DE69119959T2 - Adaptive spring suspension for motor vehicles - Google Patents

Description

The present invention relates to a suspension system for a motor vehicle designed to control the attitude of a motor vehicle by controlling the supply or discharge of a fluid to or from a cylinder, and more particularly to a suspension system for a motor vehicle which in particular has fail-safe measures in the event of a failure in the supply-discharge control system.

A suspension system for a motor vehicle is known, for example, in Japanese Laid-Open Patent Publication (Kokai) No. 130 418/1988 (see also EP-A 0 358 231), which has a plurality of cylinder units arranged between a sprung mass and an unsprung mass for each wheel, to which a plurality of gas springs are connected, so as to enable independent and separate supply or discharge of fluid to each cylinder, thereby carrying out the control of the attitude of the motor vehicle. This system is known as an active control suspension system (ACS system).

Similar active control wheel suspension systems are known from other documents, where not only the pressure in the cylinder units, the vertical and/or transverse acceleration, the vehicle and/or wheel speed, the vehicle or wheel height are determined, but also a steering angle is determined and the determination signals are used within the active control, see US-A 4 856 798, GB-A 2 221 878, EP-A 0 234 552 and EP-A 0 224 036.

In such ACS systems, a supply-discharge control valve for supplying and discharging an operating fluid is arranged to be controlled by a supply-discharge or first control device under a certain condition. However, a failure may occur so that the first control device cannot operate correctly. Such a failure includes failures related to the first control device. itself as well as various sensors, fluid circuits for supplying or discharging the fluid, among others. When such disturbances occur, the attitude of the motor vehicle cannot be controlled in a normal manner, so that the control by the first control device should be disabled (interrupted).

It should be noted here that if the first control means is disabled while the motor vehicle is traveling on a curve, the motor vehicle will continue to lean even if the motor vehicle has returned to the straight running state. In other words, when the motor vehicle is traveling on a curve, a transverse acceleration acts on the motor vehicle as a centrifugal force, causing the motor vehicle to lean in the direction in which the transverse acceleration acts, with different loads acting on the left and right wheels. The known ACS systems are designed to control the different loads acting on the left and right wheels by changing internal pressures within respective cylinder units for the left and right wheels. However, a further difficulty may arise if the control by the first control unit is out of power, resulting in a tilting of the motor vehicle in the opposite direction when the motor vehicle returns to its straight running state from cornering with different loads acting on the left and right wheels.

It is therefore an object of the present invention to provide a suspension system for a motor vehicle which is designed to cope with an abnormal engagement of a control of the attitude of the motor vehicle, whereby the operating fluid is supplied or discharged to or from the cylinder units, even if a disturbance would occur during cornering of the motor vehicle.

In order to achieve the above object, the wheel suspension system according to the present invention is basically constructed as set out in claim 1.

In this way, the system interrupts the control of the attitude of the vehicle when a fault occurs and continues to provide a predetermined correction state when the known control is interrupted during cornering.

The correction condition provided when the attitude control of the motor vehicle is interrupted may preferably include a state for lowering the vehicle height of the motor vehicle while forcibly discharging the operating fluid from the cylinder units. The resulting lowering of the vehicle height serves to improve the stability of the motor vehicle as well as to prevent the motor vehicle from leaning. The interrupting system according to the present invention can further prevent the occurrence of the situation in which the motor vehicle leans greatly in the direction opposite to the direction in which the motor vehicle leans during cornering when the motor vehicle has returned to its straight running from its cornering.

A decision as to whether the motor vehicle is currently cornering can be made, for example, by preferably using the steering angle of a steering wheel, the transverse acceleration, etc. In addition, the cornering of the motor vehicle can be determined by advantageously using a difference in the internal pressures between the left and right cylinder units.

Preferably, the vehicle height of the motor vehicle is lowered when the motor vehicle has approximately returned to its straight path after control of the attitude of the motor vehicle has been cancelled or interrupted.

Furthermore, it is advantageous that a failure mode is used depending on the type of failure. The failure mode may include a first failure mode for interrupting the control of the attitude of the vehicle, whereby the vehicle height of the vehicle is lowered, and a second failure mode for interrupting the control of the attitude of the vehicle, whereby the current vehicle height of the vehicle is maintained. Even if the second failure mode would correspond to the second disturbance mode, it can be modified so that it corresponds to the first disturbance mode by the correction device during the occurrence of a disturbance during cornering of the motor vehicle.

It is also advantageous that the high-pressure line, through which the high-pressure actuating fluid runs, is discharged to the low-pressure line, i.e. to a tank reservoir. This arrangement can ensure that the high-pressure actuating fluid of the high-pressure line is not delivered to the cylinder units by mistake for any reason.

Other objects, aspects and advantages of the present invention will become apparent in the course of the description of preferred embodiments which follows with reference to the drawings.

Fig. 1 is a block diagram showing an entire structure of the suspension system for an automotive vehicle according to an embodiment of the present invention.

Fig. 2 is a diagrammatic representation of a hydraulic pressure circuit for supplying or discharging the operating fluid in the suspension system for the automotive vehicle according to an embodiment of the present invention.

Fig. 3 is a block diagram showing the structure of the controller and its peripheral units or sections.

Fig. 4 is a block diagram showing the structure of the main control unit.

Fig. 5 is a diagrammatic representation of a system for supplying power to the control unit and its peripheral units or sections.

Fig. 6 is a flowchart showing a fail-safe control in the control unit.

Fig. 7 is a flowchart showing a decision example for determining whether the motor vehicle is running through a curve.

Fig. 8 is a flow chart showing a variant of the present invention.

The present invention will now be described in more detail with the aid of the drawings.

In Fig. 1, reference numeral 1 denotes a motor vehicle, reference numeral 2F denotes a front wheel, and reference numeral 2R denotes a rear wheel. A fluid cylinder 3 is interposed between the motor vehicle 1 as a sprung mass and each front wheel 2F and rear wheel 2R as an unsprung mass. Each fluid cylinder 3 is divided into or defined by a fluid pressure chamber 3c by a piston 3b inserted into a cylinder body 3a. An upper end part of a connecting rod 3d connected to the piston 3b is connected to the motor vehicle 1, and the cylinder body 3a is connected to each front wheel 2F and rear wheel 2R. In particular, the inside of the cylindrical body 3a substantially forms a fluid pressure chamber 3c regardless of the position of the piston 3b. In other words, the fluid pressure chamber 3c has an upper fluid pressure chamber portion disposed above the piston 3b and a lower fluid pressure chamber portion disposed below the piston 3b, both fluid pressure chamber portions always being connected to each other via a communication hole or a cutout portion formed on the piston 3b.

