Note: Descriptions are shown in the official language in which they were submitted.
CA 02314307 2000-07-21
ELECTRICAL CONTROL APPARATUS FOR LEASED EQUIPMENT
This invention relates to an electrical control apparatus for use
controlling equipment such as a vehicle where a period of use of the equipment
is
pre-determined such as in a lease.
BACKGROUND OF THE INVENTION
This application is related to and includes subject matter disclosed in
US Application Serial No: 09/400,828 filed September 21, 1999, which
corresponds to Canadian Application Serial No: 2,282,881 filed September 20,
1999.
Control apparatus for controlling electrical systems for various end
uses are well known and widely required. The present invention is particularly
but
not exclusively concerned with such control apparatus for use in vehicles such
as
trucks, trains, boats, aircraft and passenger transit vehicles. However
devices of this
type can also be used for controlling industrial processes.
A vehicle such as a passenger transit vehicle has a large number of
electrical inputs from operator actuated switches and from various other
transducers
such as temperature sensors and door closure switches. The vehicle further has
a
large number of electrical outputs where various components such as lighting,
air
conditioning, door actuators and engine control systems require output at a
predetermined voltage from the power system of the vehicle.
One conventional arrangement for controlling the various outputs from
the various inputs includes a plurality of control modules which are
interconnected
by a communication bus.
CA 02314307 2000-07-21
2
Each module has a series of input terminals for receiving control
signals from a selected combination of the various inputs of the system. Each
module has a plurality of outputs for supplying output voltage to selected
ones of the
series of controlled elements of the system. Each module has a plurality of
switches
which can be actuated to supply output as required to one or more of the
output
terminals. The switches are controlled by a processor in the module. The
switches
are preferably electronic but other electromechanical switches can be used in
some
cases. The module has a communications connection for two way communication
between the processor and the communication bus so that the status of the
module
can be communicated onto the communication bus and so that information
concerning the other modules can be communicated from the communication bus to
the processor.
U.S. Patent 5,819,869 (Horton) issued October 13, 1998
discloses an arrangement for disabling an automobile in the event that the
vehicle is
being used without the necessary authority, for example where the vehicle is
stolen
or when a lease or rental agreement has expired. The patent discloses an
arrangement in which a remote communication system allows the authorizing
agency to communicate with the occupant of the vehicle informing them of the
status
and, in the absence of a suitable response to the initial contact to operate a
relay
system for deactivating the vehicle. However this device is somewhat
unsophisticated and relies upon the ability to communicate with the vehicle
from a
remote location.
U.S. Patent 6,011,321 (Stancu et al) issued January 4, 2000 discloses
CA 02314307 2000-07-21
3
another system by which a vehicle can be deactivated from a remote location.
However none of these arrangements are effective in allowing a fleet
management to properly control operation of vehicles in a fleet when those
vehicles
are governed by different leasing arrangements.
SUMMARY OF THE INVENTION
It is one object of the present invention therefore to provide an
improved electrical control apparatus which allows control over equipment
arranged
to be used over a pre-determined period such as a lease.
According to one aspect of the invention there is provided a electrical
control apparatus electrical control apparatus for use in controlling
operation of a
controlled assembly including a plurality of sources of input signals and a
plurality of
controlled elements, the apparatus comprising:
a real time clock for providing a signal indicative of an instantaneous
time and date;
a plurality of input terminals arranged for receiving at least one input
from a respective one of said plurality of sources of input signals;
a plurality of output terminals at least one of which is arranged for
connection to a respective one of the controlled elements;
a plurality of controllers each associated with a respective one of the
output terminals for effecting control of the respective controlled element;
a processor programmed with a predetermined operating program
component so as to actuate the controllers in response to data from the input
terminals in accordance with the predetermined operating program component
CA 02314307 2000-07-21
4
which is arranged to allow the controllers to be operable in a manner which
will
disable the controlled assembly;
a unique ID code identifying the assembly;
a lease control program component arranged to be programmable with
an expiry date indicative of a date beyond which the assembly is no longer
authorized to operate;
the lease control program component being arranged, on a start up of
the assembly, to compare the expiry date with the instantaneous date and to
cause
the operating program component to disable start up of the assembly if the
instantaneous date does not pre-date the expiry date.
