2. Description of the Prior Art Brake by wire and drive by wire systems are known in the prior art whereby one can control the steering and braking functions of a vehicle using a control device, such as a steering wheel and brake pedal or joystick. Typically, these systems have more than one communication channel for communicating signals from the control device to the steering and braking motors such that, when that communication channel experiences an error, the entire system is not inoperable.

Control systems with redundant communications networks are typically accomplished using two different families of device controllers, wherein each family of device controllers operates independently on two separate networks. These redundant systems require a significant amount of hardware, which are difficult and expensive to package in a vehicle with a drive by wire or brake by wire system.

It is desirable to provide redundancy in a brake by wire or drive by wire system.

SUMMARY OF THE INVENTION AND ADVANTAGES The invention provides a safety redundant drive by wire system comprising a plurality of brake motors disposed in corners of a vehicle to which control signals may be communicated. A plurality of sensors are disposed in the system, such that at least one sensor is coupled to the brake motor for sensing a parameter of the brake motor and responsively generating a sensor signal. A device controller is disposed in the corners of the vehicle and adapted to deliver control signals to a respective brake motor. Each of the device controllers includes a first and second microprocessor for communicating control signals to the brake motor associated with that device controller, all other device controllers and each other. Each device controller is adapted to receive the sensor signal and provide it to the first and second microprocessors.

The control signals are communicated over a dual redundant communication channel system having a first communication channel for communicating control signals from one device controller to all other device controllers, and a second communication channel for redundantly communicating control signals between device controllers. The first and second microprocessors control the first and second communication channels, respectively.

A plurality of hardware configurations which may be used independently or together in some combination to achieve redundant drive by wire and brake by wire systems. Accordingly, the first and second microprocessors on a device controller control the first and second communication channels, respectively, providing a redundant drive by wire and brake by wire system with minimal hardware.

BRIEF DESCRIPTION OF THE DRAWINGS

Other advantages of the present invention will be readily appreciated as the same becomes better understood by reference to the following detailed description when considered in connection with the accompanying drawings wherein: Figure 1 is a block diagram of a system configuration wherein the first microprocessor of each device controller controls a first control member and the second microprocessor of each device controller provides redundant communications; Figure 2 is a block diagram of a system configuration wherein the first microprocessor of each device controller controls a first control member and provides redundant communications, and the second microprocessor of each device controller controls a second control member and provides redundant communications; and Figure 3 is a block diagram of a system configuration wherein the first microprocessor of two different device controllers control a first control member, and the second microprocessor of each device controller provides redundant communications.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT Referring to Figures 1 through 3, wherein like numerals indicate like or corresponding parts throughout the several views, a safety redundant drive by wire system is generally shown at 10. In a first embodiment, a plurality of first control members 12, such as brake motors, to which control signals may be communicated, are disposed in a vehicle 30, one at each wheel. A plurality of sensors 14 are disposed within the vehicle 30, wherein at least one of the sensors 14 is coupled to each of the first control members 12 for sensing a parameter of the first control member 12 and responsively

generating a sensor signal. A plurality of device controllers 16, are disposed in the vehicle 30, one at each wheel and paired with a brake motor 12, wherein each device controller 16 is adapted to deliver control signals to its respective first control member 12.

Each device controller 16 includes a first microprocessor 18, for communicating control signals to the first control member 12, thus, providing functionality to the brake motor 12, and all other device controllers 16. Each device controller 16 further includes a second microprocessor 20 for redundantly communicating control signals to all other device controllers 16 and for communicating with the first microprocessor 18. Each device controller 16 is adapted to receive sensor signals and provide these sensor signals to the first and second microprocessors 18,20. If a device controller 16 detects an error, the first microprocessor 18 discontinues controlling the control member 12 and the second microprocessor 20 communicates a default control signal to all other device controllers 16.

The system of the subject invention further includes a dual redundant communication channel system using a time deterministic protocol, such as the Time Triggered Protocol (TTP). The dual redundant communication channel has a first communication channel 24, for communicating control signals from one device controller 16 to all other device controllers 16, and a second communication channel 26, for redundantly communicating control signals from one device controller 16 to all other device controllers 16. The first microprocessor 18 of each device controller 16 controls the first communication channel 24, and the second microprocessor 20 of each device controller 16 controls the second communication channel 26. The first 18 and second 20 microprocessors are synchronized.

In one embodiment, the first microprocessor 18 and the second microprocessor 20 are not of identical type. For example, the first microprocessor 18 is an MPC555 microprocessor and the second microprocessor 20 is an HC12 microprocessor. Two different microprocessors ensure that identical code is not executed between the control microprocessors 18.

In the drive by wire or brake by wire systems of the present invention, the signal inputs are generated by a driver operated source such as steering wheel and brake pedal and/or a joystick. The device controllers 16 receive the signal input, generate control signals and communicate these control signals to the control members 12 associated with the particular device controller 16.