A gas spring 5 is connected to the fluid pressure chamber 3c of each of the fluid cylinders 3 via a communication line 4, which gas spring 5 is in turn divided into a gas chamber 5f and a fluid pressure chamber 5g by a diaphragm 5e, the fluid pressure chamber 5g being connected to the fluid pressure chamber 3c of each fluid cylinder 3.

As shown in Fig. 2, reference numeral 8 denotes a hydraulic pressure pump 8 connected to each of the fluid cylinders 3 via a fluid pressure line 10 as a high pressure line, and reference numeral 9 denotes a pressure flow control valve which is arranged in the fluid pressure line 10 and has the function of adjusting an internal pressure, that is, the fluid pressure within the Fluid pressure chamber 3c, wherein the fluid or oil is supplied or discharged to or from each fluid cylinder 3.

Furthermore, as shown in Fig. 1, reference numeral 12 denotes a master pressure sensor for detecting the pressure for discharging the liquid of the hydraulic pressure pump 8, i.e., the pressure of the liquid accumulated in each reservoir 22a and 22b, reference numeral 13 denotes a cylinder pressure sensor for detecting the liquid pressure of the liquid pressure chamber 3c of each liquid cylinder 3, reference numeral 14 denotes a vehicle height sensor for detecting a vehicle height, i.e., the pressure of the liquid accumulated in each reservoir 22a and 22b, reference numeral 15 denotes a vehicle height sensor for detecting a vehicle height, i.e., the pressure of the liquid accumulated in each reservoir 22a and 22b, 15, a vertical acceleration sensor which detects the vertical acceleration of the vehicle or the spring acceleration of the front and rear wheels 2F and 2R as will be described in detail later, 16, a transverse acceleration sensor which detects the transverse acceleration of the vehicle, 17, a steering angle sensor, and 18, a wheel speed sensor. The signals detected by these sensors and the control signals output from these switches are input to a control unit 19 which is composed of a microcomputer having a CPU, etc., and are used to control the change of the suspension posture.

Fig. 2 shows a hydraulic pressure circuit for controlling the supply or discharge of the liquid to or from the liquid cylinders 3. As shown in Fig. 2, the hydraulic pressure pump 8 has a variable volume wobble piston pump connected via two rows to a hydraulic pressure pump 21 for a power steering unit drivable by a drive source 20. To the liquid pressure line 10 connected to the hydraulic pressure pump 8 are connected three accumulators 22a, 22a and 22a of the same size, in which the liquid pressure line 10 in turn leads to a front wheel liquid pressure line 10F and a rear wheel fluid pressure line 10R. The front wheel fluid pressure line 10F further branches off into a left front wheel fluid pressure line 10FL and a right front wheel fluid pressure line 10FR. The front wheel fluid pressure line 10FL is connected to the fluid pressure chamber 3c of the left fluid cylinder 3FL of the corresponding wheel 2FL, while the right front wheel fluid pressure line 10RF is connected to the fluid pressure chamber 3c of a right fluid cylinder 3FR of the corresponding wheel 2FR. On the other hand, the rear wheel fluid pressure line 10R is connected to an accumulator 22b and divided into a left rear wheel fluid pressure line 10RL and a right rear wheel fluid pressure line 10RR on the downstream side of the accumulator 22b. The left rear wheel fluid pressure line 10RL is connected to the fluid pressure chamber 3c of the left rear fluid cylinder 3RL of the corresponding wheel 2RL, while the right rear wheel fluid pressure line 10RR is connected to the fluid pressure chamber 3c of the right rear fluid cylinder 3RR.

Each of the liquid cylinders 3FL, 3FR, 3RL and 3RR is connected to a plurality of gas springs 5FL, 5FR, 5RL and 5RR, respectively. For each gas spring 5RL, 5FR, 5RR and 5RL, in this embodiment, there are provided four gas springs, that is, a first gas spring 5a, a second gas spring 5b, a third gas spring 5c and a fourth gas spring 5d, which are arranged in parallel to each other and which are connected to the liquid pressure chamber 3c of the corresponding liquid cylinder 3 via the connecting pipe 4. Each of the gas springs 5a, 5b, 5c and 5d has an opening 25 at its branch portion of the connecting pipe 4, the opening 25 being designed to exhibit both an evaporating effect and a buffering effect in connection with the gas filled in the gas chamber 5f. The connecting line 4 is provided with an exhaust steam power slide valve 26 in a position between the first gas spring 5a and the second gas spring 5b in order to adjust the line cross-section of the connecting line 4, and the exhaust steam power slide valve 26 is designed in such a way that it can assume two positions, an open Position in which the connecting line 4 is open, and a closed position in which the line cross-section of the connecting line 4 is noticeably restricted.

The fluid pressure line 10 is connected to a relief valve 27 on the upstream side of the accumulator 22a, which functions to control the oil discharge pressure of the hydraulic pressure pump 8 to maintain it within a certain range, that is, between 120 to 160 kgf/cm². The relief valve 27 is arranged to assume a supply position and a discharge position. Specifically, when the relief valve 27 assumes its supply position, on the one hand, the amount of fluid discharged from the hydraulic pressure pump 8 is determined by introducing the pressure fluid to be discharged from the hydraulic pressure pump 8 into a swash plate actuating cylinder of the hydraulic pressure pump 8. On the other hand, when the relief valve 27 is closed, the fluid pressure within the cylinder is discharged. The relief valve 27 is further arranged so that its position can be shifted from the discharge position to the delivery position when the pressure at which the liquid is to be discharged from the hydraulic pressure pump 8 exceeds a certain upper limit discharge liquid pressure, e.g., 160 ± 10 kgf/cm², and then maintains this status until the liquid pressure reaches a certain limit discharge liquid pressure, e.g., 120 ± 10 kgf/cm² or lower. In other words, the relief valve 27 controls the discharge liquid pressure of the hydraulic pressure pump 8 within a certain range of 120 kgf/cm² to 160 kgf/cm². The flow control valve 28 is arranged so that it can assume both a delivery position in which the pressure oil from the hydraulic pressure pump 8 is supplied to the swash plate operating cylinder via the relief valve 27, and a discharge position in which the pressure oil within the cylinder 8a is discharged from the relief valve 27 to a tank storage 29. This flow control valve 28 serves to control the To control the amount of fluid discharged from the hydraulic pressure pump 8 to a constant level while maintaining constant the differential pressure between the upstream side and the downstream side in the region where a restrictor for the fluid pressure line 10 is arranged when the fluid discharge pressure of the hydraulic pressure pump 8 is maintained within the certain range by the relief valve 27. Consequently, the fluid is supplied as a main pressure to each fluid cylinder 3, the fluid being stored in the accumulators 22a and 22b.

