Electric vehicle and corresponding control method

Abstract

An electrically driven motor vehicle (V) comprises an axle and a vehicle communication network (10). The axle comprises two inverter devices (N1, N2) coupled to respective electric motors (M1, M2) to drive respective drive wheels. Each inverter device (N1, N2) comprises a respective electronic control unit (E1, E2). The two electronic control units exchange messages via a vehicle communication network (10). The first electronic control unit detects a fault (F) in the respective inverter device (N1) and / or the respective electric motor (M1). If a fault is detected, the first electronic control unit switches from a normal operating state (S0) to a secure operating state (S1, S2) and sends a secure state request message via a vehicle communication network (10). The second electronic control unit receives the secure state request message and switches from the normal operating state (S0) to the secure operating state (S1, S2) in response to the received secure state request message.

Description

Technical Field

[0001] The present invention generally relates to an electric drive motor vehicle equipped with a drive axle or a drive axle (also referred to as an "eAxle"), which drive axle or drive axle includes a pair of electric propulsion units (also referred to as "eDrive" or "eDrive subsystem"). Each electric propulsion unit includes a drive inverter device and an electric motor connected to the drive wheels of the motor vehicle.

[0002] Specifically, the present invention relates to a method for controlling two propulsion units of an axle in a synchronous and / or coordinated manner, in particular a method for controlling two inverters. Background Art

[0003] An electric drive motor vehicle equipped with two propulsion units mounted on the same axle and each propulsion unit connected to a drive wheel is known in the art. For example, document US 5481460 discloses a controller for an electric vehicle, in which the left drive wheel and the right drive wheel are driven by respective electric motors.

[0004] In such a vehicle, when a malfunction (e.g., an error or a failure) is detected in one of the inverters or one of the electric motors, it is necessary to synchronize and / or coordinate the operation of the two electric motors mounted on the same axle, and in particular to synchronize and / or coordinate the driving of the respective inverters.

[0005] For automotive applications, especially for high-performance vehicles, the first known solution for synchronizing and / or coordinating the operation of two inverters at a sufficiently high frequency involves implementing a dedicated communication channel between the two inverters. However, this solution requires implementing specific hardware, such as a Zip-wire communication channel, thereby increasing the complexity and cost of the system, as well as increasing the possible sources of failure.

[0006] Another known solution for synchronizing and / or coordinating the operation of two inverters alternatively involves implementing another electronic control unit (in addition to the two electronic control units already provided in the two inverters), also referred to as a "hybrid control unit" or "HCU", which is connected to the two inverters via a vehicle network and manages their operation. However, this solution determines an increase in the communication time between the inverters, thereby increasing the reaction time of the control system, and is therefore not suitable for application to high-performance vehicles, in which the electric motors operate at high speeds and generate high torque, and any delay in the synchronization and / or coordination of the respective inverters may result in a loss of vehicle stability.

[0007] Accordingly, it is desirable to have an electric drive motor vehicle equipped with two propulsion units mounted on the same axle and equipped with an improved inverter synchronization and / or coordination system.

[0008] Object of the Invention

[0009] The object of the present invention is to provide a motor vehicle equipped with such an improved electric drive system that allows for the rapid synchronization and / or coordination of the operation of two drive axle inverters, particularly when a fault is detected in one of the inverters or one of the electric motors, and is thus suitable for high-performance vehicles. Summary of the Invention

[0010] According to a first aspect, the subject matter of the present invention is an electric drive motor vehicle comprising an axle and a vehicle communication network. The axle includes a first inverter device coupled to a first electric motor to drive a first drive wheel and a second inverter device coupled to a second electric motor to drive a second drive wheel. The first inverter device includes a first electronic control unit, and the second inverter device includes a second electronic control unit. The first electronic control unit and the second electronic control unit are coupled to the vehicle communication network and are configured to exchange messages via the vehicle communication network. The first electronic control unit is configured to detect a fault in the first inverter device and / or the first electric motor, and in response to the detected fault, switch from a normal operating state to a safe operating state in which the first electric motor is deactivated and send a safety status request message via the vehicle communication network. The second electronic control unit is configured to receive the safety status request message via the vehicle communication network and, in response to the received safety status request message, switch from a normal operating state to a safe operating state in which the second electric motor is deactivated.

