WATCHDOG CONTROL UNIT

Abstract

Watchdog control unit (218) for an electrically powered vehicle (200), wherein the control unit (218) comprises the following: Input means configured to receive a first input indicating at least one vehicle control input, and a second input indicating vehicle acceleration and / or vehicle rotation rate (200), the second input indicating a vehicle yaw rate; and Control means that are communicatively coupled with the input means, wherein the control means are operable to initiate operation of the vehicle (200) in a safe mode when a fault condition is detected, wherein the fault condition is detected depending on the first and the second input, where the functionality of the vehicle (200) is at least partially restricted when the vehicle (200) is operated in safe mode.

Description

TECHNICAL AREA

[0001] The present disclosure relates to a watchdog and, in particular, but not exclusively, to a watchdog control unit for a vehicle. Aspects of the invention relate to a control unit, a non-transient computer-readable medium, a computer program product, a processor, and a vehicle. STATE OF THE ART

[0002] In modern motor vehicles, critical components such as engines, brakes, and steering actuators are often controlled by electronic control units (ECUs) that implement functions to determine the required output from the component under current operating conditions. These functions can utilize inputs indicating various parameters, including driver input and vehicle operating parameters, to calculate the necessary output. Consequently, these functions can be highly complex and require significant processing power.

[0003] Providing complex functions to calculate the required output of components can significantly improve vehicle performance, as the output from the components can be optimized under current operating conditions. However, the complexity of these functions also increases the risk of them producing an undesirable output under an unforeseen set of operating conditions, and furthermore, the risk of overloading the processor implementing the function, for example, due to an undetected bug in the software.

[0004] Although vehicle manufacturers make every effort to ensure that bugs and unexpected conditions are eliminated, watchdogs are in place to monitor the output of electronic control units (ECUs) and to ensure that no unsafe conditions arise due to ECU malfunctions. Watchdogs are ECUs that typically perform a simple calculation to determine, based on at least some of the inputs provided to the ECU they monitor, a range within which the output of the monitored ECU is expected to fall. If the watchdog determines that the ECU output is outside the expected range, it can initiate an appropriate corrective action, such as resetting the ECU or preventing the ECU from controlling the component.

[0005] EP 3 040 233 A1 relates to a control system for electric vehicles capable of ensuring good responsiveness and slip-stop characteristics in response to changes in road surface conditions. The system comprises a vehicle control unit configured to calculate the target value of the torque requested by the driver according to the driver's acceleration or braking input, a first communication device capable of communicating between a hydraulic control unit and a motor control unit, and a second communication device capable of communicating between the vehicle control unit and the motor control unit.

[0006] DE 10 2014 204 803 A1 discloses a system and method for controlling an electric vehicle. The electric vehicle includes at least one control device configured to detect an overvoltage fault when the voltage of an electric machine exceeds an overvoltage threshold. In response to the overvoltage fault, the electric machine and a variable voltage converter (VVC) are deactivated.

[0007] It is important that the calculation performed by a watchdog is independent of the control unit it monitors; otherwise, a bug could exist in both the control unit and its watchdog. Therefore, watchdogs of the type described above are only generally effective if a good estimate of the range into which a control unit output will fall can be made using a relatively simple function. This has led to difficulties in implementing watchdogs for certain component types.

[0008] It is an object of embodiments according to the invention to at least mitigate one or more problems according to the prior art. BRIEF SUMMARY OF THE INVENTION

[0009] Inventive aspects and embodiments provide the following: a watchdog control unit, a method, a computer program product, a non-transient computer-readable medium, a processor and a vehicle, as claimed in the attached patent claims.

[0010] According to one aspect of the invention, a watchdog control unit is provided for a vehicle, wherein the watchdog control unit comprises the following: Input device configured to receive a first input indicating at least one vehicle control input, and a second input indicating a dynamic vehicle parameter; and Tax revenues that are communicatively linked to input resources, wherein the control means are operable to initiate operation of the vehicle in a safe mode when a fault condition is detected, wherein the fault condition is detected depending on the first and the second input, where the vehicle's functionality is at least partially restricted when the vehicle is operated in safe mode. This control unit is functional to determine when a fault condition has occurred without duplicating the potentially complex functionality of the control units that determine the current to be supplied to the drive motor of the electrically powered vehicle, which may be an electric machine. The dynamic vehicle parameter can determine vehicle acceleration. or a vehicle angular acceleration. Optionally, the watchdog control unit can be a watchdog control unit for use in an electrically powered vehicle, such as one with a complex control system. Alternative embodiments may be suitable for use in vehicles powered by internal combustion engines, particularly in vehicles equipped with complex traction control systems that can provide hydraulic braking to selectively reduce the total amount of torque delivered to individual wheels.