Four of the flow control valves 9 are arranged on the downstream side of the accumulators 22a of the fluid pressure line 10, which thus correspond to the four wheels. Note that since the structure of the portion corresponding to each wheel is identical, only the left front wheel portion will be described, while description of the other portion will be omitted. The flow control valve 9 has a supply control valve 35 arranged in the left fluid pressure line 10FL of the fluid pressure line 10, and a discharge control valve 37 arranged in a low pressure line 36 for discharging the fluid or oil from the left fluid pressure line 10FL into the tank accumulator 29. Each of the supply control valve 35 and discharge control valve 37 is arranged to assume two positions, i.e., a low pressure line 36 and a low pressure line 37. i.e., an open position and a closed position, and it has a differential pressure valve built into it to maintain the fluid pressure at a predetermined value in the open position.

In the left front wheel fluid pressure line 10FL extending between the delivery control valve 35 and the left front fluid cylinder 3FL, a check valve 38 is arranged which serves as a pressure maintaining means depending on a pilot pressure. The check valve 38 is arranged to be closed when the pilot pressure is 40 kgf/cm² or less with oil pressure supplied, that is, the main pressure as a pilot pressure within the fluid pressure line 10 on the upstream Delivery control valve side of the flow control valve 9 via a pilot line 39. In other words, only when the main pressure is greater than 40 kgf/cm², the pressure oil can be supplied to the fluid cylinder 3 as well as the fluid or oil within the fluid cylinder 3 can be discharged.

As shown in Fig. 2, reference numeral 41 designates a fail-safe valve arranged in the connecting line 42 connecting the liquid pressure line 10 on the upstream side of the accumulator 22a to the low pressure line 36, which serves to relieve a high pressure condition by returning the oil accumulated in the accumulators 22a and 22b to the tank accumulator 29 when it shifts to its open position in the event of a failure. Reference numeral 43 designates a restrictor arranged in the pilot line 39 so as to serve to delay the closing of the shut-off valve 38 at the time when the fail-safe valve 41 is opened. In addition, reference numeral 44 denotes a spill valve which can return the liquid or oil to the low pressure line 36 when it is open when the oil pressure of the liquid pressure chamber 3c of each left front liquid cylinder 3FL and right front liquid cylinder 3FR rises to an abnormally high level. Reference numeral 45 denotes a return accumulator which is connected to the low pressure line 36 so that storage of the liquid or oil is carried out when the liquid or oil is discharged from the liquid chamber 3.

The control unit 19 may consist of a microcomputer and be arranged to carry out the following control of the supply or discharge of the fluid from or to the fluid cylinders 3, basically comprising:

controlling the vehicle height to assume a desired vehicle height based on a signal detected by the vehicle height sensor for each wheel;

a control for reducing the vertical vibrations of the motor vehicle on the basis of a signal which is determined by the vertical acceleration sensor 15;

a controller for balancing a load between the left and right wheels on the front wheel side and the rear wheel side based on a signal detected by the cylinder pressure sensor 13 for each wheel; and

a controller for increasing the response of each fluid cylinder 3 based on each signal detected by the transverse acceleration sensor 16, the steering angle sensor 17 and the wheel speed sensor 18.

Fig. 3 is a block diagram showing the structure of the control unit 19 and the peripheral units or sections to be controlled.

As shown in Fig. 3, the control unit 19 receives signals from each of the various sensors via a signal line 200, and has a main control unit 100 for controlling a supply/discharge control valve 120 (referred to collectively as the valves 28, 35, and 41) to supply or discharge the fluid to or from the fluid cylinders and for controlling a discharge valve 37 via a drive unit 104, a sub-control unit 101 for monitoring an abnormality of the main control unit 100 while exchanging information with the control unit 100, and a fail-safe selection unit 102 (F/S mode selection unit) for selecting a fail-safe mode based on the decision results by the main control unit 100 or the sub-control unit 101 or the like. The control unit 19 also has a relay control unit 106 for controlling a transistor 107 in response to a control signal from the main control unit or the sub-control unit 101.

A turning determination section 102a of the F/S mode selection unit 102 receives signals from the steering angle sensor 17, the transverse acceleration sensor 16, the cylinder pressure sensor 13 and the vehicle height sensor 14, and decides the turning of the motor vehicle as described below by comparing each signal detected by these sensors with a predetermined value.

The control unit 105 is for controlling the discharge valve 37 in accordance with the control of the F/S mode selection unit 102.

A contact 110b of the main relay 110 is arranged to be closed when the winding 110a thereof is energized under the control of the transistor 107, thereby supplying a voltage from the main power source 103 - a battery in this embodiment - to a solenoid 102a of the supply/discharge control valve 120. The solenoid 120a of the supply/discharge control valve 120 is controlled by the main control unit 100 via the drive unit 104 and then operated in accordance with this control. At the same time, a solenoid 37a of the discharge valve 37 is also controlled by the main control unit 100 via the drive unit 104. When transistor 107 places winding 110a of main relay 110 in a state where winding 110 is de-energized, contact 110b is opened so that the voltage supply to solenoid 102a is interrupted and solenoid 120a is then released from control by drive unit 104. At the same time, the voltage supply to solenoid 37a of discharge valve 37 is maintained.

It should be noted that the main control unit 100 and the sub-control unit 101 each have a failure monitoring circuit (N/D) 100a and 101a, and that the control by each control unit is suspended at the time when a drift of a control unit is detected.

Fig. 4 is a block diagram showing the structure of the main control unit 100. As shown in Fig. 4, the main control unit 100 has a failure determining section 51 for determining a failure of a supply/discharge control system in accordance with the signal detected by each sensor, a failure mode determining section 52 for determining a failure mode based on the signal from the failure determining section 51, and a failure mode executing section 53 for controlling the drive controller 104 of the supply/discharge control valve 120 in accordance with the decision result of, for example, the failure mode. In addition, the main control unit 100 has a turning determination section 54 for determining the turning of the motor vehicle by comparing the signals sensed by the special sensors with a predetermined value, and a correction section 55 for forcing the failure mode execution section 53 to execute a predetermined failure mode when it is judged that the motor vehicle is turning in response to the signal from the turning determination section 54.

Fig. 5 is a conceptual block diagram showing a system for supplying the power supply voltage to the control unit 19 and its peripheral units and sections. As shown in Fig. 5, a D/D converter 112 is for converting the voltage from the main power supply 103 into a specific DC voltage and supplying the DC voltage to the main control unit 100 and the sub-control unit 101.

On the other hand, as seen from Fig. 3, the DC voltage is supplied from the main power source 103 consisting of the battery to the main relay 110 and the discharge valve 37. As shown in Fig. 5, the F/S mode selection unit 102 and the drive unit 105 are supplied with the DC voltage from the main power source 103.

The voltage monitoring section 130 always monitors the output voltage from the D/D converter 112 and transmits a signal upon a certain indication of an abnormality of the electric voltage to the F/S mode selection unit 102.

Description of the failover control

The fail-safe control used in this embodiment will now be described in detail.

