Fail-safe Operation

Since the operation of the vehicle systems depends on the power mode, there is a fail-safe plan in place should the PMM fail to send a power mode message. The fail-safe plan covers those modules using exclusively serial data control of power mode as well as those modules with discrete ignition signal inputs.

The modules that depend exclusively on serial data messages for power modes stay in the state dictated by the last valid PMM message until they can check for the engine run flag status on the serial data circuits. If the PMM fails, the modules monitor the serial data circuit for the engine run flag serial data. If the engine run flag serial data is True, indicating that the engine is running, the modules fail-safe to RUN. In this state the modules and their subsystems can support all operator requirements. If the engine run flag serial data is False, indicating that the engine is not running, the modules fail-safe to OFF-AWAKE. In this state the modules are constantly checking for a change status message on the serial data circuits and can respond to both local inputs and serial data inputs from other modules on the vehicle.

Those modules that have discrete ignition signal inputs also remain in the state dictated by the last valid PMM message received on the serial data circuits. They then check the state of their discrete ignition input to determine the current valid state. If the discrete ignition input is active, battery positive voltage, the modules will fail-safe to the RUN power mode. If the discrete ignition input is not active, open or 0 volts, the modules will fail-safe to OFF-AWAKE. In this state the modules are constantly checking for a change status message on the serial data circuits and can respond to both local inputs and serial data inputs from other modules on the vehicle.