍ ^: ^: _1_1 ^ = ^ _ ^^^ L_ L ^ 1_. R ggp¿, i ^ ^ another interface, or by the user's inclination, or by applying manual forces on external objects. Additionally, the user's access can be provided by an attendant not transported by the vehicle, who can direct the movement and / or configuration of the vehicle by applying forces, such as, for example, by means of an assistance handle, to induce the vehicle lean. Alternatively, access by the user can be provided by means of an assistant through a control module that can be separated from the vehicle, wherein the control module contains a joystick, a switch, or accesses of the vehicle. board or keyboard, or in any other way. "Sensor" refers to any device for detecting any characteristic of the position or physical configuration of the vehicle and may include, for example, an inclinometer for measuring inclination, gyroscopes, or encoders to measure angular orientation or its rate of change for any of wheels or gears, etc. 15 The safe operation of a vehicle after certain types of failures may require a fault tolerance of one or more of the critical vehicle parts listed above. As used in this description and in any of the appended claims, "redundancy" refers to the replication of certain components to contribute to tolerance to vehicle failures. "Redundancy" also refers to a sampling of the data. Therefore, for example, data can be provided by means of sensors at a speed substantially greater than the system's mechanical response speed. In this case, if a data is altered in the ^^^^^^^^^^^^^^^^^^^^^^^^ ^ ^^^^^^^^^^^^^^ »^^^^^^^^ ^ ^ Mß ^^^ ^^^^^^^^^^^^^^^ system or in the system's conduction circuit or in some other place, will not cause a system response, since a new data will be provided before the answer is provided. In a preferred embodiment of the invention, certain fundamental vehicle parts are electronically interconnected in such a system structure, as shown, for example, in the block diagram of Figure 2, as described below. The combination of sensor electronic components 34 and control processors 24, 26 and 28, together with their respective power sources 30, can collectively be referred to as a power base 32. The power base 32 contains a multiplicity of base processors. power 36, each includes electronic sensor components 34, a central processing unit (CPU) 24, 26 and 28 and a power source 30. Each (CPU) 28 has an associated power source 30 and an electronic sensor board 34 The power base 32 is electronically coupled to an interface 38 to receive access by the user, as well as other controllers to control the peripheral or extraordinary functions of the vehicle. Other controllers and peripheral devices coupled to the power base 32 may include, without limitation, a seat height controller 40, as well as a shock protection controller 42 and a shock protection monitor 44, and battery chargers as well. as monitors (which are not shown). The shock protection controller 42 can perform certain functions such as purification of one or more air pockets, as described in the pending provisional application of E.U.A. 60 / 064,175, filed November 4, 1997, or alternatively, in the separation of the support 18 (shown in Figure 1) from the module making contact with the ground 20 as described in the pending provisional application of E.U.A. 60/061, 974, filed on October 14, 1997. The communication between the interface and the user 38, the peripheral controllers 40 and 42, and each of the power base processors 24, 26 and 28 of the base of power 32 is by a system serial conduction circuit 45, which, in a preferred embodiment, is an asynchronous channel having a capacity of 250 kBaudcs and employing a time division multiple access (TDMA) protocol. The actuators for rotating the wheels 16 and the gear 14 (shown in Figure 1) are typically motors, such as the left-hand wheel motor 51, in a preferred embodiment, the actuators are servomotors. The actuator 51 for the left wheel can be driven either by means of redundant left wheel amplifiers 46 and 48, and similarly, it can be a right wheel amplifier 50 which will drive the actuator for the right wheel, and can be a gear amplifier 52 that will drive the actuator for the gear. In a preferred embodiment of the invention, power channels are provided that share loads, wherein both left wheel amplifiers 46 and 48 relate to the total output of the left wheel motor 51, without However, each left wheel amplifier has the ability to provide limited performance for a short period, to allow the vehicle to rest safely. The power channels can also be referred to in the present invention, and in any of the appended claims, as "control channels". Additional redundancy can be provided in each motor 51, whose half windings of each motor provide a sufficient torque for the operation of the vehicle. Each total redundant group of amplifiers 46, 50 and 52 is controlled by one of the power amplifying controllers 54 and 56. Particularly, it is a great advantage to provide all current to the servomotors via the wheel amplifiers 46 and 48 so as not to High current series elements are required between the battery and the motor. The communication between the redundant power base processors 24, 26 and 28 and the power amplifier controller 54 is effected by a power base series driving circuit 58 while, in order to provide full redundancy, communication between the redundant power processors 24, 26 and 28 and the power amplifier controller 56 is by means of a second power base series driving circuit 60. As can be seen in light of the description of the previous system with reference to Figure 2 , the control structure associated with the vehicle can be highly redundant, with degrees of redundancy difference appended to various system components.