[0011] It is noted that, within the scope of this application, the term "acceleration" is understood to encompass any change in speed over time in any direction. Accordingly, increases or decreases in the magnitude of the vehicle's speed, or changes in the direction of travel of a vehicle, are all considered to cause an "acceleration" of the vehicle.

[0012] It should be noted that the vehicle can be operated in a normal mode if no fault condition has been detected, and that functionality may be limited in relation to the normal mode if the vehicle can be operated in safe mode.

[0013] Optionally, the control unit is configured to prevent the operation of at least one electric machine of the electric vehicle, thereby initiating the operation of the vehicle in safe mode.

[0014] Furthermore, the control system is optionally capable of opening a switch between the electric vehicle's battery and the electric motor when a fault condition is detected, thereby initiating safe operation of the vehicle. Advantageously, this allows the watchdog control unit to prevent the electric motor from delivering positive torque to the vehicle's wheels.

[0015] Optionally, the control means are functional to send a cancellation signal to a control unit that is functional to control the electric machine when the fault condition is detected, thereby initiating the operation of the vehicle in safe mode. Optionally, the cancellation signal causes the control unit to essentially prevent the electric machine from generating positive torque.

[0016] In one embodiment, the electric vehicle comprises multiple electric machines, wherein the multiple electric machines include a first group of one or more electric machines and a second group of one or more electric machines, wherein, when the vehicle is operated in safe mode, the operation of the first group of electric machines is prevented, and the operation of the second group of electric machines is not prevented. A watchdog controller, as defined above, can be particularly useful in such an electric vehicle, since a conventional watchdog for such a vehicle can be very complex and therefore prone to software bugs.

[0017] Optionally, the first group of electric machines is configured to deliver torque to one or more front wheels of the vehicle, and the second group of electric machines is configured to deliver torque to one or more rear wheels of the vehicle. In one embodiment, the first group of electric machines is configured to deliver torque to one or more rear wheels of the vehicle, and the second group of electric machines is configured to deliver torque to one or more front wheels of the vehicle. Preventing the operation of only one group of electric machines can allow the vehicle to continue to be driven when a fault condition has been detected.

[0018] Optionally, the second input indicates a vehicle yaw rate. The fault condition can be detected if the vehicle yaw rate exceeds a first threshold. Optionally, the fault condition is detected if the vehicle yaw rate exceeds the first threshold for a specified period. The first threshold can vary depending on the currently selected driving mode of the vehicle.

[0019] Optionally, the first input includes an input indicating a current steering angle; and the first threshold varies depending on the current steering angle.

[0020] In one embodiment, the first input comprises one or more inputs of the current accelerator pedal position and the current brake pedal position; The second input includes an input indicating vehicle acceleration, with the error condition being detected if the vehicle acceleration is outside an expected range; and The expected range varies depending on the accelerator pedal position and the brake pedal position.

[0021] According to another aspect of the present invention, for which protection is sought, an electrically powered vehicle is provided which includes a watchdog control unit as described above.

[0022] The vehicle optionally includes: several wheels; several electric machines, each of the electric machines being linked to one of the wheels; and Powertrain control device, capable of receiving multiple powertrain control signals indicating multiple vehicle parameters, including the at least one vehicle control input, wherein the powertrain control device is capable of providing individual torque request signals to each of the electric machines, wherein the individual torque request signals are calculated as a function of the powertrain control signals.

[0023] Optionally, the powertrain control system is functional to provide individual request signals for regenerative braking to each of the electric machines, whereby the individual request signals for regenerative braking are calculated depending on the powertrain control signals.

[0024] In one embodiment, when the vehicle is operated in safe mode, several vehicle systems are deactivated sequentially, and the vehicle's response to the deactivation of each system is monitored by powertrain control devices, the watchdog control unit, and / or another control device. Advantageously, this allows the watchdog control unit to identify the source of the fault. Under certain circumstances, this enables the vehicle to be operated safely despite the fault condition.

[0025] Optionally, the watchdog control unit is also configured to monitor the communication status of one or more of the vehicle's subsystem control units. The watchdog control unit can be configured to initiate safe mode operation of the vehicle upon detecting a loss of communication with one of the subsystem control units.

[0026] In one embodiment, the vehicle may include one or more accelerometers that are communicatively linked to the watchdog control unit. The accelerometers may be configured to generate a second input.

