Fault tolerant architecture for a personal vehicle

A motorized vehicle capable of fault detection and of operation after a fault has been detected. The vehicle has a plurality of control components coupled to a motorized drive and a comparator for comparing the output of each of the control components with outputs of other control components so that failures may be identified. The vehicle may have multiple processors coupled to a plurality of control channels by means of a bus and a decision arrangement that suppresses the output of any processor for which a failure has been identified.

TECHNICAL FIELD
 The present invention pertains to system architecture for a powered
 vehicle, and more particularly to redundant features of system
 architecture.
 BACKGROUND OF THE INVENTION
 Personal vehicles, such as those used by handicapped persons, for one
 example, may be self-propelled and user-guidable, and, further, may entail
 stabilization in one or more of the fore-aft or left-right planes, such as
 when no more than two wheels are in ground contact at a time. More
 particularly, such a vehicle is depicted in FIG. 1 where it is designated
 generally by numeral 10. Vehicle 10 for transporting subject 12 or other
 payload, may include one or more wheels 16 or clusters 14 of wheels 16,
 with each wheels and/or clusters being motor-driven, in coordination or
 independently. Such vehicles are among those described in U.S. Pat. No.
 5,701,965 and in U.S. Pat. No. 5,971,091 which are each incorporated
 herein by reference. Vehicles of this sort may be more efficiently and
 safely operated when they employ system architectural features
 supplementary to those described in the prior art.
 SUMMARY OF THE INVENTION
 In accordance with a preferred embodiment of the present invention, there
 is provided a vehicle for locomotion over land capable of failure
 detection. The vehicle has a support structure for supporting a load, a
 ground-contacting module for providing locomotion capability to the
 support structure, and a motorized drive arrangement form permitting
 controllable motion of the ground contacting element. Additionally, the
 vehicle has a plurality of control components, each control component
 having an output, and a comparator for comparing the output of a first
 control component with the output of another of the control components for
 identifying a failure of either the first or the other control components.
 The control components may include a sensor for sensing at least one of a
 position and an orientation of the vehicle, a plurality of redundant
 control channels, each control channel capable of independently
 controlling the motorized drive arrangement, or a plurality of processors
 coupled to each of the redundant control channels by means of a system
 bus. Each processor has an output and each processor is capable of
 receiving input commands from a user, a signal from the sensor, and the
 output of each of the other processors.
 In accordance with alternate embodiments of the invention, the control
 components may be chosen from among a plurality of sensors for sensing
 position or orientation of the vehicle and a plurality of control
 channels, each control channel capable of independently controlling the
 motorized drive. The control components may also include a plurality of
 processors coupled to the control channels by means of a system bus, and
 the system bus may couple the plurality of processors and at least one of
 the set of the user input, a battery capacity indicator, a temperature
 indicator, a seat height controller, and a crash protection controller.
 The output of any of the control components may be provided at a rate
 exceeding a mechanical response rate of the motorized drive. Each
 processor may be capable of receiving input commands from a user, a signal
 from the sensor, and the output of each of the other processors, and the
 comparator may compare the outputs of the processors for identifying a
 failure of any of the processors, it may also include a disconnect circuit
 for removing a defective processor from the system bus, and it may
 suppress the output of any processor for which a failure has been
 identified in such a manner as to allow continued operation of the vehicle
 using all other processors.
 In accordance with yet further embodiments of the invention, there is
 provided a vehicle having a support structure for supporting a load and a
 ground-contacting element for providing locomotion capability to the
 support structure, the ground contacting element movable about an axle
 with respect to a local axis, and a motorized drive for permitting
 controllable motion of the ground contacting element about the axle and
 for permitting motion of the axle such that the local axis is moved with
 respect to the support structure. A sensor is provided for sensing at
 least one of a position and an orientation of the vehicle, as are a
 plurality of control channels, each control channel capable of
 independently controlling the motorized drive. The vehicle has a plurality
 of processors coupled to the control channels by means of a system bus,
 each processor having an output, each processor capable of receiving input
 commands from a user, a signal from the sensor, and the output of each of
 the other processors, and a comparator for intercomparing the output of
 the processors for identifying a failure of any of the processors. The
 vehicle may have a motorized drive having a plurality of redundant
 windings.
 In accordance with another embodiment of the invention, there is provided a
 fail-safe joystick. The joystick has a centering mechanism that restores
 the joystick to a center position when released by a user and a sensor for
 detecting the joystick in the center position.

