Fail-safe mechanism having a driver circuit for controlling driving of an electrical system of a vehicle

• US 6,498,403 B1
• Filed: 09/01/2000
• Issued: 12/24/2002
• Est. Priority Date: 09/03/1999
• Status: Expired due to Fees

• Current Assignee: Kayaba Industry Company Limited, HINO Motors Limited (Toyota Motor Corporation)
• Original Assignee: Kayaba Industry Company Limited, HINO Motors Limited (Toyota Motor Corporation)
• Inventors: Sasaki, Kazuhiro, Hagidaira, Shinichi, Amano, Norimasa
• Primary Examiner(s): Jackson, Stephen W.
• Assistant Examiner(s): POLK, SHARON A
• Application Number:
  US09/654,552
• Time in Patent Office: 844 Days
• Field of Search: 307/9.1, 307/10.1, 303/122, 303/122-2-1, 123/339.14, 123/339.15, 123/339.19
• US Class Current: 307/9.1
• CPC Class Codes: B62D 5/0484 for reaction to failures, e.g. limp home
• CPC Class Codes: B62D 5/0493 detecting processor errors, e.g. plausibility of steering direction

Abstract

The invention relates to a device that interrupts electric power to a driving circuit when a system failure is detected. A fail-safe mechanism is provided with a main switch circuit connected between a driving power source and a driver circuit; a sub switch circuit connected between the driving power source and the main switch circuit, and maintaining an OFF state in normal times; a timer circuit allowing the sub switch circuit for a predetermined time period after the driving power source is turned on; a failure detector circuit connected between the main switch circuit and a controller; and a sub switch control means bringing the sub switch circuit to an OFF state when the feeding of electric current is cut off. The main switch circuit is turned OFF when the failure detector circuit detects an abnormal condition of the controller.

Claims

1. A fail-safe mechanism comprising:

a driver circuit for controlling driving of an electrical system of a vehicle;

a controller controlling said driver circuit in accordance with a control program;

a driving power source feeding electric current to said driver circuit;

a main switch circuit connected between said driving power source and said driver circuit;

a sub switch circuit connected between said driving power source and said main switch circuit to control the ON/OFF switching of power source applied from said driving power source to said main switch circuit, and maintaining an OFF state in normal times;

a timer circuit allowing said sub switch circuit to be fed with electric current for a predetermined time period after said driving power source is turned on;

a failure detector circuit connected between said main switch circuit and said controller; and

a sub switch control means provided in shunt with said driver circuit downstream from said main switch circuit, and bringing the sub switch circuit to an ON state due to the feeding of electric current to said driver circuit, and the sub switch circuit to an OFF state when the feeding of electric current to said driver circuit is cut off,

when the failure detector circuit detects an abnormal condition of the controller, said main switch circuit being turned OFF to interrupt the electric current passing from said driving power source to said driver circuit; and

wherein said sub switch circuit includes a first switch and a second switch connected in parallel, said first switch being controlled by said timer circuit, said second switch being controlled by said sub switch control means.

2. A fail-safe mechanism comprising:

a driver circuit for controlling driving of an electrical system of a vehicle;

a controller controlling said driver circuit in accordance with a control program;

a driving power source feeding electric current to said driver circuit;

a main switch circuit connected between said driving power source and said driver circuit;

a sub switch circuit connected between said driving power source and said main switch circuit to control the ON/OFF switching of power source applied from said driving power source to said main switch circuit, and maintaining an OFF state in normal times;

a timer circuit allowing said sub switch circuit to be fed with electric current for a predetermined time period after said driving power source is turned on;

a failure detector circuit connected between said main switch circuit and said controller; and

a sub switch control means provided in shunt with said driver circuit downstream from said main switch circuit, and bringing the sub switch circuit to an ON state due to the feeding of electric current to said driver circuit, and the sub switch circuit to an OFF state when the feeding of electric current to said driver circuit is cut off;

when the failure detector circuit detects an abnormal condition of the controller, said main switch circuit being turned OFF to interrupt the electric current passing from said driving power source to said driver circuit; and

wherein said failure detector circuit includes a plurality of watchdog timers and an AND circuit, each of said watchdog timers receiving a failure detection signal outputting from each control program, said AND circuit receiving and output signal from said each watchdog timer and sending the output signal to said main switch circuit.

3. A fail-safe mechanism comprising:

a first and a second control systems controlling driving of an electrical system of a vehicle, and each of said first and second control systems includes a driver circuit connected with the electrical system of the vehicle;

a CPU controlling said driver circuit;

a driving power source feeding electric current to said driver circuit;

a switch circuit connected between said driving power source and said driver circuit;

a CPU failure-detecting feature connected between said switch circuit and said driver circuit and detecting an abnormal condition of said CPU from an output signal sent from said CPU, wherein when said CPU of one said first and second control system outputs a failure signal during the operation of said one control system, said CPU failure-detecting feature of said one control system outputs an instruction for turning off to said switch circuit of said one control system, and said one control system sends a signal, representing the stopping of the feeding of electric current to said driver circuit, to said CPU of the other control system to allow said other control receiving the signal to start the driving-control; and

wherein said CPU failure-detecting feature includes a plurality of watchdog timers and an AND circuit, each of said watchdog timers receiving a failure detection signal outputting from each control program in said CPU, said AND circuit receiving an output signal from said each watchdog timer and sending the output signal to said switch circuit.