[0027] According to another aspect of the present invention, for which protection is sought, a method for controlling an electrically powered vehicle is provided, comprising the following:

[0028] Receiving an initial input indicating at least one vehicle control input, and a second input indicating a dynamic vehicle parameter; and

[0029] Initiating the operation of the vehicle in a safe mode when a fault condition is detected, whereby the fault condition is detected depending on the first and second inputs, where the vehicle's functionality is at least partially restricted when the vehicle is operated in safe mode. The dynamic vehicle parameter can be vehicle acceleration or vehicle angular acceleration.

[0030] The procedure optionally includes: To prevent the operation of at least one electric machine of the electric vehicle when the fault condition is detected, thereby initiating the operation of the vehicle in safe mode.

[0031] The vehicle optionally includes: several wheels; several electric machines, each of the electric machines being linked to one of the wheels; and Powertrain control means, functional to receive multiple powertrain control signals indicating multiple vehicle parameters, including the at least one vehicle control input, wherein the method comprises providing individual torque request signals to each of the electric machines, wherein the individual torque request signals are calculated as a function of the powertrain control signals.

[0032] According to another aspect of the present invention to be protected, a computer program product is provided which is executable on a processor to implement a method as previously described.

[0033] According to another aspect of the present invention to be protected, a non-transient computer-readable medium is provided which contains computer-readable code which, when executed by a computer, causes a vehicle to perform a procedure as previously described.

[0034] According to another aspect of the present invention to be protected, a processor is provided and arranged to implement a method or a computer program product as previously described.

[0035] It should be noted that the term “watchdog control unit” used herein is understood to mean both a single control device or unit and a unit comprising several control devices or units that are operated collectively to provide the executed control functionality for a watchdog control unit.

[0036] Within the scope of this application, it is expressly intended that the various aspects, embodiments, examples, and alternatives set forth in the preceding paragraphs, in the claims, and / or in the following description and drawings, and in particular their individual features, may be considered independently of one another or in any combination. This means that all embodiments and / or features of any embodiment may be combined in any way and / or in any combination, provided that these features are not incompatible.The applicant reserves the right to amend any originally filed patent claim or to file any new patent claim accordingly, including the right to amend any originally filed patent claim to depend on and / or incorporate any feature of any other patent claim, even if it was not previously claimed in this manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] One or more embodiments of the invention will now be described exclusively by way of example with reference to the accompanying drawings; these show: Fig. 1 a schematic diagram of a known vehicle containing a watchdog control unit; Fig. 2 a schematic diagram of a vehicle containing a watchdog control unit in an embodiment according to the invention; Fig. 3 a vehicle containing a dynamic watchdog control unit in an embodiment according to the invention; and Fig. 4 a flowchart illustrating the operation of a dynamic vehicle control unit in an embodiment according to the invention. DETAILED DESCRIPTION

[0038] Fig. Figure 1 shows a schematic diagram of a prior art vehicle 100 with four wheels 102A-D, two of which, 102C and 102D, are driven by an AC electric motor 104 via a differential 106. The motor 104 is powered by a battery 108 via a control unit 112 and an inverter 110. The control unit 112 regulates the power supply to the inverter 110 depending on various inputs, including the positions of the accelerator pedal 114 and the brake pedal 116. The watchdog control unit 118 is further configured to receive inputs from the positions of the accelerator pedal 114 and the brake pedal 116, and it is also configured to receive an input indicating the current flow to the inverter 110.The watchdog controller 118 is configured to calculate an expected current flow to the inverter 110 and to determine whether the expected current flow to the inverter 110 falls within the expected range. If the observed current falls within the expected range, the watchdog controller 118 takes no action. However, if the observed current is outside the expected range, the watchdog controller 118 determines that a fault has occurred and controls a switch (not shown) between the inverter 110 and the battery 104 to open it, thus preventing the motor from supplying power to the wheels 102C and 102D.

[0039] The in Fig. The arrangement shown in Figure 1 is effective provided that the watchdog controller 118 is able to calculate an expected range for the current flow to the inverter 110 that is narrow enough to ensure that a malfunction of the controller 112 is detected quickly, but still accurate enough that the current always falls within the expected range during normal operation. However, it is important that the watchdog controller 118 does not simply replicate the control logic implemented in the controller 112, as this could lead to a situation where a common fault exists in both the watchdog controller 118 and the controller 112, which would therefore not be recognized as a fault.