DETAILED DESCRIPTION OF SPECIFIC EMBODIMENTS
 Referring to FIG. 1, the fundamental parts of vehicle 10 may be considered,
 without limitation, to include a support 18 for supporting subject 12, a
 ground-contacting module 20 for transporting support 18, one or more
 actuator mechanisms (not shown) for driving wheels 16 and/or clusters 14,
 and one or more controllers for governing the actuator mechanisms in
 accordance with desired parameters input by a user and the physical
 position, and configuration of vehicle 10 as well as the measured time
 rates of change of the position and configuration of the vehicle. The
 physical position and/or configuration of the vehicle are monitored, on a
 continuous or periodic basis, by a set of sensors (not shown), the outputs
 of which are used by the one or more controllers. As an example, sensors
 providing displacement and tilt information allow the controller to
 calculate the torque to be applied to the wheels or clusters of a vehicle,
 in accordance with specified control laws and as described in U.S. Pat.
 No. 5,701,965 and U.S. Pat. No. 5,971,091.
 By way of clarification, the term "ground," as used in the expression
 "ground-contacting module 20" or in other references to the surface over
 which vehicle 10 locomotes, may be any surface, interior or exterior to
 enclosed buildings, which may be traversed by vehicle 10. The term
 "personal transporter" is used herein interchangeably with the term
 "vehicle." Additionally, the term "wheels" may equivalently encompass
 arcuate elements or other ground-contacting members capable of propelling
 vehicle 10 across the ground. The "position" of the vehicle is referred to
 some fiducial point fixed with respect to the ground, whereas
 "configuration" refers to the disposition of components of the vehicle
 with respect to one another and includes, without limitation, such
 attributes as seat height, frame lean, etc., as well as settings made in
 software, such as specified speed, acceleration, joystick sensitivity,
 etc. In particular, in accordance with a preferred embodiment of the
 invention, wheels 16 rotate about axles 22 which may themselves be rotated
 about a cluster axle 24 which constitutes the axis of cluster rotation.
 Support 18 may, in turn, be raised or lowered with respect to cluster 14.
 Other internal degrees of freedom which may be present in vehicle 10 are
 similarly encompassed within the scope of the term "configuration" as used
 herein and in any appended claims. Similarly, the angular orientation, or
 tilt, of vehicle 10 with respect to gravity is also encompassed within the
 scope of the term "configuration."
 User input may be provided by the subject transported by the vehicle, as by
 means of joystick or other interface, or by the user leaning, or by
 applying hand forces on external objects. Additionally, user input may be
 provided by an assistant not carried by the vehicle, who may command the
 motion and/or configuration of the vehicle by applying forces, as to an
 assist handle, for inducing the vehicle to lean. Alternatively, user input
 may be provided by an assistant by means of a control module that may be
 detached from the vehicle, where the control module contains a joystick,
 switch, or keypad inputs, or in any other way. "Sensor" refers to any
 device for monitoring any characteristic of the physical position or
 configuration of the vehicle and may include, for example, an inclinometer
 for measuring tilt, gyroscopes, encoders for measuring the angular
 orientation or its rate of change for any of the wheels or clusters, etc.
 Safe operation of a vehicle after certain types of failures may require
 fault tolerance of one or more of the fundamental vehicle parts listed
 above. As used in this description and in any appended claims,
 "redundancy" refers to the replication of certain components for
 contributing to fault tolerance of the vehicle. "Redundancy" also refers
 to oversampling of data. Thus, for example, data may be provided by
 sensors at a rate substantially higher than the mechanical response rate
 of the system. In this case, if a datum is corrupted on the system bus or
 elsewhere, it will not effect the system response since a new datum will
 be provided before the response must be provided. In a preferred
 embodiment of the invention, certain fundamental vehicle parts are
 electronically interconnected in a system architecture such as the one
 shown, as an example, in the block diagram of FIG. 2, as now described.
 The combination of sensor electronics 34 and control processors 24, 26, and
 28, along with their respective power sources 30, may be referred to
 collectively as a power base 32. Power base 32 contains a multiplicity of
 power base processors 36, each including sensor electronics 34, a central
 processing unit (CPU) 24, 26, and 28 and a power source 30. Each CPU 28
 has an associated power source 30 and sensor electronics board 34.