^ ^, A, ... .... . A ^ jÉ = ^^ Several topics can be addressed in light of the redundancy described above. One of them is the allocation of control and decision making when the redundant components are present and active simultaneously.

Control of the series driving circuit According to the preferred TDMA protocol presented above, each device in the series driving circuit 45 has an assigned time channel to transfer or transmit a set of previously defined data. All devices in the series driving circuit 45 are programmed to respond to or address specific data transmitters that are based on software configurable control registers. The series driving circuit 45 is controlled by a processor which is referred to as the Master Conductor Circuit Control in series, for example, a specified one of the power base processors 24, 26 and 28, which could additionally correspond to a designated "Master Power Base Processor", which has already been presented in the present invention, for example purposes, as well as the processor 24. The Master Control of the series driving circuit controls a master synchronized package as well as the Error data collection of the driving circuit. In the event that the interface of the master power base processor fails, a "secondary power base master control" determined as described below assumes the master control of the system's series conduction circuit.

Critical Fault Operation Components In the case where the operation of a component is essential to put the vehicle in safety mode without harming the vehicle occupant, triple fault tolerant redundancy is employed, in accordance with a preferred embodiment of the vehicle. invention, to create an operative functionality to failures. An example of a critical fault operation component is the power base processor, of which three are provided and designated as power base processors 24, 26 and 28 in FIG. 2. Each power base processor 24, 26 and 28 is also associated with a specific group of critical sensors of which reliable output is required to ensure the typical functionality of the vehicle, including, without limitation, the balance of the vehicle, the condition of the battery, etc. In addition, a single failure of a point of any processor or sensor should be detectable. Additionally, according to one embodiment of the invention, the detection of a fault in the operation of any processor or detector can be reported to the control power base processor that is currently being used and from there to a user interface 38 and to be therefore transported to the user by means of a visual or non-visual indicator. A non-visual indicator, an auditory warning or a sensitive one may be included by means of tactile forms, to cite two examples, without limitation - »* --- -, - - - t * fflf ^^ some. Other non-visual indication means for warning the user of a potential damage is the superposition of an intermittent pulse signal, either periodic or non-periodic, in the wheel drive amplifiers, thus creating an uneven movement of the vehicle which may be detected by the passenger. In the case of triple redundant sensors or processors, faults can be detected by comparing the data provided by each sensor with the data provided by the remaining pair of redundant sensors, thus creating an operational functionality to failures, where the vehicle can continue operating on the basis of the information provided by the remaining sensors, and that determined as defective (by the described comparison, or otherwise), until the vehicle can be established in a safety mode without endangering the occupant of the vehicle . In such case, the remaining sensors or processors may be required to agree with the limits prescribed for the operation and continue at a reduced level of functionality of the vehicle, and the operation may be terminated immediately in the event of a disagreement between the remaining sensors or processors. . A comparator is provided, using circuitry of electronic switches or software running at least one power base processor, as is known to those skilled in the art of electronics, to disable the connection to series driving circuits. 45, 58 and 60 of any errant processor or sensor. For example, in one mode of operation, the power amplifier controller t * ~ Ab, + (PAC) stores the results of the power base processor (PBP) A and PBP B. If the two results are the same, the PAC uses the result of PBP A, since both are correct. If the two results of PBP A and PBP B differ, the PAC will wait for a cycle until it is instructed on what needs to be done. PBP C will send a signal to the fault processor so that it immediately stops on its own in the second cycle, and in the third cycle, PAC will listen only from the working PBP and follow its command.