The failover control can have:

a. fail-safe control which is performed based on a signal from each of the sensors indicating a failure when the main control unit is operating normally;

b. a fail-safe control that is performed when the main control unit does not operate normally; and

c. a fail-safe control that is performed when the power supply causes an abnormality.

The interference modes present in this embodiment may include:

(1) a failure mode A (corresponding to a first failure mode specified in the claim of this application); a failure which requires that control be suspended while maintaining the current ride height of the vehicle; the failure mode A further comprising:

(1.1) a fault mode A-0: the fault mode is maintained until the fault is resolved; and

(1.2) a fault mode A-1: the fault mode is reset when the ignition is off (IG.OFF)

(2) a failure mode B (corresponding to a first failure mode specified in the claim): a failure which requires the ride height of the motor vehicle to be lowered, thereby discharging the fluid (oil) within the fluid cylinders.

(3) a failure mode C: a failure which requires that control be continued, with only an alarm being given, for example by a flashing light of an alarm lamp or the like.

It should be noted that the content of a disturbance corresponds to each of the disturbance modes.

Now, the fail-safe control performed by the control unit 19 based on the signal of each sensor indicating a failure when the main control unit 100 is operating normally will be described with reference to the flow chart shown in Fig. 6.

In Fig. 6, in step S1, it is decided whether a failure flag F of the main control unit 100 is "1". If the decision result in step S1 is negative, that is, if it indicates that the failure flag F is "1", the program proceeds to step S2, in which the failure determining section 51 of the main control unit 100 inputs the signal detected by each sensor as a signal, to detect a failure. Then, in step S3, a decision is made to determine whether a failure occurs based on the failure signals. If it is decided in step S3 that there is no failure, the processing is terminated. On the other hand, if it is decided in step S3 that there is a failure, the program proceeds to step S4, in which the failure mode is determined or discriminated by the failure mode determining section 52.

Then, in step S5, another decision is made to determine whether the failure mode is the failure mode B. If the decision result in step S5 is affirmative, that is, it indicates that the failure mode is the failure mode B, the failure mode B is executed in the steps that follow. In other words, the main control section stores the failure mode in step S6, which is followed by the processing in step S7, in which the failure mode execution section 53 of the main controller 100 generates a control signal that is supplied to the relay drive unit 106 via a control line 123 to open the contact 110d of the main relay 100. On the other hand, the sub-control unit 101 continuously exchanges information with the main control unit 100 via a signal line 200 to monitor an abnormality in the operation of the main control unit 100. When it is judged that the main control unit 100 is operating normally, the relay drive unit 106 is supplied with a control signal via a control line 124 like the main control unit 100, that is, a control signal by which the contact 110b of the main relay 110 is opened.

The relay drive unit 106 is arranged to control the transistor 107 in response to control signals from the main control unit 100 and the sub-control unit 101. In other words, after receiving the control signals, the relay drive unit 106 stops energizing the winding 110a of the main relay 110, thereby controlling the transistor 101. As a result, the contact 110b of the main control relay 110 is opened so that the current to the solenoid 120a of the supply/discharge control valve 120 is interrupted, thereby closing the supply/discharge control valve 120 and opening the fail-safe valve 41 at the same time. In other words, the valves 120 and 41 are electromagnetic valves, with the valve 120 being permanently closed but opening when energized and the valve 41 being permanently open but closing when energized.

Then, in step S8, an alarm is given, the alarm lamp may blink, followed by step S9, in which a drive signal is transmitted to the solenoid 37a of the discharge valve 37 via the drive unit 104, whereby the fluid (oil) is controlled to be discharged at a maximum flow rate from a fluid chamber 3c of the fluid cylinder for each wheel to lower the vehicle height of the motor vehicle. The discharge of the fluid (oil) from the fluid chamber 3c of the fluid cylinder through the discharge valve 37 is carried out while being delayed for a certain time until the shut-off valve 38 is closed by the restrictor 43 after the fail-safe valve 41 is opened. Note that the discharge valve 37 is a valve which is always closed but is opened when energized.

The main control unit 100 ends the processing, with the flag F set to "1" in step S10 after the failure mode B is executed.

On the other hand, if it is decided in step S5 that the failure mode is not the failure mode B, the program proceeds to step S11. In step S11, it is decided whether the failure mode is the failure mode A-0. If the decision result in step S11 shows that the failure mode is the failure mode A-0, the failure mode is stored in step S12, followed by processing in step S13, in which the cornering determination section 54 decides whether the vehicle is cornering based on the signal detected by the special sensors. If the decision result in step S13 shows that the vehicle is cornering, the correction section 55 prevents the failure mode execution section 53 from executes the failure mode A in response to a signal from the turning determination section 54, followed by the processing in step S7 in which the failure mode B is forcibly executed. In other words, as at the time of execution of the failure mode B, the contact 110b of the main relay 100 is opened, so the energization of the solenoid 120a of the supply/discharge control valve 120 is stopped, whereby the supply/discharge control valve 120 is closed and the fail-safe valve 41 is opened.

On the other hand, if it is decided in step S13 that the vehicle is not turning, the failure mode A is carried out as described below.

First, in step S14, the relay drive unit 106 receives a control signal for opening the contact 110b of the main relay 110 generated by the main control unit 100 and the sub-control unit 101, thereby controlling the transistor 107 in response to the control signal and stopping the energization of the coil 110a of the main relay 110. As a result, the energization of the solenoid 120a of the supply/discharge control valve 120 is stopped, similarly to the execution of the failure mode B, thereby closing the supply/discharge control valve 120 and opening the fail-safe valve 41. Then, the program proceeds to step S15, where an alarm is triggered.

The function of the turning determination section 102a of the F/S mode selection unit 102 is to determine whether or not the vehicle is turning depending on signals generated by the special sensors via the signal line 200 and as a result of comparing the signals with a predetermined value. The F/S mode selection unit 102 learns whether the failure mode is the failure mode A based on the decision result and the signal from the relay drive unit 106. Then, in step S16, the F/S mode selection unit 102 controls the drive unit 105 so that no control signal is generated for the discharge valve 37 so that the discharge valve remains closed, thereby maintaining the vehicle height of the vehicle.

After executing the failure mode A in the manner described above, the program proceeds to step S17, where the flag F is set to "1", followed by the end of the processing.

If the decision result in step S11 shows that the failure mode is not the failure mode A-0, the program proceeds to step S21 where it is decided whether the failure mode is the failure mode A-1. If the decision result in step S21 is affirmative, the program proceeds to step S13 where it is further decided whether the motor vehicle is turning, followed by the step of executing the failure mode A-0 in the manner described above. On the other hand, if the decision result in step S21 is negative, that is, if it is decided that the current failure mode is the failure mode A-1, the program proceeds to step S22 where it is decided whether the current failure mode is the failure mode C or not.

