by Dr John Davis.
The BLOODHOUND SSC vehicle control system consists of three interrelated and interacting separate control units. The control functions of the car are separated into regions, they are broadly, Jet engine and it functions, Rocket Engine and its associated functions such as the APU's V12 engine and the remaining vehicle functions such as wings, steering and brakes. A diagram of how these are all interconnected is below.
Control Systems Overview
Each controller will collect sensor information necessary for its function and will control the actuators to make things happen.
However, as safety is an overriding requirement for BLOODHOUND SSC, it is imperative that a rigorous procedure for cross checking is in place. To achieve this each of the three processors not only has control responsibility for its own area of the car, but also has override responsibility for one of the other areas. This control/override architecture is arranged such that Processor 1 that has control of the Rocket functions also has override responsibility for the functions normally carried out by Processor 3 which are the vehicle functions. Similarly Processor 2 has control of the Rocket and override responsibility of the Rocket functions. To complete the functions, Processor 3 has control of the vehicle functions and override capability for the JET functions.
This circular Control/Override layout ensures that at least two processors are ensuring the various functions are carried out correctly. Information from vital sensors such as the vertical load on each wheel is collected by both the control and override processors via independent electronic circuits, the results of which are checked by information being passed around a Data Ring Main that links all the processors, also in a circular fashion.
Another vital function carried out by this circular data ring main is to ensure all sections of the control system are functioning correctly. Each processor will not only receive information from the other two processors, it will also receive its own data back as an input. By ensuring its own data returns to itself in a timely manner ensures the overall heath of the control system.
In addition, there is a fully automated watchdog system in place. Each processor switches one digital output from low to high with alternating clock pulses. The other two processors will independently monitor this digital line to ensure it is changing state from low to high in a regular fashion. If no state change is detected within a required time frame, the override processor will automatically take over control of the output functions of the processor that is not correctly switching its watchdog digital line. At the same time, the processor that is not ‘toggling’ its watchdog line will, if still functioning, receive via the data ring main notification that its output functions have been overridden and will, if still operating, initiate a controlled shut down. At the same time, the two functioning processors will already have initiated an ordered shutdown of their control functions in an attempt to bring the car safely to a halt.