Critical safety components against failures In the case where a failure of a component can be tolerated for the duration of the time required to safely finish the operation of the vehicle, redundant components are used in duplicate. In the case that the sensors fall into this category, for example, a fault is detected in one of the sensors by comparing the outputs of the respective sensors. In the case where a discrepancy is detected, the operation of the vehicle can be safely completed, thus providing a safety function against faults. Fail-safe functionality is typically provided for each motor 51, for wheel amplifiers 46, 48 and 50, for gear amplifiers 52, and for power amplifier controllers 54 and 56, as well as for sensors that detect the force handle (used for control g ^. ^^ - • jJÉ ^ external vehicle), for the brakes, as well as for the installation of the seat in the module that makes contact with the ground. Faults are detected, in the case of non-redundant sensors, based on the characteristics of the sensor outputs that are unique to the sensor failure modes or by comparison with the expected performance. Non-redundant sensors may include, for example, seat height encoders.

Fault safety control lever 10 Referring now to Figure 3, a fail-safe control lever mechanism is shown and designated generally with the number 60; has a control lever that can be automatically centered 62. Since a standard potentiometer control lever can suffer faults that cause the device attached to the control lever sees a direction deviation or a "jamming" condition, the control lever mechanism 60 provides an independent means to detect when the control lever 62 is in a central position. A sensor 64, which, for example, can be a Hall effect sensor, detects when the pole of the control lever 66 is in its central position, in alignment with the sensor 64. The potentiometers 68 and 70 detect the position of the control lever 62 with respect to two orthogonal axes. In the event that a fault occurs in either the potentiometers 68 and 70, if the joystick 60 is released, it will return to the center, since & it is a control lever that can be centered automatically, and that will compromise the sensor 64, thus providing a signal to the system, dependent on the potentiometer system that has failed.

Contingent Operational Limits In addition to the detection of component failures as described above, other additional features of the controller may be provided, in accordance with alternative embodiments of the present invention, to provide safety to the vehicle occupant. In the various vehicle control modes, such as those described in the U.S.A. No. 5,701, 965 in the EUA patent application serial number 08 / 384,705, a moment of torque is applied to the appropriate group of gears or wheels in order to achieve the specified control objectives that are regulated by the user's access or by Internal control objectives such as vehicle balance. In the case where a vehicle wheel temporarily loses contact with the ground the rotation of the air-driven wheel is not a valid measure of the position of the vehicle with respect to the ground, and the effect of wheel rotation to regulate the application of the torque to which the wheel must be limited, effectively limiting the acceleration of the wheel under these circumstances. Additional bases to limit the speed include a reference to the remaining battery capacity or free height, in such a way that A sufficient reserve torque is always available to maintain the stability of the vehicle. Additionally, the speed of the vehicle can be limited to avoid an overload of the batteries in the descent where the inclination of the motors is used for the regeneration of power. Similarly, the dissipation requirements of a bypass regulator can be reduced by decreasing the maximum speed of the decreasing vehicle. Additionally, the speed of the vehicle can be limited based on the height of the seat in accordance with the lateral stability restrictions. In addition to the speed limitation, you can limit modes of vehicle operation based on fault data derived as described above. The described embodiments of the invention are intended to be merely exemplary and numerous variations and modifications may be made that will be apparent to those skilled in the art. All of these variations and modifications are intended to be included within the scope of the present invention as defined in the appended claims. ^ mr ^^^^^^^^ | ^^^ g ^^^ ¿^ ^^^^^^ j ^^ | ¡^ ¿^^^^^^

Claims (15)

NOVELTY OF THE INVENTION CLAIMS

1. - A vehicle for terrestrial locomotion, said vehicle comprises: a) a support structure to support a load; b) a contact module with the ground to provide the movement capacity to the support structure; c) a motorized transmission to allow the controllable movement of the contact module with the ground; d) a variety of control components coupled to the motorized transmission, each control component has an output; and e) a comparator to compare the output of each of the control components where the output of another of the control components is to identify a failure of any of the control components.

2. The vehicle according to claim 1, further characterized in that the diversity of control components is chosen from the group of: a) a variety of sensors for detecting at least one position and orientation of the vehicle; b) a variety of control channels, each control channel has the ability to independently control the motorized transmission.

3. The vehicle according to claim 1, further characterized in that the diversity of control components includes: a) a variety of control channels, each control channel has the ^ ¡^ ^ * É > css? '' faith? '' I? l? = - ^ aa ^ j ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^; and b) a variety of processors coupled to each of the control channels by means of a system driving circuit.