Where the term "lease" is used herein, it is appreciated that the most
common use of the system described herein will be to control lease terms; but
the
same expiry dates can also be used for other functions and therefore is not
strictly
limited to expiry dates used in leases.
Preferably the program is arranged to be programed with said expiry
date by a special code which has embedded therein the unique ID code and the
expiry date where the special code is scrambled and includes a checksum.
In one arrangement, the program is arranged to be programed with the
special code by a keypad associated with the assembly, that is available for
operation by authorized service personnel. This can be located conveniently at
the
driver compartment for operation by the driver. As the code is scrambled and
includes the ID code which is not known to the driver or other personnel, the
code
can be entered by the person concerned without danger that they may alter the
CA 02314307 2000-07-21
expiry date.
In a more advanced arrangement making use of satellite
communications for communicating various data, the program is arranged to be
programed with the special code by a wireless communication, such as by
satellite,
5 between a base unit and the assembly.
Preferably the program is arranged to provide an indication to an
operator warning when the expiry date is imminent.
Preferably the program is programable with a start date indicative of a
date before which the assembly is not authorized to operate and wherein the
program is arranged, on a start up of the assembly, to compare the start date
with
the instantaneous date and to activate start up of the assembly only if the
instantaneous date is after the start date.
Preferably the program is arranged to provide an indication to an
operator warning that the expiry date has expired and is the reason for the
failure to
effect start up.
Preferably the apparatus further includes a communication bus and at
least one control module including said predetermined operating program
component and in one arrangement the lease control program is included in said
at
least one module as a component of the program therein.
In another arrangement, there is provided a separate lease control
module wherein said lease control program is included in said lease control
module
as a component of the program therein and wherein the lease control module
communicates with the control module through the bus.
CA 02314307 2000-07-21
6
Preferably there is provided a plurality of control modules each having
connection to the communication bus for transmitting communications on and
receiving communications from the bus, a different function from that of the
others
such that each receives input from a different one or more of the sources of
input
data and each effects control of a different one or more of the controlled
elements,
where a plurality of the control modules are involved in effecting the start
up such
that in the event that the start up is disabled, start up is prevented by each
of said
plurality of the modules.
Preferably the apparatus includes a port connected to the
communication bus for receiving the special code on the communication bus.
Preferably the control apparatus is provided in a vehicle for controlling
electrical components of the vehicle.
Preferably there is provided a manually operable key pad for entering
the expiry date.
Preferably the keypad is arranged in a driver's compartment for
operation by the driver.
The invention is also directed to the further aspect of the lease control
module itself for use with an existing apparatus and control systems for the
apparatus.
BRIEF DESCRIPTION OF THE DRAWINGS
One embodiment of the invention will now be described in conjunction
with the accompanying drawings in which:
Figure 1 is a schematic illustration of the control apparatus according
CA 02314307 2000-07-21
7
to the present invention including a plurality of separate modules.
Figure 2 is a schematic illustration of one of the modules.
Figure 3 is a schematic illustration of the exterior of the housing
showing the status LEDs and a feedback harness for diagnostics.
In the drawings like characters of reference indicate corresponding
parts in the different figures.
DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS
In Figure 1 is shown a vehicle 10 having ground wheels 11, an engine
compartment 12 containing an engine system (not shown) and an operator station
13 at which an operator is seated for controlling the vehicle in its various
functions.
All these elements are shown schematically since the details of these elements
are
well known to one skilled in the art.
The electrical system for controlling the vehicle comprises a
communication bus 14 which runs through the vehicle from a forward position
through to a rearward position. The system further includes one or more of
individual control modules, which in the example illustrated includes six such
modules M1, M2, M3, M4, M5 and M6. Each of these is connected to the
communication bus by an individual connection communicating from the
communication bus to a terminal on the module allowing two way communication
between the module and the bus.
Each module has associated with it a series of inputs which are
indicated at input 1 through input 6. It will be appreciated that this is a
schematic
illustration of a plurality of inputs defined by the combination of all of the
inputs 1
CA 02314307 2000-07-21
through 6 and that each module has associated with it a selected group of the
total
number of inputs. The inputs comprise various different components of the
vehicle
including manually operable switches, transducers and sensors which are well
known to one skilled in the art and therefore will not be described in detail.