If it is decided in step S22 that the current failure mode is the failure mode C, the program proceeds to step S23 where an alarm is given, for example, by turning a light on and off, which is further followed by step S24 where the flag F is set to "1", followed by the end of the processing. On the other hand, if the decision result in step S22 shows that the current failure mode is not the failure mode C, i.e., neither the failure mode A nor the failure mode B nor the failure mode c, the program proceeds to step S25 where the processing temporarily stops.

Now, referring back to the first step of processing the fail-safe control, if the decision result in step S1 is affirmative, the program proceeds to step S18 where it is decided whether the current failure mode is the failure mode B or the failure mode A-0. On the other hand, if the decision result in step S18 is affirmative, the program proceeds to step S19 where it is decided whether the ignition switch is turned off to stop the engine. If the decision result in step If the decision result in step S19 shows that the ignition switch is off, the program proceeds to step S20 where the flag F is set to "1", followed by the end of the processing. If the decision result in step S19 shows that the ignition switch is on, that is, that the engine is running, the processing is terminated.

The following is a description of the fail-safe control performed by the main control unit 100 when the main control unit does not operate normally, for example, due to drift or other reasons.

The operation of the main control unit 100 is continuously monitored by the monitoring circuit 100a which is connected to it and by the sub-control unit 101, whereby the operation of the sub-control circuit 101 itself is monitored by the monitoring circuit 101a which is connected to it.

If the main control circuit 100 would cause an abnormal operation of its control due to drift or other reasons, the monitoring circuit 100a will notice this abnormality, thereby prohibiting the operation of the main control circuit 100. In addition, due to the exchange of information with the main control circuit 100, the sub-control unit 101 detects the abnormality of the main control unit 100, thereby transmitting a signal via a control line 124 to notify the relay drive unit 106 of this abnormality.

The relay drive unit 106 determines the abnormality of the operation of the main control unit 100 from the signal indicating such abnormality, and locks the main relay 110 in the same manner as when the failure mode is executed based on the failure signals when the main control unit is operating normally as described above. At the same time, the F/S mode selection unit 102 transmits a signal to the drive unit 105 to control the discharge valve 37 based on the signal from the relay drive unit 106 and the comparison result between the signal sampled by the special sensors and the predetermined value. In other words, the camming determination section controls 102a of the F/S mode selecting unit 102 opens the discharge valve 37 to discharge the liquid or oil from the liquid pressure chamber 3c of each fluid cylinder and lowers the vehicle height of the motor vehicle when it is judged that the motor vehicle is running on a curve from the comparison result between the signals generated by the special sensors and the predetermined value. On the other hand, when it is judged that the motor vehicle is not running on a curve, the control is performed so that the discharge valve is kept closed to maintain the current vehicle height of the motor vehicle.

The fail-safe control when the power supply causes an abnormality will now be described.

If the supply of voltage to the main control unit 100 or the sub-control unit 101 is interrupted or a certain level of voltage is not ensured due to a failure in the D/D converter 112 shown in Fig. 5, these units become out of control. Therefore, the operation of the drive unit 104 and the relay drive unit 106 cannot be guaranteed, causing the transistor 107 to turn off due to a lack of a base voltage. This further interrupts the supply of voltage to the winding 110a of the main relay 110, resulting in the state that the contact 110b is opened.

The voltage monitoring section 130 continuously monitors the output voltage of the D/D converter 112 and transmits to the F/S mode selection unit 102 a signal indicating an abnormality of the voltage immediately after such an abnormality is detected. Then, the F/S mode selection unit 102 transmits a signal to drive the discharge valve 37 to drive the drive unit 105 based on the signal indicating the abnormality of the voltage and the comparison result between the signals detected by the special sensors and the predetermined value. In other words, when it is decided that the motor vehicle is in the normal state as a result of the comparison between the signals from the special sensors and the predetermined value, the discharge valve 37 is controlled so as to lower the vehicle height of the motor vehicle in the same manner as in the case where the fail-safe control is performed when the main control unit 100 caused an abnormality in the operation. In the other case, the discharge valve 37 is controlled so as to maintain the current vehicle height of the motor vehicle.

Fig. 7 shows an example of a decision where it is decided whether the motor vehicle is running on a curve, which corresponds to the control performed by the curve determining section 54 in Fig. 4. This control corresponds to step S13 of Fig. 6.

According to Fig. 7, if either of the decision steps S41 to S48 yields an affirmative result, then it is decided in step S47 that the motor vehicle is currently running on a curve. If all decisions in steps S41 to S46 come to the conclusion that the motor vehicle is not currently running on a curve, the processing is terminated. The description of the successive decision steps S41 to S48 now follows.

First, the decision is made based on the signals from the pressure sensors 13 to determine the internal pressures within the cylinder units 5. This decision corresponds to steps S41 and S42. If it is decided in step S41 that the difference between the left cylinder units 5 and the right cylinder units 5 on the front wheel side is equal to or greater than a predetermined value (threshold value), it is determined that the vehicle is cornering. If it is decided in step S42 that the difference between the left cylinder unit 5 and the right cylinder unit 5 on the rear wheel side is equal to or greater than a predetermined value, it is determined that the vehicle is cornering.

Second, a decision is made in step S43 based on the signals from the steering angle sensor 17 to determine the steering angle of the steering wheel. It is decided that the motor vehicle is cornering (step S47) when the steering angle is equal to or greater than a certain value.

Third, in step S44, a decision is made to determine whether the transverse acceleration acting on the motor vehicle is equal to or greater than a predetermined value based on the transverse acceleration sensor 16. If it is decided in step S44 that the transverse acceleration is equal to or greater than a predetermined value, the program proceeds to step S47, where it is decided that the motor vehicle is turning.

A fourth decision is made based on the signals generated by the vehicle height sensors to determine the vehicle height of the motor vehicle at each wheel position. The vehicle height detected by the vehicle height sensor 14 is equal to a stroke of the cylinder unit 5. In other words, in step S45, a decision is made to determine whether the difference between the vehicle heights (the stroke heights) at the position of the left and right wheels of the front wheel side is equal to or greater than a certain value. If the decision result in step S45 indicates that the difference in the strokes is equal to or greater than the predetermined value, the program proceeds to step S47, where it is decided that the motor vehicle is currently turning. Similarly, in step S46, it is judged whether the difference between the vehicle heights (strokes) at the position of the left and right wheels on the rear wheel side is equal to or greater than a predetermined value, and if the decision result in step S46 indicates that the difference is equal to or greater than the predetermined value, it is determined in step S47 that the vehicle is turning.

As described above, by the present invention, the cornering of a motor vehicle can be determined extremely easily while competing with a disturbance of the sensors, whereby it is determined on the basis of a plurality of sensors or a plurality of conditions whether the motor vehicle is currently in a curve, whereby a final decision on the cornering of the motor vehicle is made on the basis of each decision result.