[0011] As can be seen in more detail from the following description, the basic idea behind the present invention is that when a fault or anomaly is detected in one of the two inverters, the two inverters driving the drive wheels of the same vehicle axle are synchronously (and optionally coordinated) switched to a safe state by using the vehicle communication network.

[0012] In a preferred embodiment, the first electronic control unit is configured to execute a control program in response to detecting a fault and, if the control program confirms the existence of a fault, switch to the safe operating state and send a safety status request message.

[0013] In a preferred embodiment, the first electronic control unit is configured to switch from the normal operating state to a first safe operating state or a second safe operating state according to the operating conditions of the first inverter device and / or the first electric motor sensed at the moment when the fault is detected.

[0014] In a preferred embodiment, the second electronic control unit is configured to switch from a normal operating state to a first safe operating state or a second safe operating state. The first electronic control unit is further configured to send a status message via a vehicle communication network, the status message indicating which one of the first safe operating state and the second safe operating state the first electronic control unit has switched to. The second electronic control unit is further configured to receive the status message via the vehicle communication network and, in response to the received status message, switch from the normal operating state to the same safe operating state indicated by the status message.

[0015] In a preferred embodiment, the first electronic control unit is configured to switch between a first safe operating state and a second safe operating state according to the operating conditions of the first inverter device and / or the first electric motor.

[0016] In a preferred embodiment, in the first safe operating state, the first inverter device is driven such that all switches of the half - bridge of the first inverter device are turned off.

[0017] In a preferred embodiment, in the second safe operating state, the first inverter device is driven in such a way that all high - side switches of the half - bridge of the first inverter device are closed and all low - side switches of the half - bridge of the first inverter device are turned off, or all low - side switches of the half - bridge of the first inverter device are closed and all high - side switches of the half - bridge of the first inverter device are turned off.

[0018] In a preferred embodiment, the vehicle communication network includes a Controller Area Network (CAN) type bus and optionally includes a motor vehicle propulsion control bus.

[0019] In a preferred embodiment, the second electronic control unit is configured to detect the loss of communication with the first electronic control unit via the vehicle communication network and, in response to detecting the loss of communication, switch from the normal operating state to a safe operating state.

[0020] In a preferred embodiment, the first electronic control unit includes a hardware circuit configured to force the first electronic control unit to switch from the normal operating state to a safe operating state in response to a critical fault occurring in the first electronic control unit.

[0021] According to a second aspect, the subject matter of the present invention is a method for controlling a motor vehicle according to one or more embodiments. The method includes:

[0022] - Detecting a fault in the first inverter device and / or the first electric motor of the vehicle;

[0023] - In response to detecting a fault, switch the first electronic control unit from the normal operating state to a safe operating state in which the first electric motor is deactivated, and send a safety status request message from the first electronic control unit via the vehicle communication network;

[0024] - Receive the safety status request message at the second electronic control unit via the vehicle communication network; and

[0025] - In response to receiving the safety status request message, switch the second electronic control unit from the normal operating state to a safe operating state in which the second electric motor is deactivated. Detailed implementation

[0026] Other features and advantages of the present invention will become apparent from the following description with reference to the accompanying drawings, which are provided only as non-limiting examples, wherein:

[0027] - Figure 1 is a block diagram of an inverter for driving an electric vehicle; and

[0028] - Figure 2 and Figure 3 is a block diagram of a drive system of an electric vehicle including two electric propulsion units on the same axle.

[0029] In the accompanying drawings herein, corresponding components are denoted by the same reference numerals.