4. The vehicle according to claim 3, further comprising a disconnection circuit for removing a defective processor from the disconnection circuit of the system.

5. The vehicle according to claim 3, further characterized in that the disconnection circuit of the system couples the diversity of processors and at least one of the set of accesses of the user, a battery capacity indicator, a temperature indicator , a seat height controller and a shock protection controller.

6. The vehicle according to claim 1, further characterized in that the output of at least one control component is provided at a speed that exceeds the mechanical response speed of the motorized transmission.

7. A vehicle of locomotion land, said vehicle has the ability to detect faults, the vehicle comprises: a) a support structure to support a load; b) a contact module with the ground to provide the movement capacity to the support structure; c) a motorized transmission to allow the controllable movement of the contact module with the ground; d) a sensor for detecting at least one position and orientation of the vehicle; e) a variety of control channels, each , ^^^^^^^^^^^^^^^^^^^^^^^^^ ¿^^^^^ control channel has the ability to independently control the power transmission; and b) a variety of processors coupled to the control channels by means of a system driving circuit, each processor has an output, each processor has the ability to receive access instructions by the user, a sensor signal, and the output of each of the other processors; and g) a comparator to compare the outputs of the processors to identify a failure of any of the processors.

8. The vehicle according to claim 7, further characterized in that the comparator further includes a disconnection circuit for removing a defective processor from the disconnection circuit of the system.

9. The vehicle according to claim 7, further characterized in that the comparator suppresses the output of any processor for which a failure has been identified, so that allow continuous operation of the vehicle using all other processors.

10. A vehicle comprising: a) a support structure to support a load; b) a contact element with the ground to provide the movement capacity to the support structure, the floor contact element can be moved around an arrow with respect to a local axis; c) a motorized transmission to allow the controllable movement of the ground contact element around an arrow and to allow movement of the arrow so that the local axis moves with regarding the support structure; d) a sensor for detecting at least one position and orientation of the vehicle; e) a variety of control channels, each control channel having the ability to independently control the motorized transmission; and b) a variety of processors coupled to the control channels by means of a system driving circuit, each processor has an output, each processor has the ability to receive access instructions by the user, a sensor signal, and the output of each of the other processors; and g) a comparator to compare the outputs of the processors to each other to identify a failure of any of the processors.

11. The vehicle comprising: a) a support structure to support a load; b) a contact element with the ground to provide the movement capacity to the support structure, the floor contact element can be moved around an arrow with respect to a local axis; c) a motorized transmission including a plurality of redundant electric motor windings, to allow controllable movement of the floor contact element that can be moved around the arrow so that the local axis moves with respect to the support structure .

12. The vehicle comprising: a) at least one contact element with the ground to cause the movement of the vehicle on the surface of the ground; b) a motorized transmission to allow the controllable movement of at least one element in contact with the ground, the aUM controllable movement characterized yor A set of movement instructions; c) a variety of sensors to detect configuration variables and vehicle movement variables and generate sensor signals; d) a user access to receive instructions from the user to control the movement of the vehicle; e) a variety of power amplifier controllers, each power amplifier controller having the ability to control the complete set of controllable motion instructions; f) a variety of processors, each processor has the ability to receive sensor signals at least from A subset of the sensor diversity and the user access and the signal sending processor instruct each power amplifier controller to control the movement of the vehicle in accordance with a system control law; and g) a disposition of decisions to decide which of the diversity of processors should regulate in the case that the instructions 15 of the processor in discrepancy are sent to a power amplifier controller.

13. The vehicle according to claim 12, which further includes a disconnection circuit to remove a defective processor from the system driving circuit. 0 14.- A safety control lever against failures, comprising: a) a centering mechanism that restores the control lever to a central position when it is released by a user; and b) a sensor for detecting the control lever in the central position.

15. - A method for controlling the locomotion of a vehicle, the method comprising: a) providing a variety of control channels, each control channel having the ability to independently control a motorized transmission that drives the vehicle; b) provide a diversity of processors, each processor supplies an output to each of the control channels by means of a system driving circuit; c) compare the outputs of the processors; d) identify any defective processor; and e) controlling the vehicle based on the outputs of the processors other than the identified defective processor. '^^^^^^^^ i ^^^^^^^^^^^^^^^^^^