Fig. 8 shows another embodiment according to the present invention. Fig. 8 is a variant of Fig. 6 in which a part of the system of Fig. 6 is modified. The common elements are omitted from Fig. 8. In this embodiment, when the vehicle height of the motor vehicle is lowered, the operation of opening the discharge valve 37 is delayed until it is confirmed that the motor vehicle is brought into an almost straight running state after the main relay 110 is turned off in step S51. The decision concludes that the motor vehicle is almost straight running if either of the conditions in step S52 or step S53 is satisfied. In other words, it is decided in step S52 whether the steering angle is approximately 0, or it is decided in step S53 whether the transverse acceleration is approximately 0.

The relationship between the specific failures of the device in the supply-discharge control system for controlling the supply or discharge of the fluid and the failure modes to be determined by the failure mode determining section 52 will now be described. The failure mode occurring can be determined as either failure mode A-0, A-1, B or C, for example, under the following conditions:

1. The occurring failure mode is determined as failure mode C when the vehicle height of the motor vehicle is higher than 30 mm or higher than a reference vehicle height when the ignition switch is turned on. In this case, the fall prevention valve 41 is in its closed position. The failure at this time is considered to be a failure due to dirt having entered the shut-off valve of the fluid line 10, so that the flow of a pressure fluid or oil through the fluid pressure line 10 can clear this failure, thus smoothly performing the flow control.

2. The existing trouble mode is determined as trouble mode A-0 when the main pressure is equal to or lower than a reference pressure (30 kgf/cm²) after several seconds (for example, 5 seconds) have elapsed from the time when the ignition switch was turned on. The trouble at this time is considered to be caused by the fail-safe valve 41 being stuck in its open position, a crack in a pipe for the fluid pressure pipe 10, a trouble in the main pressure sensor 12, or the like, which are serious troubles that cannot be eliminated until repair is made.

3. The occurring trouble mode is determined as trouble mode A-0 when the output signal of the main pressure sensor 12 is equal to or greater than an upper limit voltage (4.5 V). In this case, the cause of the trouble is considered to be based on a decrease in the voltage VSS of the main pressure sensor 12.

4. The occurring trouble mode is determined as trouble mode A-1 when the output signal of the main pressure sensor 12 is equal to or lower than a lower limit voltage (0.5 V). The trouble is considered to be caused by reduction of the ground potential GND of the main pressure sensor 12. In contrast to the reduction of the voltage VSS as described in 3 above, the reduction of the ground potential GND can be eliminated in this case.

5. When the main pressure is equal to or greater than 185 kgf/cm², the abnormality occurring is considered to be the abnormality mode A-0. The cause of abnormality may be due to abnormality of the discharge valve 28 or the like. It should be noted here that the control by the control unit 19 is temporarily suspended when the main pressure is reduced to 100 kgf/cm² or lower, while the control is resumed when the main pressure reaches 110 kgf/cm².

6. The occurring failure mode is determined as failure mode A-0 when the main pressure in a certain time (for example, about 5 seconds) independent of the control does not rise by the control unit 19 which is interrupted due to the main pressure being reduced to 100 kp/cm² or lower. The cause of a malfunction may be due to malfunctions on the side of the discharge valve 28, the main pressure sensor 12, etc.

7. The occurring failure mode is determined as failure mode A-0 when the state of the main pressure P that satisfies the following condition:

P(t) - P (t-Δt) ≤ 2 kgf/cm²

(where Δt = 1 second),

lasts for ten minutes or more. This failure is considered to be caused by the signal from the main pressure sensor 12, which is fixed.

8. The occurring failure mode is determined as failure mode A-1 when the state of the main pressure P which satisfies the following condition:

P(t) - P(t-Δt) ≤ 2 kgf/cm²

(where Δt = 1 second),

continuously for 5 seconds after the relationship between the vertical acceleration G(t) of the motor vehicle and the gravitational acceleration G has satisfied the following equation:

G(t) - 1G < -0.1G

In this case, the fault is considered to be caused by the signal of the main pressure sensor 12, which is fixed, as stated above in item 7. However, the duration of the fault is 5 seconds, so that this fault can be eliminated.

9. The occurring failure mode is considered as failure mode A-1 when the status of the main pressure P that satisfies the following condition

P(t) - P(t-Δt) &le; 2 kgf/cm²

(where Δt = 1 second)

continuously for 5 seconds, such as the automotive main pressure sensor along the road to a height where the relationship between the current vehicle height H(t) and the reference vehicle height H₀ is satisfied: H(t) - H₀ < 30 mm. The cause of a failure in this case is considered to be due to a detection of the signal from the cylinder pressure sensor 13. This failure can be eliminated in the same manner as in 8 above.

10. When the main pressure is reduced to 90 kgf/cm2 or lower, the failure mode that occurs is considered to be failure mode A-1. The failure is considered to be caused due to a rupture of a pipe or the like.

11. The occurring failure mode is regarded as failure mode A-0 when an open circuit of the sensors 12 to 18 and an actuator, for example the hydraulic pressure pump 8 or the like, is detected.

12. When the output signal from the oil level sensor (not shown) for detecting the amount of oil in the tank accumulator 29 is turned off for one second, the occurring trouble mode is considered to be trouble mode A-0. The cause of trouble is considered to be a break in a pipe or the like.

13. The occurring failure mode is considered as failure mode A-0 when the output signal from the cylinder pressure sensor 13 is equal to an upper limit voltage (4.5 V) or higher. A failure caused by the cut-off of the voltage VSS of the cylinder pressure sensor 13 is considered.

14. The occurring failure mode is considered as failure mode A-0 when the output signal from the cylinder pressure sensor 13 is equal to or lower than a lower limit voltage (0.5 V). A failure caused by a reduction in the ground potential GND of the cylinder pressure sensor 13 is considered.

15. The control is temporarily suspended to prevent the backflow of oil when the cylinder pressure (+ 10 kp/cm²) becomes greater than the main pressure.

16. The occurring failure mode is considered as failure mode B if the wheel of the motor vehicle continues to impact (H(t) - H(t-Δt) > 0), in a state where the wheel is bumping (H(t) - H�0 > 0), and in the state where the cylinder pressure has increased (P(t) - P(t)-Δt)) > 0), continuously lasts for 300 ms (0.3 seconds) or more. A disturbance caused by detection of the inflow into the port control valve 9 is considered. In this case, since control cannot be performed so that the predetermined vehicle heights are equal to each other at all four wheel positions, the vehicle heights are set to be equal to each other at all four wheel positions in a state where the fluid cylinders 5 are maximally contracted, thereby discharging the fluid or oil within the fluid cylinders for the respective wheels.