[0030] As expected, one or more embodiments can be applied to the field of electric drive vehicles, particularly high-performance vehicles, which are equipped with an axle including two electric propulsion units, each electric propulsion unit including an electric motor and an inverter. The present invention relates to a method for synchronizing and / or coordinating the operation of two inverters when a fault (e.g., a failure or an error) is detected in one of the two inverters and / or in one of the two electric motors. In such a case, the rapid synchronization and / or coordination of the operation of the two inverters helps to maintain the stability of the vehicle while in motion.

[0031] Figure 1is a block diagram showing the operation of an electronic control unit E (also referred to as "motor control processor" or "MCP", possibly implemented by a microcontroller) of an inverter N that powers an electric motor of an axle of a motor vehicle. The control unit E of the inverter N typically operates in an operating state (or running state) S0, i.e., the "normal" state used when no anomalies or faults are detected in the system. In response to the control unit E detecting a fault F, the control unit E switches to a safe operating state, in which the inverter N is driven so as to cut off the power supply to the corresponding electric motor. Specifically, the control unit E can switch to a first safe operating state S1 or a second safe operating state S2 depending on the operating condition of the system sensed at the moment the fault F is detected. For example, if the supply voltage of the inverter N is below a specific threshold (e.g., equal to 60 V), the unit E can switch to the safe operating state S1, and if the supply voltage of the inverter N is above this threshold, the unit E can switch to the safe operating state S2. The two safe operating states S1 and S2 are different because they correspond to different drive configurations of the inverter N. Specifically, the operating state S1 can correspond to the so-called "six-switch open" or 6SO state, in which all six switches of the three half-bridges of the inverter N are in a high-impedance state (i.e., open). The operating state S2 can alternatively correspond to the so-called "three-phase short-circuit" or 3PS state, in which all three low-side switches (or all three high-side switches) of the three half-bridges of the inverter N are in a low-impedance state (i.e., closed), and all three high-side switches (or all three low-side switches) of the three half-bridges in the inverter N are in a high-impedance state (i.e., open), thereby short-circuiting the three phases of the electric motor at the same voltage. Additionally, the control unit E can switch from one safe operating state to another (i.e., from S1 to S2 and vice versa) in response to a change in the operating condition (e.g., if the supply voltage of the inverter N exceeds the threshold, or in response to a different trigger). Typically, the control unit E of each inverter is equipped with local control logic that allows switching between the operating states S0, S1, and S2 depending on faults and / or operating conditions that may be detected.

[0032] In some applications, an electric motor vehicle includes two electric propulsion units (right and left) mounted on the same axle, one for each driving wheel, as Figure 2 shown. Figure 2 is a block diagram showing some components of a motor vehicle according to the present invention. Specifically, Figure 2Shows the electronic control unit E1 of the first inverter N1 and the electronic control unit E2 of the second inverter N2 (also referred to as "motor control processor" or "MCP"). In this case, communication needs to be implemented between the two electronic control units E1 and E2 of the two inverters N1 and N2 in order to synchronize and / or coordinate their operations. In various embodiments, the control units E1 and E2 do not communicate via a dedicated communication channel (such as a Zip-wire), but are coupled to a vehicle communication bus or network 10, which can be the CAN (Controller Area Network) bus of the vehicle propulsion system. Each control unit E1, E2 implements control functions for managing faults and is configured to exchange CAN messages via the bus 10 (for example, by sending one or more broadcast messages or "frames") for synchronizing and / or coordinating operations with the other control unit when a fault is detected. Specifically, the message exchange between the units E1 and E2 via the (CAN) bus 10 can be carried out at a relatively high speed to ensure a fast response time. For example, the message exchange between the left inverter and the right inverter can be carried out within a time limit of 2 ms.