Two of the inputs are indicated at AUX and RUN respectively and
these are of course well known in a vehicle and relate to the ignition system
by
which the operator can switch the ignition to either a run condition or the
AUX
condition which thus activates many components of the system. These inputs
form
one of the inputs of each of the input combinations input 1 through input 6
and
therefore each is communicated to the respective module as an input through
that
particular module. It will be appreciated therefore that some of the inputs
are
common to all of the modules and some of the inputs are individual to only one
of
the modules or one or two of the modules depending upon the design of the
system
and the functions to be effected. The AUX or RUN conditions are of course
highly
significant in the operation of the system and therefore are used as inputs to
each of
the modules. In some designs, the AUX and RUN inputs can be replaced by a
single input generally known as MASTERPOWER, wherein the power is activated in
all conditions of operation by the MASTERPOWER input and a separate switch is
used for actuating the starter motor.
The modules are designed so that they are in a power-on condition
only when one or more of a selected number of the inputs therefore are in the
on
condition. Thus some of the modules may shut down to a power-off or power-save
condition when there is no input to the module on the selected number of
inputs. In
CA 02314307 2000-07-21
9
order to ensure that all of the modules are in the power-on condition when
either
AUX or RUN or MASTERPOWER is selected, these inputs are supplied to each of
the modules as one of the selected ones of the modules. Thus the selection of
AUX
or RUN ensures that all modules are in the power-on condition. When neither
AUX
or RUN is selected, other inputs to selected ones of the modules will drive
the
respective module into the power-on condition while others, which are not
receiving
the power-on input conditions remain in the power-save condition with no
outputs.
Each module drives a plurality of outputs indicated at output 1 through
6 respectively. Thus the total number of outputs required is the total of all
of the
outputs 1 through 6 and each module is selected to drive a predetermined
combination of those outputs depending upon the design of the system.
The system further includes a programming port P which
communicates with the communication bus at a suitable location thereon for
receiving programming port from a suitable programming system which may be a
PC as indicated at PC.
Turning now to Figure 2, the structure of each module is shown in
combination with the elements associated with that module. Thus the module
comprises a housing 15 which contains the module components and supports a
plurality of terminals on the exterior surface of the housing for connection
to the
various inputs and outputs as described hereinafter.
The module includes a first power bar 16 and a second power bar 17.
The first power bar is connected through an electrical connection to an input
terminal
18 for receiving either 24 volts DC power from a source 19 on the vehicle or
12 volts
CA 02314307 2000-07-21
DC from a source 21. The second power bar is connected to a terminal 20 for
receiving either 24 volts DC from the source 19 or 12 volts DC power from the
source 21. Thus each module may be used to supply only one of the available
voltages or may be used to supply both voltages depending upon system
5 requirements.
The power bar 16 is connected to a plurality of electronic switches S1
through S5 each of which controls communication of voltage from the supply 19
to a
respective connector of an output terminal 22. The power bar 17 is connected
to a
plurality of switches S6 through S10 and again each of these controls supply
of
10 voltage from the source 21 to a respective connector of the terminal 22.
The
switches are preferably electronic but other electromechanical switches can be
used
in some cases. The number of switches can of course vary with requirements.
The terminal 22 provides therefore connectors for connection to
selected outputs 01 through 010 which can be any component of the vehicle
requiring at the set voltage and thus, depending upon the design of the
system, the
connector to the terminal 22 can be connected to selected vehicle components
for
supplying the necessary voltage thereto for operating the components as
required.
The module further includes a terminal 23 which has a plurality of
connectors each for connecting to a respective one of the inputs from the
combination of inputs to that module, the inputs being indicated at 11 through
110.
As set forth above, according to the design of the system, selected ones of
the
inputs 11 through 110 are arranged for connection to various input components
of the
vehicle of the system and thus provide an input to the module.
CA 02314307 2000-07-21
11
The module further includes a terminal 24 for connection to inputs IX
and IY. These inputs are connected to switches S11 and S12 which can be
actuated to supply the respective input to a respective output connector of
the
terminal 22 for connection to outputs OX and OY. Thus the module can be used
not
only to control the supply of high side voltage, that is a positive voltage
line to the
outputs 01 through 010 but in addition the module can be used to supply a
required
output to outputs OX and OY which can be low voltage connections or can be low
side ground connections depending upon design requirements. The necessary
output is thus applied at the selected input IX or IY and is controlled by the
switch
S11 or S12 as required. The switches S11 and S12 are both bi-directional for
this
purpose.