 Power base 32 is electronically coupled to an interface 38 for receiving
 user input, as well as to other controllers for controlling peripheral or
 extraordinary functions of the vehicle. Other controllers and peripheral
 devices coupled to power base 32 may include, without limitation, a seat
 height controller 40, as well as a crash protection controller 42 and a
 crash protection monitor 44, and battery chargers and monitors (not
 shown). Crash protection controller 42 may provide such functions as the
 deployment of one or more air bags, as described in pending U.S.
 provisional application 60/064,175, filed Nov. 4, 1997, or, alternatively,
 the separation of support 18 (shown in FIG. 1) from ground-contacting
 module 20 as described in pending U.S. provisional application 60/061,974,
 filed Oct. 14, 1997. Communication among user interface 38, peripheral
 controllers 40 and 42, and each of power base processors 24, 26, and 28 of
 power base 32 is via system serial bus 45, which, in a preferred
 embodiment, is an asynchronous channel having a capacity of 250 kBaud and
 employing a time division multiple access (TDMA) protocol.
 Actuators for rotating wheels 16 and cluster 14 (shown in FIG. 1) are
 typically motors, such as left-wheel motor 51, and, in a preferred
 embodiment, the actuators are servo motors. The actuator 51 for the left
 wheel may be driven by either of redundant left wheel amplifiers 46 and
 48, and, similarly, either right wheel amplifier 50 will drive the
 actuator for the right wheel, and either cluster amplifier 52 will drive
 the actuator for the cluster. In a preferred embodiment of the invention,
 load-sharing power channels are provided whereby both left wheel
 amplifiers 46 and 48 are required for full performance of left wheel motor
 51, however, each left wheel amplifier is capable of providing limited
 performance for a short period of time, in order to allow the vehicle to
 come to rest in safety. Power channels may also be referred to herein, and
 in any appended claims, as "control channels." Additional redundancy may
 be provided in each motor 51, with half the windings of each motor
 providing sufficient torque for operation of the vehicle. Each redundant
 full set of amplifiers 46, 50, and 52, is controlled by one of power
 amplifier controllers 54 and 56. In particular, it is advantageous to
 provide all current to the servo motors via wheel amplifiers 46 and 48 so
 that no high-current series elements are required between the battery and
 the motor. Communication among redundant power base processors 24, 26, and
 28 and power amplifier controller 54 is via power base serial bus 58
 while, so as to provide full redundancy, communication among redundant
 power processors 24, 26, and 28 and power amplifier controller 56 is via a
 second power base serial bus 60.
 As can be appreciated in light of the above system description in reference
 to FIG. 2, the control architecture associated with the vehicle may be
 highly redundant, with differing degrees of redundancy attaching to the
 various components of the system.
 Several issues must be addressed in view of the redundancy described above.
 One issue is the assignment of control and decision making when redundant
 components are concurrently present and active.
 Control of Serial Bus
 In accordance with the preferred TDMA protocol discussed above, each device
 on serial bus 45 has an allocated time slot to transfer or broadcast a
 predefined data set All devices on serial bus 45 are programmed to respond
 or listen to specific senders of data based on software configurable
 control registers. Serial bus 45 is controlled by a processor referred to
 as the Serial Bus Master, for example, a specified one of power base
 processors 24, 26, and 28 which may correspond, additionally, to a
 designated "Master Power Base Processor," designated herein, for purposes
 of example, as processor 24. The Serial Bus Master controls a master sync
 packet and bus error data collection. In the event of a Master Power Base
 Processor interface fault, a "Secondary Power Base Master," determined as
 described below, assumes the System Serial Bus Mastership.
 Fail-Operate Critical Components
 In cases where the operation of a component is essential in order to bring
 the vehicle into a safe mode without endangering the occupant of the
 vehicle, fault-tolerant triple redundancy is employed, in accordance with
 a preferred embodiment of the invention, in order to create a
 fail-operative functionality. One example of a fail-operative critical
 component is the power base processor, of which three are provided and
 designated as power base processors 24, 26, and 28 in FIG. 2. Each of
 power base processors 24, 26, and 28 is also associated with a specified
 set of critical sensors from which reliable output is required in order to
 assure critical functionality of the vehicle, including, without
 limitation, balance of the vehicle, battery condition, etc. It follows
 that a single-point failure of any processor or sensor should be
 detectable. Additionally, in accordance with an embodiment of the
 invention, the detection of a fault in the operation of any processor or
 detector may be reported to the currently controlling power base processor
 and from there to user interface 38 and thereby conveyed to the user by
 means of a visual or non-visual indicator. A non-visual indicator may
 include an audible warning or one sensible by tactile means, to cite two
 examples, without limitation. Another means of non-visual indication for
 warning the user of a potential hazard is the superposition of an
 intermittent drive signal, either periodic or aperiodic, on the
 wheel-driving amplifiers, thereby creating uneven motion of the vehicle
 that may be sensed by the passenger.