In a second embodiment of the subject invention, as shown in Figure 3, two device controllers 16 are adapted to deliver different control signals to one first control member 12, more particularly, a dual wound motor disposed at each front wheel of a vehicle. Each device controller 16 operates independently, such that if one device controller 16 with associated control members 12 fails, the second device controller 16 can provide some limited control level. In this configuration, one front and one rear brake are controlled by the same device controller. This embodiment further includes a master microprocessor for controlling the braking functions for the dual wound motor controller and a brush motor controller, such that two or more microprocessors are present in the system to provide either redundant communications or redundant control, or both.

In a third embodiment, the system 10 of the first embodiment includes a second control member 34, such as a steering member, to which control signals are communicated by the second microprocessor 20 of an associated device controller 16.

Each device controller 16 includes a first microprocessor 18, for communicating control signals to the first control member 12, thus, providing functionality to the brake motor 12 and all other device controllers 16. The first microprocessor 18 also redundantly communicates control signals from the second control member 34 to all other device controllers 16. Each device controller 16 further includes a second microprocessor 20 for communicating control signals to the second control member 34, thus, providing functionality to the steering motor, and all other device controllers 16. The second microprocessor 20 also redundantly communicates control signals to all other device controllers 16 and communicates with the first microprocessor 18. If a device controller 16 detects an error, the first microprocessor 18 discontinues controlling the first control member 12, while still providing redundant communications for the second communication channel 26. The second microprocessor 20 communicates a default control signal for the first control member 12 to all other device controllers 16 while still communicating control signals to the second control member 34.

In another embodiment, the first microprocessor 18 and the second microprocessor 20 are of identical type. For example, both the first microprocessor 18 and the second microprocessor 20 are MPC555 microprocessors. While two identical microprocessors allow propagation of software bugs, software development is simplified.

In yet another embodiment of the system 10, the first microprocessor 18 of one of the device controllers 16 communicates control signals to the second control member 34.

With reference to Fig. 4, the present invention is applied to a braking and steering system 40 having a first road wheel (RW) dual wound motor 42, a second road wheel dual mount motor 44, a left front (LF) brake motor 46, a right front (RF) brake motor 48,

a left rear (LR) brake motor 50, and a right rear (RR) brake motor 52. The first and second RW dual wound motors 42,44 for providing steering control to a vehicle (not shown). The LF, RF, LR, and RR motors provide braking control for the vehicle.

A first RW steering dual microprocessor controller 54 controls actuation of the first RW dual wound motor 42. A second RW steering dual microprocessor controller 56 controls actuation of the second RW dual wound motor 44.

A LF brake dual microprocessor controller 58 controls actuation of the LF brake motor 46. A RF brake dual microprocessor controller 60 controls actuation of the RF brake motor 48. A LR brake dual microprocessor controller 62 controls actuation of the LR brake motor 50. A RR brake dual microprocessor controller 64 controls actuation of the RR brake motor 52. Preferably, the LR controller 62 and the RR controller 64 each control one of two hand wheel steering motors 66.

The dual microprocessor controllers 54,56,58,60,62,64 each have first and second microprocessors 18,20, as described above. In one embodiment, the first and second microprocessors 18,20 of the first and second RW steering dual microprocessor controllers 54,56 each control one half of the respective dual would motor 42,44. Thus, if one the first and second microprocessors 18,20 fails or is taken off-line due to a fault then steering function exists through the other microprocessor 18,20.

With reference to Fig. 5, an alternative embodiment 70 of the braking and steering system 40 is shown. In Fig. 5, like elements are numbered the same as in Fig.

4. The first RW steering dual microprocessor 54 and the LF brake dual microprocessor controller 58 are combined in a first brake and steer dual microprocessor controller 72.

The second RW steering dual microprocessor 56 and the RF brake dual microprocessor controller 60 are combined in a second brake and steer dual microprocessor 74.

With reference to Fig. 6, a system 80 is illustrated where a dual wound motor 82 controls a single function, such as braking and/or steering. The system 80 includes a main controller 84, a first motor controller 86, and a second motor controller 88. The main controller 84, first motor controller 86 and the second motor controller 88 each include a single microprocessor 18,20 which performs operational checks on the other controllers 84,86,88. Under normal operation, the main controller 84 provides control information to the first and second motor controllers 86,88. The first and second motor controllers 86,88 each control one half of the dual wound motor 82. The main controller 84,86,88 are coupled to a common bus 90 for sharing all inputs and outputs such that each controller 84,86,88 can operation independently at a low power output.

Obviously, many modifications and variations of the present invention are possible in light of the above teachings. The invention may be practiced otherwise than as specifically described within the scope of the appended claims, wherein that which is prior art is antecedent to the novelty set forth in the"characterized by"clause. The novelty is meant to be particularly and distinctly recited in the"characterized by"clause whereas the antecedent recitations merely set forth the old and well-known combination in which the invention resides. These antecedent recitations should be interpreted to cover any combination in which the incentive novelty has utility. In addition, the reference numerals in the claims are merely for convenience and are not to be read in any way as limiting.