The module further includes a processor 25 which has a connection to
the input terminal 23 so as to receive the inputs 11 through 110 as control
inputs
thereto. The processor further is connected to a terminal 26 which provides an
input
indicating to the processor which of the module functions M1 through M6 this
particular is intended to carry out. One technique for the input from the
terminal 26
is to provide a ground block which connects selected ones of a plurality of
connectors of the processor to ground so that the particular ground connectors
are
selected in dependence upon the module location M1 through M6 to provide the
required indication to the processor 25.
The processor 25 further connects to a terminal 27 communicating with
the communication bus 14 through a connector 28. Thus the processor can
provide
two way communication to and from the communication bus.
CA 02314307 2000-07-21
12
The processor contains programming information including a base
program stored in a memory 1 and an operating program stored in memory 2.
These memory components are shown separately and schematically for
convenience of illustration but it will be appreciated that in many cases the
memory
component will comprise a single memory chip where the base program and the
operating program are stored as separate parts on the memory chip.
The system operates by providing a program in the operational
program memory 2 which contains a series of separate sections each defining
the
function for a respective one of the modules so that each module as programmed
with the operational program can carry out the function of each of the other
modules.
The processor receives the input from the terminal 26 to identify which module
performs the respective program.
The inputs according to the design system to which the program has
been created are attached at the input terminals 23 so as to provide the
necessary
inputs to the processor. The outputs are connected in accordance with the
design
arrangement so as to receive the required output from the required source.
During normal operation, each processor is activated into a power-on
situation by the provision of an input to a selected number, for example
inputs 11 to
15, of the total inputs 11 through 110 as determined by the hardware. Thus
those
modules required at any predetermined condition of the system are activated.
Each module is arranged so that the processor thereof communicates
onto the communication bus data defining the current status of each of the
inputs
and each of the outputs of that module whenever there is a change of status.
CA 02314307 2000-07-21
13
The processor of each module thus receives the data on the
communication bus and therefore has in an operating portion of the memory a
current indication of the status of each of the other modules.
This data is used in conjunction with the inputs to that module from the
inputs 11 through 110 under control of the designed operational program to
actuate
the switches S1 through S10 and thus determine the outputs. It will be
appreciated
that the program can be designed for various different characteristics of the
system
including many different arrangements of input and output. The program can be
arranged to incorporated data from a number of the modules in actuating a
particular
output of a particular module. The program can be used to utilize a single
input to
one of the modules to actuate outputs at one or more of the other modules. The
program can be used to generate feedback so that a sensor responsive to
actuation
by a certain output provides data for the communication bus which is fed back
so
that it is subsequent actuation only occurs if the first actuation has
completed
successfully. The program can be arranged to receive data from other elements
connected to the communication bus and supplying status data to the bus, such
as
the engine control system, and to use that data in actuating selected outputs
of the
modules.
As shown in Figure 3, each module include two series of status LEDs
for indicating to service technicians the operation of the modules. Thus the
input
connectors of the input terminal are associated with individual LEDs L11 to
L110 of
one series of the status LEDs which are arranged to be on when an input is
present
and off when no input is present. Each output connector is associated with a
CA 02314307 2000-07-21
14
respective one of the second series of LEDs L01 to L010 to indicate the status
of
the respective output. Each LED is arranged to be on when an output is
present, to
be off when no output is present and to flash when a fault, such as a short or
overload, is detected. This two series of status LEDs can be used with a feed
back
harness H to check the proper operation of the module. Thus a feedback harness
is
provided which allows a connection from each output to a respective one of the
inputs. In the event that there are more inputs than outputs, or vice versa,
connections can be doubled so that one output is connected to two inputs. The
program is then actuated to run a diagnostic mode in which each output is
actuated,
to generate a respective input, and then to generate an output if each input
is
present. In such a situation, all status LEDs should be on and if they are not
then a
fault is present.
The modules are supplied in an initial condition in which the base
program in memory 1 is installed and therefore enables the processor to carry
out
initial programming functions but does not enable the processor to carry out
the
necessary control of the outputs in dependence upon the operational program
since
that is not present.
The absence of the operational program therefore allows the module to
be generic without dedication to a particular operational program. The module
can
therefore be re-programmed for different systems and schemes of operation to
accommodate modifications over an extended life of manufacture of a particular
product or various differences due to selection of particular options in the
product.