 In the case of triple redundant sensors or processors, failures may be
 detected by comparison of the data provided by each sensor to the data
 provided by the remaining pair of redundant sensors, thereby creating a
 fail-operative functionality, wherein the vehicle may continue to operate
 on the basis of the information provided by the remaining sensors, if one
 is determined to be defective (by the described comparison, or otherwise),
 until the vehicle may brought to a safe mode without endangering the
 occupant of the vehicle. In such a case, the remaining sensors or
 processors may be required to agree to within prescribed limits in order
 for operation to continue at a reduced level of vehicle functionality, and
 operation may be immediately terminated in case of disagreement between
 the remaining sensors or processors. A comparator is provided, using
 electronic switch circuitry or software running on at least one power base
 processor, as known to persons skilled in the electronic arts, to disable
 the connection to serial buses 45, 58, and 60 of any errant processor or
 sensor. For example, in one mode of operation, the power amplifier
 controller () stores the results from power base processor (PBP) A and
 from PBP B. If the two results are the same, the uses the result from
 PBP A, since both are correct. If the two results of PBP A and PBP B
 differ, the will wait a cycle until directed what to do. PBP C will
 send a signal to the faulted processor to shut itself down in the second
 cycle, and, in the third cycle, will hear only from the working PBP
 and will follow its command.
 Fail-Safe Critical Components
 In the case where failure of a component may be tolerated for the duration
 of time required to safely terminate vehicle operation, doubly redundant
 components are employed. In the case of sensors falling into this
 category, for example, a failure of one of the sensors is detected by
 comparing the outputs of the respective sensors. In the case in which a
 discrepancy is detected, operation of the vehicle may be terminated
 safely, thereby providing a fail-safe functionality. Fail-safe
 functionality is typically provided for each motor 51, wheel amplifiers
 46, 48, and 50, cluster amplifiers 52, and power amplifier controllers 54
 and 56, as well as sensors monitoring a force handle (used for external
 control of the vehicle), brakes, and seat installation in the
 ground-contacting module.
 Failures are detected, in the case of non-redundant sensors, on the basis
 of characteristics of sensor outputs which are unique to sensor failure
 modes or by comparison to expected performance. Non-redundant sensors may
 include, for example, seat height encoders.
 Fail-safe Joystick
 Referring now to FIG. 3, a fail-safe joystick mechanism is shown and
 designated generally by numeral 60, having a self-centering joystick 62.
 Whereas a standard potentiometer joystick may suffer faults causing the
 device attached to the joystick to see a drift or "hard-over" condition,
 joystick mechanism 60 provides an independent means of detecting when
 joystick 62 is in a center position. A sensor 64, which may, for example,
 be a Hall-effect sensor, senses when joystick post 66 is in the center
 position, in alignment with sensor 64. Potentiometers 68 and 70 sense the
 position of joystick 62 with respect to two orthogonal axes. In case a
 failure occurs in either of potentiometers 68 and 70, if joystick 60 is
 released, it will return to the center, since it is a self-centering
 joystick, and will engage sensor 64, thereby providing a signal to the
 system, independent of the failed potentiometer system.
 Contingent Operational Limits
 In addition to the detection of component failures as discussed above,
 additional controller features may be provided, in accordance with
 alternate embodiments of the present invention, to provide for the safety
 of the occupant of the vehicle. In the various modes of vehicle control
 such as those described in U.S. Pat. No. 5,701,965 and U.S. Pat. No.
 5,971,091, torque is applied to the appropriate set of clusters or wheels
 in order to achieve specified control objectives governed by user input or
 internal control objectives such as vehicle balance. In a case in which a
 wheel of the vehicle temporarily loses contact with the ground, the
 rotation of the airborne wheel is not a valid measure of vehicle position
 with respect to the ground, and the effect of the rotation of the wheel in
 governing the application of torque to the wheel must be limited,
 effectively limiting acceleration of the wheel under these circumstances.
 Additional bases for speed limiting include a reference to the remaining
 battery capacity or headroom, such that sufficient reserve torque is
 always available to maintain vehicle stability. Furthermore, the speed of
 the vehicle may be limited to prevent overcharging of batteries on descent
 down an incline if the motors are used for power regeneration. Similarly,
 the dissipation requirements of a shunt regulator may be reduced by
 reducing the maximum speed of the vehicle on descent. Additionally, the
 vehicle speed may be limited on the basis of seat height in accordance
 with lateral stability constraints. In addition to speed limiting, modes
 of operation of the vehicle may be limited on the basis of fault data
 derived as described above.
 The described embodiments of the invention are intended to be merely
 exemplary and numerous variations and modifications will be apparent to
 those skilled in the art. All such variations and modifications are
 intended to be within the scope of the present invention as defined in the
 appended claims.