[0033] When a fault F is detected in the inverter N1 (or the electric motor coupled thereto), the inverter N1 reacts by implementing a recovery mode as shown in Figure 1 That is, according to the operating conditions of the inverter or the electric motor detected at that time, it switches from the normal operating state S0 to the safe operating state S1 or S2. At the same time, the control unit E1 sends a (broadcast) message requesting operation in the safe state ("safe state request" message, or simply SSR message) via the bus 10, which is received by the control unit E2 of the second inverter N2. After receiving this message, the control unit E2 forces the second inverter N2 to switch to the safe operating state to ensure that there is no imbalance in the torque provided by the two electric motors on the same axle and to allow the vehicle to stabilize within a short period of time (for example, 70 ms).

[0034] Specifically, if a fault is detected in one of the two propulsion units (i.e., inverter N1 or the motor associated therewith), the corresponding inverter N1 can execute a control program to confirm whether an error exists. This control program can be completed within a confirmation time T1, which can be approximately 40 ms or shorter. Once an error is confirmed, inverter N1 switches to a safe operating state S1 or S2, for which an execution time T3 is spent, and this execution time T3 can be approximately 12 ms or shorter. At the same time, once an error is confirmed, inverter N1 sends an SSR message via bus 10 for reception by the second inverter N2. When the second inverter N2 receives the SSR message from bus 10, it can verify the reception of the message within a certain communication time T2 (e.g., after a certain number of sampling intervals, such as two sampling intervals), and this communication time T2 can be approximately 10 ms or shorter. Once the SSR message is verified by inverter N2, the control unit E2 forces inverter N2 to switch to a safe operating state S1 or S2, for which an execution time T3 is spent, and this execution time T3 can also be approximately 12 ms or shorter. Considering the indicated values of times T1, T2, and T3 discussed herein, the present invention allows the two inverters N1 and N2 (left and right) of the same axle to operate in a safe operating state within a total reaction time that can be approximately 62 ms or shorter starting from when a fault is detected in one propulsion unit or the other.

[0035] In some embodiments, the control units E1 and E2 of inverters N1 and N2 are configured to implement a synchronous switch to a safe operating state even in the case of a loss of communication between the two inverters and / or in the case of a critical failure in one of the control units. Specifically, each control unit E1, E2 can be configured to detect the loss of communication with the other control unit (e.g., by implementing a watchdog function, i.e., by detecting that the other controller has not sent a signal for a time exceeding a specific duration). In response to the detected loss of communication, the control unit forces the operating state of the corresponding inverter to switch to a safe operating state (S1 or S2) by selecting one or the other safe state according to its internal logic. This function also applies to the case of a critical failure in one of the control units: in this case, a dedicated hardware circuit can force the faulty control unit to switch to a safe operating state, and if the failure prevents the control unit from communicating via bus 10, then once the loss of communication is detected, the other control unit will also switch to a safe operating state.

[0036] In some embodiments, the SSR messages exchanged between inverters N1 and N2 via bus 10 simply indicate that the operating state of the inverters needs to be switched to a safe operating state. The implementation of the recovery mode and the choice of which safe state (S1 or S2) must be implemented are determined independently of each other by the local logic of each inverter, and thus synchronization of the behavior of the two inverters can be achieved. However, it has been noted that the two safe operating states S1 (six switches open, 6SO) and S2 (three-phase short circuit, 3PS) of the inverter have different effects on the driving of the motor. Specifically, the 3PS state generates a negative torque on the drive shaft (and thus, if the drive system does not have a drive disconnection system, a negative torque is also generated on the wheels connected to the drive shaft), and its value decreases as the engine speed increases. The 6SO state, alternatively, induces a back-EMF voltage, whose value increases linearly as the engine speed increases. If the back-EMF voltage is lower than the DC-link voltage of the inverter, i.e., lower than the voltage provided by the vehicle's drive battery (e.g., about 800V), the 6SO state does not generate any torque on the drive shaft; conversely, if implemented when the engine is running at a threshold speed greater than the back-EMF voltage is greater than the DC-link voltage of the inverter, the 6SO state generates a torque on the motor shaft, whose value increases linearly as the engine speed increases. Therefore, implementing different safe operating states between the two inverters of the same axle (e.g., state S1 in inverter N1 and state S2 in inverter N2, and vice versa) may, in some cases, result in different torque values being applied to the two drive wheels, with the risk of causing the vehicle to be unstable while driving.