It will be appreciated that the basic program includes a conventional
CA 02314307 2000-07-21
communication protocol such as CAN which controls the operation and
communication between the elements of the system.
In the event of initial installation of all of the modules, the modules are
initially installed from the supply in the condition with the operational
program
5 omitted. When installed and connected as required, the necessary programming
is
applied to the communication bus for communication to each of the modules
through
the port P from the programming system PC. The program is therefore supplied
into
the memory using conventional programming techniques of data are supplied to
be
led into the memory of each processor together with a check sum and each
10 processor in turn confirms by returning the check sum that the program
portion has
been properly installed. While usually the operational program is omitted, it
is
possible that another program will be already in place in one or more of the
modules
depending upon their source in which case the existing program is overwritten
or
replaced by the new programming relevant to the new situation.
15 As previously described, each module has the input from the terminal
26 which identifies to that module which function that module is intended to
perform
thus allowing the modules to be individually addressed during the programming
procedure.
In the event of replacement of a module, should that module be
defective or for some other reason, the replacement module is again generally
supplied in a condition from the supplier in which the operational memory is
omitted
thus allowing the module to be generic and applicable to a number of different
models of the product concerned. In some cases a replacement module may come
CA 02314307 2000-07-21
16
from another source such as a spare part already used in another vehicle in
which
case it will contain an existing operational program which will be incorrect
for the
new system and will thus need to be replaced by the programming system
described
herein.
While the arrangement set out herein is intended and designed to
allow replacement of only one module at a time, it is also possible to
generate
arrangements which will allow replacement of more than one module.
The module to be replaced is removed by disconnecting the various
connections to the terminals and a replacement module is inserted in its
place. Of
course the replacement occurs in a condition with the power to the sources 19
and
21 disconnected so that the vehicle is in a power-off condition.
After the module is installed, the power is reconnected so that the
vehicle enters the power-up condition. As previously explained, in the initial
power
up condition it is not necessary that all of the modules are moved into the
power-on
condition since some may remain inactive since they are not required in the
initial
condition of the vehicle. However, actuation of the vehicle ignition switches
to the
AUX, RUN or MASTERPOWER condition, is arranged as explained before so that
each module is actuated to the power on condition. In most cases it is
acceptable to
cause the programming procedure to run at each power-up. However, in some
cases it may be desirable to prevent this occurring except in a situation
where a
specific arrangement of inputs is actuated by the technician wishing to cause
the
procedure after installation of a module, thus defining a masterlock
arrangement
operable by the technician.
CA 02314307 2000-07-21
17
In this initial condition, when each module detects the AUX, RUN or
MASTERPOWER input, the basic program is arranged, after running the
conventional protocol for initial addressing, to cause each module to emit
onto the
communication bus a reference or identification number which forms part of the
operating program together with an optional check sum calculated from the
operating program.
The reference number forms part of the operational program and
identifies the particular design of system used in this particular vehicle
depending
upon its time of manufacture and depending upon the option selected.
The base program of each of the processors causes the processors to
receive the information emitted onto the communication bus by each of the
modules.
Since the replacement module does not contain the operational program. Any
data
transmitted by that module, from an existing operational program if any,
likely does
not contain the correct reference number nor the correct check sum since this
has
not been programmed into the module. The modules under the control of the base
program thus compare the data emitted and a determination is made as to
whether
all are accurate and proper or whether one is inaccurate.
In the condition set forth above where the process of comparison of the
reference numerals occurs at each power-up with the ignition in the AUX or RUN
condition, in most cases the modules will determine that each of the modules
contains the correct and accurate program.
However in the event that one of the modules becomes defective or is
replaced and therefore does not contain the proper operational program, that
CA 02314307 2000-07-21
18
module will emit to the communication bus a reference number and check sum
which are inaccurate, that is different from those of the other modules. In
this case,
the base program is arranged to designate one of the modules to download from
its
memory the operation program onto the communication bus for loading into the
replacement module.
Programming is carried out using conventional programming
techniques so that each program portion is communicated with a check sum and
the
receiving module replies to confirm proper receipt by transmitting a
calculated reply
check sum.