[0040] Fig. Figure 2 shows a vehicle 200 with four wheels 202A-D, each of which is driven by a separate electric motor 204A-D. Current from the battery 206 is supplied to the motor 204A-D via the control unit 208. The current can either be supplied to each of the motors 204A-D via an inverter connected to each of the motors (not shown), or the motors 204A-D can be DC motors.

[0041] The in Fig. The arrangement shown in Figure 2 has the advantage that the power supplied to each of the wheels 202A-D can be controlled independently of the control unit 208 without applying a braking torque to any of the wheels. This can improve the stability and dynamic performance of the vehicle compared to prior art vehicles that have only limited control over the power supplied to each wheel. The torque supplied to each wheel is calculated by the control unit 208, depending on the positions of the accelerator pedal 214 and the brake pedal 216, as well as several other parameters, which may include one or more parameters related to surface traction, one or more parameters related to wheel slip, steering wheel position, vehicle yaw rate, and vehicle speed.Calculating the torque required at each wheel can be comparatively complicated, and there can be significant variations in the torque required at each wheel; these variations may depend on parameters other than the positions of the brake pedal and accelerator pedal.

[0042] In one embodiment, the control unit 208 can receive inputs indicating the current rotational speed at each of the wheels, and it can be configured to calculate slip values ​​at each of the wheels as a function of the wheel rotational speeds and an estimate of the vehicle speed; this estimate can be generated based on values ​​from an accelerometer or by other known methods. The control unit 208 is capable of estimating the available traction at each of the wheels as a function of the slip values ​​and the torque supplied to each of the wheels by the motors 204A-D.Depending on the estimated available traction, the control unit can modify the current currently supplied to each of the motors 204A-D to provide more torque to those wheels with comparatively high available traction and less torque to those wheels with comparatively low available traction. This can improve the vehicle's dynamic performance in situations where traction is limited. Similarly, when the vehicle 200 is cornering, the control unit 208 can modify the current supplied to each of the motors 202A-D to reduce or prevent wheel slip and to control the vehicle's yaw rate so that it essentially matches a target yaw rate that can be calculated based on user steering input.

[0043] The torque required at each wheel, and consequently the current supplied to each of the motors 204A-D for a given position of the accelerator pedal 214 and the brake pedal 216, can therefore vary considerably and in a comparatively complex manner. Consequently, a watchdog control unit that is functional in order to calculate an expected range for the current supplied to each of the motors 204A-D would have to consider inputs other than the positions of the accelerator and brake pedals. Furthermore, the watchdog control unit would have to perform a similarly complex calculation to be able to calculate an expected range narrow enough to reliably detect any faults that occur, and it might be necessary for the watchdog control unit to emulate a significant portion of the functionality of the control unit 208.This creates a risk that a common fault could occur in the watchdog control unit and in control unit 208, which would result in the fault not being detected. Therefore, one or more watchdog control units, which compare the current currently supplied to motors 202A-D with an expected range, may not provide sufficient protection against potential fault conditions.

[0044] As in Fig. As shown in Figure 2, the control unit 208 is equipped with a dynamic watchdog control unit 218. The dynamic watchdog control unit 218 is functional to detect a fault condition in the control unit 208 (or in one of the motors 204A-D controlled by the control unit 208) and to open the switch 210 to prevent the control unit 208 from controlling the motors 204A-D when the fault condition is detected. The operation of the watchdog control unit 218 is described in more detail below.

[0045] The dynamic watchdog control unit 218 is capable of receiving inputs from a six-degree-of-freedom accelerometer 220 indicating vehicle acceleration and rotation about three mutually perpendicular axes (X, Y, Z), as well as inputs indicating the position of the accelerator pedal 214, the position of the brake pedal 216, and the current vehicle speed. The dynamic watchdog control unit can also be configured to receive an input indicating a current steering input, such as the position of the vehicle's steering wheel and / or a torque applied by the vehicle's driver.

[0046] The Fig. Figure 3 shows a vehicle 200 with a coordinate system indicating the directions of the X, Y, and Z axes. As in Fig. As can be seen in Figure 3, the X-axis is aligned with the vehicle's direction of travel, the Y-axis is perpendicular to the direction of movement and is horizontal when the vehicle is on level ground, and the Z-axis is vertical when the vehicle is on level ground. The accelerometer 220 is further capable of producing an output indicating the angular velocity about each of the X, Y, and Z axes. It should be noted that rotation about the X-axis is conventionally referred to as "roll," rotation about the Y-axis as "pitch," and rotation about the Z-axis as "yaw." Coordinate systems other than the one shown in Figure 3 are not permitted. Fig. The three options shown are also possible, although the one in Fig. The system shown in point 3 generally simplifies the calculations performed in the system.

