The invention relates to a closed loop control system for a vehicle speed control. This takes the form of a position control of the butterfly for a petrol engine or the fuelling control lever of a diesel engine. The control loop may be operated by any convenient form of power source which may be electrical, hydraulic or pneumatic. It is a well recognised problem that faulty operation of the automatic control may result in a speed demand higher than the driver's intention, and this would be unsafe. Many such systems incoporate extra position switches either at the threshold of opening or at the fully open position, whose state is monitored to give an indication of incorrect operation, but sometimes these can only detect gross errors. The object of the present invention is to utilise the signals already present in a closed loop system to give an indication of faulty operation, either by itself to provide a simpler system, or in combination with limit switches to give an enhanced sensitivity. The signal signifying a fault may be used in various ways; for example, to activate a warning indicator or

to disable the engine to prevent unwanted acceleration.

The system may use an electric motor and potentiometric input and feedback transducers. The control system may be an analogue circuit or a microprocessor and faulty operation may be detected by an analogue safety unit. The present invention provides a closed loop fuel supply control .system for a vehicle. The system comprising a variable fuel supply, a fuel supply actuator, a fuel demand means, a fuel supply sensor for producing a supply signal variable with the state of the fuel supply, a fuel demand sensor for producing a demand .signal to variable with the state of the fuel demand means, a control unit including a comparator means for comparing the supply signal and the demand signal to produce an error signal for operating the fuel supply actuator, and a safety unit including a timer for determining when the error signal has exceeded a predetermined value for more than a predetermined time period, the safety unit producing an emergency signal if the error signal exceeds said predetermined value for more than a predetermined time period.

Preferred embodiment of the present invention will now be described by way of example only with reference to the accompanying drawings in which:

Fig 1 shows a closed loop control system according to a first embodiment of the invention;

Fig 2 shows a simple analogue circuit for monitoring the error in the embodiment of Fig 1;

Fig 3 shows a more advanced circuit for monitoring the error according to a second embodiment of the invention; and

Fig 4 shows in block diagram form an algorithm for implementation in a micro-processor controller for monitoring the error according to a third embodiment of the invention.

Referring to Fig 1 , fuel demand means comprising a foot pedal 2 is monitored by a fuel demand sensor comprising a potentiometer 4 which produces a demand signal on line 6 proportional to the state of depression of the pedal 2. A variable fuel supply comprising a throttle

valve 8 is monitored by fuel supply sensor comprising a potentiometer 10, which produces a supply signal on line 12 proportional to the opening of the throttle valve 8. The throttle valve 8 is biased towards a closed position. A fuel supply actuator comprising an electric motor l8 is arranged to open and close the throttle valve 8. A control unit 14 includes a comparator 15 which compares the signals on lines 6 and 12 and produces an error signal on line 17• The error signal equals the supply signal minus the demand signal and can be positive or negative. The throttle motor l8 receives an output signal from the control unit 14 on line 16 and operates to open the throttle if the error signal is negative and to close the throttle if the error signal is positive.

Referring to Fig 2, a safety circuit or safety unit housed in control unit 14 s also connected to lines 6 and 12. The safety circuit comprises a difference amplifier 38 a window comparator circuit 40, a timer circuit 50 and a atching circuit 60. The difference amplifier 38 has as input the demand signal and the supply signal and produces an error safety signal Ver

proportional to the difference between the demand signal and the supply signal.

The window comparator circuit 40 comprises comparators 42 and 44 having their outputs connected to the outputs of diodes 46 and 48 respectively. The output of the difference amplifier is connected to the positive signal of comparator 4 and the negative input of comparator 44. A chain of resistors Rl R2 and R3 is connected between a 5 volt supply and a 0 volt supply. The negative input of comparator 42 is connected between Rl and R2 and the positive input of comparator 44 i connected between R2 and R3. Another chain of resistors R4, R5 and R6 is connected between the 5 volt supply and the 0 volt supply and the input to the diodes 46, 48 is connected via line 41 between R5 and R6. If the error safety signal Ver exceeds a maximum error offset magnitude, either positive or negative, as set by the resistor chain Rl , R2, R3 the voltage on line 41 goes low. The significant error may be between 5 and 20% of full travel of the pedal 2.

The timing circuit 50 comprises a transistor 5 having a first output connected to 0 volt supply and a second

output connected via resistor R7 to the 5 volt supply. The second output is also connected via capacitor Cl to the 0 volt supply and to line 58 which is fed to the latch circuit 6θ. ^: output from the timing circuit goes high if the signal on line 41 is low for longer than 400 ms, ie if the error safety signal Ver exceeds the maximum error for that time.

The latching circuit comprises a comparator 62 having its negative input connected to the timer 50 via line 58 and its positive input connected via resistor R8 to the 0 volt supply and via capacitor C2 to the 5 volt supply.

A third resistor chain R9, R10, Rll, R12 is connected between the 5 volt and 0 volt supplies, and the positive input to comparator 62 is connected by line 63 between Rll and R12. The output from comparator 62 is connected via line 64 between R10 and Rll, and the control unit output line 70 is connected between R9 and R10.

When the signal on line 58 goes high because the error

signal Ver has exceeded a predetermined value for a predetermined time period the signal on line 70 is latched low by the latching circuit 60. The signal on line 70 is then input to an alarm 80 which produces an audible and visible alarm when the signal on line 70 goes low. Line 70 can only be reset by switching off the ignition supply.

In the embodiment shown in Fig 3 _> difference amplifier 138 and window comparator 140 correspond to the embodiment of Fig 2. The output on line 141 is fed to an inverting amplifier 182 whose output on line 151 is fed to a monostable multivibrator 184 and to a first input 153 of a latching flip flop 186. The monostable multivibrator 184 has its output connected to an AND gate 188, the ouput of which is fed to a second input 154 of the flip-flop 186. One output Ql from the flip-flop l86 is fed to a .second input of the AND gate l88 and the other output 02 is fed to an alarm (not shown). When the output.from the amplifier 182 goes high it initiates a square wave signal of period, typically 400 ms, from the multivibrator 184, the square wave beginning with a positive pulse. This pulse is passed through the AND gate l88 to the input

114 of the flip-flop 186. The direct input from amplifier 182 is a gate and only if the output from the amplifier 182 is still high at the positive step at the end of the first negative pulse from the multivibrator 184 will the flip-flop be caused to switch. This will cause the voltage on output Q2 to go high and signal the fault condition to any other circuit. The output l will go low and prevent any other signal passing the AND gate 188, thus latching the system until it is cleared by switching off the supply as in the embodiment shown in figure 2.

Referring to Fig 4 in the third embodiment of the invention the control unit and safety unit are in the form of a microprocessor. Fig 4 shows a section of the program flow diagram which deals with a safety cut-out.

At step 1 the error is calculated as the difference between the demand signal and the supply signal. At step 2 the error is compared with a set r-aximum error. If the error exceeds the set maximum, the program proceeds to step 3 where the error timer is examined. If the error timer is not currently running it is started at step 4- If it is running it i.s allowed to

proceed. If the error is less than the set maximum, the program proceeds to step 5 where the error timer is reset. At step 6 the error timer is examined. If the timer has reached a preset time, an emergency signal is produced which is used to shut down the control systems to a safe state, for example by cutting off power to the actuator so that the throttle closes.

In an alternative embodiment the emergency signal is used to activate a separate solenoid valve to shut off the fuel supply to the engine.

In yet another embodiment for a petrol engine the emergency signal is used to close down the spark ignition system for the engine.