The system therefore allows a generic module which is generic to a
number of different designs of system to be installed subsequent to the
initial
programming at any time during the life of the vehicle and the system
automatically
programs the module so that it receives from the designated one of the modules
the
necessary operational program so that the modules can then commence operation
in the normal operating manner.
Preferably the designated module is the module with the lowest
number designation which would be module M1. In the event that module M1 is
the
replacement module, the base program is programmed to cause the next module
which is module M2 to effect the downloading for programming the replacement
module M1.
In order to avoid the necessity for the procedure of checking to be
carried out at each power-up when no modules have been replaced, the system
may
CA 02314307 2000-07-21
19
be arranged so that an operator actuates a predetermined arrangement of inputs
and only when these inputs are operational does the check program run.
The arrangement of modules can also be used to control leasing
arrangements or similar arrangements in which the vehicle is authorized to be
operated only within a predetermined time period.
For this purpose, the system includes a real time clock as shown in
Figure 1 which communicates with the bus 14. The clock may be associated with
one of the modules or may be a separate element. The clock includes battery
backup so that it will keep time even if the vehicle battery is disconnected.
Setting or
changing the time on the clock is programmed only through the port P from the
PC
using authorizing codes so that the setting of the clock can be effected only
by an
authorized person using the authorized equipment and security codes. In the
alternative the clock setting can be fixed at the manufacturing location. In a
yet
further arrangement, the time may be regularly checked by GPS system if used
on
the vehicle.
Furthermore a predetermined identification code associated with the
vehicle is stored on the vehicle and is accessible to the bus 14. The ID code
is
stored electronically and cannot be changed. The ID code is unique to that
particular vehicle. The ID code is stored in a location so that it cannot be
removed
for example by replacing one of the modules, since the ID code must remain
with the
vehicle despite replacement of the module.
The modules as described previously include the program as
previously set forth. In one arrangement, the modules have a programming
CA 02314307 2000-07-21
component so that an expiry date can be stored electronically on the vehicle
in the
modules themselves. As shown in figure 1, in an alternative arrangement, the
lease
control program can be stored in a separate lease control module LCM located
in
the driver's compartment and arranged for communication with the bus.
5 This expiry date can be entered only by authorized persons. The expiry
date can also include an expiry time which might be different from midnight if
this is
suitable in particular circumstances.
In addition to the expiry date, a start date can also be entered. The
use of a start date in conjunction with an expiry date allows a fleet operator
to enter
10 authorized time periods for operation of the vehicle which do not start
immediately
but run for a predetermined time period from a future date to a further future
date for
example over a one year period. The start date can of course be set as a date
equal
to the instantaneous date so that the time period runs from current or
instantaneous
time through the expiry date.
15 The start date and expiry date for a vehicle can be entered into the
programming of the modules through the port P using a special code available
only
to authorized persons operating the authorized equipment to effect the coding
process. Embedded in the code is the expiry date in conjunction with the
vehicle ID
number. The data digits in the code are scrambled and contain a sufficiently
long
20 check sum to make the system very secure. Thus an authorized person
utilizing the
authorized PC can enter through the port P into the programming of the modules
the
expiry date and the ID code with the ID code being checked from the code
supply on
the vehicle to ensure that the expiry date is properly relevant to the vehicle
CA 02314307 2000-07-21
21
concerned. In the event that the ID code is incorrect the expiry date cannot
be
entered. In the event that the ID code properly checks, the programming enters
the
expiry date into the programming of the modules. As set forth previously,
replacement of any one or more of the modules does not affect the storing of
the
expiry date since the data is then communicated from the remaining modules as
previously explained.
At the same time as storing the expiry date, the start up date is also
stored which can of course be equal to the instantaneous date.
If preferred, programming can be effected through a component
dedicated to the vehicle rather than through a separate PC through the port P.
Thus, as shown in Figure 1, the key pad forms an element which is part of the
lease
control module LCM and is securely attached to the vehicle and includes the ID
code
and the necessary components of a conventional key pad. The LCM has the
following functions and features:
1. The keypad has keys numbered 0 to 9 and additional keys,
such as "Clear" and "Enter".
2. An alphanumeric display of for example LED lamps can indicate
"Enter Code:, "Correct code entered", "Code Error" and "Expired".
3. The display indicates if the lease will expire soon.
4. The Real Time Clock (RTC) with battery backup.
5. A unique identifier. This identifier will be used by the customer
to keep track of individual vehicles.