[0037] In general, it has been noted that for most of the driving time of a motor vehicle, the rotational speeds of the two electric motors (right and left) are almost the same, such that in most cases where an inverter sends an SSR message after a fault is detected, the two inverters will switch to the same safe operating state (S1 or S2), even though the choice of the safe state is independently delegated to the internal logic of each inverter (i.e., when there is synchronization of the activation of the safe state, but not replication or mirroring of the behavior (i.e., actual coordination) between the two inverters).

[0038] However, in some cases, when a fault is detected, e.g., due to wheel slip or cornering, the two electric motors may run at different speeds. In these cases, the different speeds of the two motors can determine that the two inverters implement two different safe operating states. In other cases, a fault may occur that prevents one of the two inverters from implementing the 6SO state, such that in the case of a request to implement a safe state, even at low speed, that inverter will implement the 3PS state while the other inverter will implement the 6SO state. Thus, in various embodiments, the inverter that detects the fault not only conveys an SSR message requesting that the other inverter generally implement a recovery mode, but also conveys the type of safe operating state (S1 or S2) that is implemented. This functionality can be implemented by setting the value of a specific field of the CAN SSR message, or by sending a second (broadcast) message via bus 10 that conveys further information about the type of safe operating state that is implemented. In this way, the second inverter receives a request to switch to a safe operating state and an indication of which safe state to implement from bus 10, and the internal logic of the second inverter is "bypassed" to directly implement the safe state requested by the first inverter. Thus, the behavior of the second inverter reflects the behavior of the first inverter, resulting in true coordination and avoiding the application of different torque values to the two drive wheels.

[0039] Figure 3 is a block diagram showing a motor vehicle V equipped with the system described herein, wherein an axle (in this case at the rear, but possibly at the front) is provided with two inverters N1, N2, each inverter controlling a respective electric motor M1, M2 connected to a respective drive wheel of the vehicle.

[0040] The invention described herein is advantageous because it allows the synchronization and / or coordination of the operation of two electric propulsion units mounted on the same axle of a motor vehicle in the event of a detected fault, without the need to implement a dedicated communication channel between the two inverters (and thus reducing the complexity and cost of the system, as well as the complexity and cost of the packaging). The invention allows such synchronization and / or coordination of the inverters to be obtained with a low reaction time, which also applies to ensuring vehicle stability and improving driving safety, even in the case of high-performance vehicles.

[0041] Of course, without prejudice to the principles of the invention, the construction details and embodiments can vary widely with respect to what has been described and illustrated purely by way of example, without thereby departing from the scope of the invention as defined in the appended claims.

Claims

1. An electric-driven motor vehicle (V), comprising: An axle, which includes a first inverter device (N1) coupled to a first electric motor (M1) to drive a first drive wheel and a second inverter device (N2) coupled to a second electric motor (M2) to drive a second drive wheel, wherein the first inverter device (N1) includes a first electronic control unit (E1), and the second inverter device (N2) includes a second electronic control unit (E2); and A vehicle communication network (10); wherein the first electronic control unit (E1) and the second electronic control unit (E2) are coupled to the vehicle communication network (10) and are configured to exchange messages via the vehicle communication network (10), and wherein the first electronic control unit (E1) is configured to: - Detect a fault (F) in the first inverter device (N1) and / or the first electric motor (M1); and - In response to detecting the fault (F), switch from a normal operation state (S0) to a safe operation state (S1, S2) in which the first electric motor (M1) is deactivated and send a safety status request message via the vehicle communication network (10); and wherein the second electronic control unit (E2) is configured to: - Receive the safety status request message via the vehicle communication network (10); and - In response to receiving the safety status request message, switch from the normal operation state (S0) to a safe operation state (S1, S2) in which the second electric motor (M1) is deactivated.