[0047] The dynamic watchdog control unit 218 is capable of calculating an expected range of dynamic vehicle behavior depending on the positions of the accelerator pedal 214, the brake pedal 216, and the steering wheel. The expected range can include an upper and a lower threshold for acceleration in the "X" direction, as well as a yaw rate (i.e., a rotational speed about the "X" axis), and these limits can vary depending on the driver inputs to the accelerator pedal 214, the brake pedal 216, and the steering wheel. The limits can further vary depending on one or more features of the terrain on which the vehicle is currently being driven, such as the surface topology or the available surface traction. The limits can also vary depending on the currently selected driving mode.Thus, the limits of the expected dynamic behavior can be wider when a "Sport" or "Race" mode is selected.

[0048] The watchdog control unit 218 can access an electronic memory containing a lookup table regarding driver inputs to the accelerator pedal, brake pedal, and steering wheel, as well as the upper and lower limits for acceleration and yaw rate. The upper and lower limits stored in the lookup table can be empirically determined during vehicle calibration for a predefined set of inputs, based on the observed range and dynamic vehicle behavior. If the observed dynamic behavior falls outside the observed range, the behavior of the watchdog control unit 218 can be configured to determine that a fault condition has occurred. Accordingly, the watchdog control unit 218 can initiate the operation of the vehicle in a safe mode, for example, by controlling the opening of switch 210, thereby electrically disconnecting the battery 206 from the control unit 208.

[0049] In addition to limits calculated based on driver input, the Watchdog ECU 218 can also implement absolute limits on the vehicle's dynamic performance. If an observed dynamic parameter exceeds one of these absolute limits, a fault condition can be assumed, regardless of the driver's input. Therefore, safe mode operation can be initiated whenever a dynamic parameter exceeds an absolute limit on the vehicle's dynamic performance.

[0050] The operation of the watchdog control unit 218 in a specific embodiment according to the invention is now described with regard to Fig. 4 is described in more detail. The watchdog control routine 300 begins in step 302 and then proceeds directly to step 304, in which the watchdog control unit 218 receives inputs indicating the positions of the accelerator and brake pedals, a current steering input, and the current vehicle speed. The procedure then proceeds to step 306, in which the expected ranges of dynamic vehicle performance are calculated as a function of the inputs received in step 304. In the present embodiment, only expected ranges of yaw rate and acceleration in the X-direction are calculated, although it should be noted that expected ranges for other dynamic parameters may be calculated additionally or instead in other embodiments.

[0051] After step 306, the control routine continues with step 308, in which the watchdog control unit 218 receives input from the accelerometer 220 indicating the current dynamic behavior of the vehicle. The control routine then continues with step 310, in which the watchdog control unit 218 determines whether the observed acceleration and / or yaw rate are within the expected ranges calculated in step 306. If the observed acceleration and / or yaw rate are not within the expected ranges, the watchdog control unit 218 determines that a fault condition has occurred, and the control routine continues with step 316, in which the watchdog control unit 218 initiates the operation of the vehicle 200 in a safe mode. In some embodiments, after determining that a dynamic vehicle parameter is outside the expected range, the watchdog control unit 218 may wait for a predetermined period (e.g.,(one second, two seconds, or five seconds). If the dynamic parameter returns to the expected range within the specified time period, then watchdog 218 may not determine that an error condition has occurred, and therefore the control routine can proceed to step 312 instead of step 316. If the dynamic parameter does not return to the expected range within the specified time period, then the watchdog determines that an error has occurred and proceeds to step 316, in which safe mode is initiated. Operation in safe mode is described in more detail below. If it is determined that the observed acceleration and yaw rate are within the expected ranges, then the control routine proceeds to step 312.

[0052] In step 312, the watchdog control unit 218 determines whether any of the observed dynamic parameters are outside of predefined absolute limits for dynamic vehicle performance. If any of the dynamic parameters are within the absolute limits for dynamic performance, the control routine continues with step 316. Otherwise, the control routine continues with step 314.