17. The failure mode occurring is determined as failure mode B when the wheel of the motor vehicle continues to fall back ((H(t) - H(t-Δt) < 0) in a state where the wheel falls back (H(t) - H�0 < 0) and in the state where the cylinder pressure has been reduced (P(t) - P(t-Δt)) < 0) continuously lasts for 300 ms (0.3 seconds) or more. A failure caused by detecting the discharge from the flow control valve 9 is considered. In this case, control to have predetermined vehicle heights identical to each other at all four wheel positions in the manner as in item 16 above cannot be performed, so that the vehicle height of the motor vehicle should be lowered.

18. When the wheel impacts at a rate of 30 mm or greater, and the condition where the cylinder pressure is 30 kg/cm2 or less has continued for 300 ms (0.3 seconds) or more, the failure mode that occurs is determined to be failure mode B. The cause of failure is the seizure of the inflow into the flow valve 9 as specified in item 16.

19. When the wheel falls back at the rate of 60 mm or more and the condition where the cylinder pressure is 100 kgf/cm² or more continuously for 300 ms (0.3 seconds) or more lasted, the occurring fault mode is defined as fault mode B. The cause of a fault lies in the blocking of the discharge from the flow valve 9, as above under number 17.

20. The occurring failure mode is interpreted as failure mode A-0 when the output signal from the vehicle height sensor 14 is equal to or greater than an upper limit voltage (4.5 V). A failure caused by cutting the voltage VSS of the vehicle height sensor 14 is considered.

21. The occurring failure mode is determined as failure mode A-0 when the output signal from the vehicle height sensor 14 is equal to or lower than a lower limit voltage (0.5 V). A failure caused by decrease of the ground potential GND of the vehicle height sensor 14 is considered.

22. When the output signal of the vehicle height sensor 14 does not change for three seconds after the vertical acceleration of a certain wheel reaches the specified value (0.1 G) or higher, the occurring trouble mode is determined to be trouble mode A-1. The cause of a trouble is the stuck signal of the vehicle height sensor 14, and this trouble can be eliminated.

23. The occurring failure mode is determined as failure mode A-0 when the state in which the output signal from the vertical acceleration sensor 15 is equal to or higher than an upper limit voltage (4.5 V) has continued for one second or more. A failure caused by a decrease in the voltage VSS of the vertical acceleration sensor 15 is considered.

24. The occurring failure mode is determined as failure mode A-0 when the state in which the output signal from the vertical acceleration sensor 15 is equal to or lower than a lower limit voltage (0.5 V) has continued for one second or more. A failure caused by reduction of the ground potential GND of the vertical acceleration sensor 15 is then considered.

25. The occurring disturbance mode is determined as disturbance mode A-1 when the state has continued for 500 ms in which the output signal from one vertical acceleration sensor 15 has not varied from the output signal generated 100 ms previously, although the other two or three vertical acceleration sensors 15 have changed their output signals generated 100 ms previously. The cause of a disturbance is considered to be due to the signal from the vertical acceleration sensor 15 being stuck, and this disturbance can be eliminated.

26. If the output signal from the vehicle height sensor 14 does not come close to the reference value after 10 minutes, the trouble mode that occurs is considered to be trouble mode A-1. A trouble can be considered to be caused by the signal from the vehicle height sensor 14 being stuck, the flow control valve 19 being stuck in its closed state, or the like. However, this trouble can be eliminated in the same manner as in the case where the signal from the vehicle height sensor 14 is stuck.

27. The occurring failure mode is considered to be failure mode A-0 when the state in which the output signal from the transverse acceleration sensor 16 is equal to or greater than an upper limit voltage (4.5 V) has continued for one second or more. A failure caused by the reduction of the voltage VSS of the transverse acceleration sensor 16 is considered.

28. The occurring failure mode is considered to be failure mode A-0 when the state in which the output signal from the transverse acceleration sensor 16 is equal to or lower than a lower limit voltage (0.5 V) has continued for one second or more. A failure is considered to have been caused by a reduction in the ground potential GND of the transverse acceleration sensor 16.

29. The occurring failure mode is considered as failure mode A-0 when the output signal from the steering angle sensor 17 is equal to or greater than an upper limit voltage (4.5 V). A failure caused by reduction of the voltage VSS and the steering angle sensor 17 is considered.

30. The occurring trouble mode is considered as trouble mode A-0 when the output signal from the steering angle sensor 17 is equal to or lower than a lower limit voltage (0.5 V). A trouble is considered to be caused by reduction of the ground potential GND of the steering angle sensor 17.

31. The failure mode occurring is considered to be failure mode C when each of the vehicle speeds is actuated by the output signal from each of the two vehicle speed sensors 18 and the difference between the actuated vehicle speeds is equal to or greater than a certain value. The vehicle speed is used in a control system to improve the response of each fluid cylinder 3 during cornering, whereby control is performed by the control unit 19 over the flow rate of each of the fluid cylinders 3. However, the vehicle speed is merely a secondary element in the control system, so that it is not required to terminate the control over the flow rate even if the wrong vehicle speed should be detected.

32. A failure in the central processing unit (CPU) is fault mode A-0.

The above description is directed to preferred embodiments of the present invention. It should be noted, however, that a decision to determine whether the vehicle is cornering may be made in a suitable manner in addition to the measures described above, for example by using a sensor, advantageously making use of the difference in vertical acceleration between the left and right sides of the motor vehicle (by using a pair of left and right vertical acceleration sensors) or by advantageously making use of the difference in wheel speed between the left and right wheels (by using the pair of left and right rotation sensors).

Claims (28)