2. The motor vehicle (V) according to claim 1, wherein, The first electronic control unit (E1) is configured to: - Execute a control program in response to the detected fault (F), - If the control program confirms the existence of the fault (F), switch to the safe operation state (S1, S2) and send the safety status request message.

3. The motor vehicle (V) according to claim 1 or 2, wherein, The first electronic control unit (E1) is configured to switch from the normal operation state (S0) to a first safe operation state (S1) or a second safe operation state (S2) according to the operating conditions of the first inverter device (N1) and / or the first electric motor (M1) sensed at the moment when the fault (F) is detected.

4. The motor vehicle (V) according to claim 3, wherein: The second electronic control unit (E2) is configured to switch from the normal operation state (S0) to the first safe operation state (S1) or to the second safe operation state (S2); The first electronic control unit (E1) is configured to send a status message via the vehicle communication network (10), the status message indicating which one of the first safe operation state (S1) and the second safe operation state (S2) the first electronic control unit (E1) has switched to; and The second electronic control unit (E2) is configured to: - Receive the status message via the vehicle communication network (10); and - In response to receiving the status message, switch from the normal operation state (S0) to the same safe operation state (S1, S2) indicated by the status message.

5. The motor vehicle (V) according to any one of the preceding claims, wherein, The first electronic control unit (E1) is configured to switch between the first safe operating state (S1) and the second safe operating state (S2) according to the operating conditions of the first inverter device (N1) and / or the first electric motor (M1).

6. The motor vehicle (V) according to any one of the preceding claims, wherein, In the first safe operating state (S1), the first inverter device (N1) is driven such that all switches of the half-bridge of the first inverter device (N1) are turned off.

7. The motor vehicle (V) according to any one of the preceding claims, wherein, In the second safe operating state (S2), the first inverter device (N1) is driven such that all high-side switches of the half-bridge of the first inverter device (N1) are closed and all low-side switches of the half-bridge of the first inverter device (N1) are turned off, or all low-side switches of the half-bridge of the first inverter device (N1) are closed and all high-side switches of the half-bridge of the first inverter device (N1) are turned off.

8. The motor vehicle (V) according to any one of the preceding claims, wherein, The vehicle communication network (10) includes a Controller Area Network CAN bus, preferably a propulsion control bus of a motor vehicle (V).

9. The motor vehicle (V) according to any one of the preceding claims, wherein, The second electronic control unit (E2) is configured to: - Detect the loss of communication with the first electronic control unit (E1) via the vehicle communication network (10); and - In response to detecting the loss of communication, switch from the normal operating state (S0) to the safe operating state (S1, S2).

10. The motor vehicle (V) according to any one of the preceding claims, wherein, The first electronic control unit (E1) includes a hardware circuit configured to force the first electronic control unit (E1) to switch from the normal operating state (S0) to the safe operating state (S1, S2) in response to a critical fault occurring in the first electronic control unit (E1).

11. A method for controlling a motor vehicle (V) according to any one of the preceding claims, the method comprising: - Detect a fault (F) in the first inverter device (N1) and / or the first electric motor (M1); - In response to detecting the fault (F), switch the first electronic control unit (E1) from the normal operating state (S0) to the safe operating state (S1, S2) in which the first electric motor (M1) is not activated, and send a safety state request message from the first electronic control unit (E2) via the vehicle communication network (10); - Receive the safety state request message at the second electronic control unit (E2) via the vehicle communication network (10); and - In response to receiving the safety state request message, switch the second electronic control unit (E2) from the normal operating state (S0) to the safe operating state (S1, S2) in which the second electric motor (M1) is not activated.

Images