6. The LCM will start in the "Expired" mode until activated by an
CA 02314307 2000-07-21
22
authorized user provided "pass code".
7. The customer creates a "pass code" by using a software
application which generates an encrypted multi-digit number based on a lease
expiry
date and the unique vehicle identifier.
8. The software generated "pass code" can then be entered in the
vehicle keypad.
9. The "pass code" is decrypted by the LCM and if the "pass code"
identifier matches the vehicle identifier the new vehicle expiry date is saved
in the
vehicle.
10. The LCM will then change modes from "Expired" to "Enabled".
11. Once the LCM is in the "Enabled" mode, it communicates an
encrypted J1939 "Enabled" message to all Modules in the vehicle. The modules
will
then start normal operation.
12. If an "Enabled" J1939 message is not received by the modules
during vehicle power up, the modules will remain in a lock out state,
disabling all of
their output functions.
13. For further vehicle protection, an encrypted message can be
sent from the lease control module to other electronic control apparatus in
the
vehicle such as the engine controller to utilize the anti-theft capabilities
of that
controller.
As a further alternative, a satellite communication module can be
provided on the vehicle for communicating between a remote base station and
the
bus 14. This satellite communication can be used to enter the necessary data
and
CA 02314307 2000-07-21
23
includes the following features.
1. This interface uses a module containing a satellite transceiver,
CAN interface, storage for vehicle ID and Expiry Date, and optionally a GPS
system.
2. Real Time can be updated from the GPS link when available.
3. The satellite transceiver module is used to store the new Expiry
Date in the vehicle.
4. When a lease is to be renewed, the customer pays for a certain
lease term. The customer personnel accesses their database, determines the
vehicle ID and address of the vehicle, and sends a coded message which can for
example be sent over the Internet and via SpaceTrac web site to the vehicle.
The
coded message contains the vehicle ID and the new Expiry date. Other
communication media and protocols can also be used.
5. When the LCM receives the coded message, it verifies the
checksum, extracts the vehicle ID and new Expiry Date, and updates the Expiry
Date if appropriate. It finally confirms to the user that the vehicle has been
enabled.
6. Since the user can remotely access the Expiry Date, it is
possible to set its status to "Expired" over the Internet. This could be done
if the
lessee's payment "bounces" or if the vehicle is reported stolen.
7. The two-way link has the ability to provide unique information to
the user personnel, such as vehicle location (requires GPS), odometer reading,
expiry date, and any vehicle data that is available on the CAN network.
When the necessary data providing the start date and expiry date have
been entered and the vehicle is operating, at each vehicle start up, the real
time is
CA 02314307 2000-07-21
24
compared to the expiry date. If the real time is beyond the expiry date all
output
functions from the modules are disabled. An indicator on the operator
instrument
panel or on the keypad if used and if accessible to the operator will indicate
an
expired condition. Since the whole vehicle is disabled in this manner
utilizing
multiple output functions from the various modules, it is extremely difficult
and very
extensive to overcome the disabling action since it relates in effect to all
aspects of
electrical functioning of the vehicle. For safety reasons the expiry date
checking is
done only at the vehicle start up. If the expiry date is reached while the
vehicle is
running, it will continue to run until the operator shuts off the ignition. In
the event
that the real time is close to the expiry date, for example one day from
expiry, the
expiry indicated at the operator instrument panel or at the keypad will alert
the
operator that the lease will soon expire. The expiry indicator will stay on
once the
expiry time has passed and therefore act to alert the driver that if he shuts
the
vehicle off he will not be able to restart it.
The device therefore allows proper control of the period of authorized
operation since the expiry date is stored on the vehicle itself and is not
merely
responsive to the receipt of communications from an exterior source. The
storing of
the expiry date is effected in a secure manner so that it cannot be readily
changed or
overridden.
Once the expiry date has been reached, the disabling effect occurs
throughout all of the individual modules so that it is impossible or at least
extremely
difficult to override each of the effects of the disabling action.
Since various modifications can be made in my invention as herein
CA 02314307 2000-07-21
above described, and many apparently widely different embodiments of same made
within the spirit and scope of the claims without department from such spirit
and
scope, it is intended that all matter contained in the accompanying
specification shall
be interpreted as illustrative only and not in a limiting sense.