1. Wheel suspension system for a motor vehicle, comprising: a cylinder unit (3) arranged between a sprung mass (1) and an unsprung mass (2) for each wheel; a fluid supply-discharge device (8, 9, 29) for supplying and discharging an actuating fluid to or from this cylinder unit (3); and a first control device (19; 100) for controlling at least a vehicle height by controlling the fluid supply-discharge device (8, 9, 29) under a certain condition; marked by a failure detecting means (51, 52) for detecting the occurrence of a failure which hinders the normal execution of the control by the first control means; a control interrupting means (53) for inhibiting the control by the first control means when the failure is detected by the failure detecting means; a second control device (120) for controlling the fluid supply-discharge device in response to the fault detected by the fault detection device when the control by the first control device is prohibited by the control interruption device; a cornering determination device for determining the cornering of the motor vehicle; and a correction device (55) for correcting the control by the second control device to dispense with a function for maintaining the vehicle height when the cornering determination device determines the cornering of the vehicle. 2. A suspension system according to claim 1, wherein the correcting means corrects the control by the second control means (120) so as to lower a vehicle height of the motor vehicle (1) while forcibly discharging the actuating fluid from the cylinder unit (3). 3. Wheel suspension system according to claim 1 or 2, wherein the cornering of the motor vehicle (1) is determined by a steering angle (sensor 17) of a steering wheel. 4. Wheel suspension system according to one of claims 1 to 3, wherein the cornering of the motor vehicle (1) is determined by a difference in the internal pressure between a left cylinder unit (3FL, 3RL) and a right cylinder unit (3FR, 3RR). 5. Wheel suspension system according to one of claims 1 to 4, wherein the cornering of the motor vehicle (1) is determined by a magnitude of the transverse acceleration acting on the motor vehicle (1). 6. Wheel suspension system according to one of claims 1 to 5, wherein the cornering of the motor vehicle (1) is determined by a difference in the lifting height between a left cylinder unit and a right cylinder unit. 7. Wheel suspension system according to one of claims 1 to 6, wherein a plurality of cornering determination devices (13, 16, 17, 54, 102a) are provided, and a decision is made on cornering if one of the cornering determination devices determines the cornering of the motor vehicle (1). 8. A wheel suspension system according to any one of claims 1 to 7, wherein the correction by the correction means (55) is carried out when a steering angle of a steering wheel is approximately zero. 9. A suspension system according to claim 2 or 8, wherein the correction by the correction means (55) is carried out at the time when the steering angle reaches approximately zero after the control is interrupted by the control interrupting means (53). 10. Wheel suspension system according to one of claims 1 to 9, wherein the correction is carried out by the correction device (55) when a transverse acceleration acting on the motor vehicle (1) is approximately zero. 11. A suspension system according to claim 10, wherein the correction by the correction means (55) is carried out at the time when the transverse acceleration reaches approximately zero after the control is interrupted by the control interrupting means (53). 12. Wheel suspension system according to one of claims 2 to 11, wherein: the delivery-discharge device has a delivery control valve (35) and a discharge control valve (37), which can be controlled separately and independently of one another; and the discharge of the actuating fluid for lowering the vehicle height is carried out by closing the delivery control valve (35) and by opening the discharge control valve (37). 13. A suspension system according to claim 12, wherein the unloading control valve (37) assumes a maximum opening angle when the vehicle height is lowered. 14. A wheel suspension system according to any one of claims 2 to 13, further comprising an internal pressure maintaining device for regulating an internal pressure within the cylinder unit (3) so as to achieve a value equal to or greater than a predetermined value when the vehicle height is lowered. 15. Wheel suspension system according to claim 2 or 4, wherein a decision is made as to cornering of the motor vehicle (1) if a difference in the internal pressure between a left cylinder unit (3FL, 3RL) and a right cylinder unit (3FR, 3RR) is equal to or greater than a predetermined value. 16. Wheel suspension system according to claim 15, wherein a cornering of the motor vehicle (1) is decided if at least one of two conditions applies, these two conditions being: the first condition is a difference in internal pressure between the left cylinder unit (3FL) and the right cylinder unit (3FR) at the front of the motor vehicle (1); and the second condition is a difference in internal pressure between the left cylinder unit (3RL) and the right cylinder unit (3RR) at its rear. 17. Wheel suspension system according to one of claims 1 to 16, with: a decision means (52) for deciding to determine whether the failure is in a first failure mode or in a second failure mode depending on the output signal from the failure determination means (51), wherein the first failure mode interrupts the first control means (19; 100) in a state in which a vehicle height of a motor vehicle (1) is lowered, the actuating fluid within the cylinder unit (3) is discharged, and the second failure mode interrupts the control by the first control means (19; 100) while maintaining a current vehicle height; an execution means (53) for executing the fault mode determined by the decision means ; a differential pressure detection device (102) for determining a difference in the internal pressure between a left cylinder unit (3FL, 3RL) and a right cylinder unit (3FR, 3RR); and wherein the correction means allows the execution means (53) to execute the first failure mode before a decision by the decision means (52) when a difference in internal pressure equal to or greater than a predetermined value is detected by the difference pressure detection means (102). 18. A suspension system according to claim 17, wherein the first failure mode is executed by closing the supply control valve (35) and opening the unloading control valve (37). 19. A suspension system according to claim 17 or 18, wherein the second failure mode is executed by closing both the supply control valve (35) and the unloading control valve (37). 20. Wheel suspension system according to one of claims 17 to 19, wherein: each delivery control valve (35) and discharge control valve (37) is an electromagnetic valve; the delivery control valve (35) is always closed, but is opened when it is energized; and the supply of a supply voltage (3) to the delivery control valve (35) is forcibly switched off when a fault is detected by the fault detection device (51). 21. A wheel suspension system according to claim 20, wherein the supply voltage (103) is arranged to be continuously supplied to the discharge control valve (37) from a battery voltage source. 22. A wheel suspension system according to claim 20 or 21, wherein: the first control device comprises a first control section (100) and a second control section (101, 102), wherein the first control section (100) executes the control, to open or close the supply control valve (35) and the discharge control valve (37), and the second control section (101, 102) executes the control to open or close the discharge control valve (37); the supply voltage (103) from the battery voltage source is continuously applied to the second control section (101, 102); and the second control section (101, 102) is arranged to open the discharge control valve (37) when a fault is decided as the first fault mode by the decision device (52) due to an occurrence of the fault in the first control section (100). 23. A wheel suspension system according to any one of claims 16 to 22, wherein the fluid supply/discharge device comprises: a pump (8) for converting a low-pressure actuating fluid in the tank storage (26) into a high-pressure actuating fluid; a high pressure line (10) for supplying the high pressure actuating fluid to each cylinder unit (3) through the pump (8); a low-pressure line (36) for returning the actuating fluid within the cylinder units (3) to the tank storage (29); a supply control valve (35) connected to the high pressure line (10), which is an electro-magnetic valve capable of separately and independently supplying the actuating fluid to each cylinder unit (3); a discharge control valve (37) connected to the low pressure line (36), the valve being an electromagnetic valve capable of separately and independently discharging the actuating fluid from each cylinder unit (3); wherein the first control means controls the opening and closing of the supply control valve (35) and the discharge control valve (37) under the predetermined condition. 24. Wheel suspension system according to one of claims 1 to 23, further comprising a fail-safe valve (41) for forcibly relieving the high pressure line (10) to the tank accumulator (29) when the fault is detected by the fault detection device (51, 52). 25. A wheel suspension system according to claim 23 or 24, further comprising a valve unit (44) for preventing the internal pressure within the cylinder unit (3) from falling below a predetermined value, whereby the discharge of the actuating fluid from the cylinder unit (3) is regulated. 26. Wheel suspension system according to one of claims 23 to 25, wherein a gas spring (5) is connected separately and independently to each cylinder unit (3). 27. Wheel suspension system according to claim 26, wherein an opening (25) is arranged between each cylinder unit (3) and the corresponding gas spring (5). 28. Wheel suspension system according to one of claims 25 to 27, wherein a valve unit (38) for maintaining the internal pressure is closed when the pressure within the high-pressure line (10) acts as a pilot pressure and when the pressure within the high-pressure line (10) is equal to or less than a predetermined value.