[0053] In step 314, the watchdog control unit 218 determines whether communication with one or more other subsystem control units (in Fig.(2 not shown) is normal. The other subsystem control units can be arranged to control a steering system of the vehicle, one or more friction brakes of the vehicle, or any other system. It should be noted that some of the other subsystem control units may be associated with safety-critical systems, while others may be associated with non-safety-critical subsystems. In the illustrated embodiment, the other subsystem control units are all arranged to send a signal to the watchdog control unit 218 at predetermined time intervals, indicating that they are functioning normally. If the watchdog control unit has received all of the expected signals from the other subsystem control units, then the watchdog control unit 218 determines that no fault conditions have occurred and the control routine returns to step 304.If the watchdog control unit does not receive a signal from one or more of the other subsystem control units within the specified period, then watchdog control unit 218 can determine that communication with the subsystem control unit is interrupted and that a fault condition has therefore occurred. The control routine then proceeds to step 316, in which the vehicle enters safe mode.

[0054] When the control routine 300 proceeds to step 316, the watchdog control unit 218 initiates the operation of the vehicle 200 in a safe mode. When the vehicle 200 is operating in safe mode, its functionality is limited compared to its normal operating state. In some embodiments, the watchdog control unit 218 may be capable of controlling the switch 210 such that it opens whenever a fault condition is detected, thereby preventing the electric motors 204A-D from providing positive torque to the wheels 202A-D. The driver can then bring the vehicle 200 to a stop in a safe location using the brakes and steering.However, in other embodiments where the action is taken when the vehicle enters the safe state, this action may vary depending on the fault condition that caused the watchdog control unit 218 to initiate safe mode operation. For example, if the fault condition that caused safe mode operation was the interruption of communication with a non-safety-critical vehicle subsystem, then the watchdog control unit may be configured to issue a warning and prevent the operation of the subsystem with which communication was interrupted when the vehicle entered safe mode.

[0055] In some embodiments, the watchdog control unit 218 can be configured to send override signals to disable one or more components of the vehicle 200 when a fault condition is detected. For example, if the observed dynamic vehicle behavior is outside the range of expected dynamic vehicle behavior, the watchdog control unit 218 can be configured to send an override signal to the control unit 208, the override signal causing the control unit 208 to control some or all of the electric motors 204A-D to essentially provide zero positive drive torque. The watchdog control unit 218 can be configured to initially send a first override signal, causing zero torque to be generated by the motors 204A and 204B connected to the front wheels 202A and 202B.If the watchdog control unit (or another control unit) determines that the fault condition has been corrected by preventing the operation of motors 204A and 204B, then the first override signal is maintained and the vehicle continues to operate using motors 204C and 204D. If the first override signal does not correct the fault condition within a predetermined time period (for example, five seconds), then the watchdog control unit 218 may stop sending the first override signal and may instead send a second override signal. This second signal causes the control unit 208 to control the electric motors 204C and 204D to produce essentially zero torque.If the watchdog control unit (or another control unit) determines that the fault condition has been corrected by preventing the operation of motors 204C and 204D, the first cancel signal is retained, and the vehicle operates using motors 204A and 204B. Otherwise, a third cancel signal, causing all four electric motors 204A-D to generate a positive torque of essentially zero, is sent from the watchdog control unit 218 to the control unit 208. In some embodiments, the watchdog control unit may be configured to control switch 210 to open only if the third cancel signal does not correct the fault condition. It should be noted that the sequence in which the front and rear electric motors are deactivated by the first and second cancel signals may be reversed in some embodiments.

[0056] The watchdog control unit 218 can cause the driver to receive a warning indicating that the vehicle's functionality will be limited each time safe mode is initiated. Furthermore, depending on the action taken by the control unit to initiate safe mode operation, it can also be configured to issue an external warning to alert other road users that the vehicle's performance is limited. This external warning may include activating the vehicle's hazard warning lights.

[0057] It should be noted that the sequence of steps in control routine 300 is only an example and can be modified. Furthermore, some steps can be executed simultaneously with others or omitted altogether. In one embodiment, determining in step 310 whether the acceleration and yaw rates are within the expected ranges can be performed simultaneously with determining in step 312 whether any of the dynamic parameters are outside the absolute limits and / or with determining in step 314 whether communication with any of the other ECUs has been interrupted.

[0058] Although the present invention has been described in relation to an electric vehicle with individual electric machines linked to each wheel, it should be noted that embodiments according to the invention are also applicable to electric vehicles in which one electric machine is configured to drive all wheels. Furthermore, some embodiments may be applicable to hybrid vehicles that are partially powered by an internal combustion engine or to vehicles that are exclusively powered by an internal combustion engine.

[0059] It is understood that embodiments of the invention can be implemented in the form of hardware, software, or a combination of hardware and software. Such software can be stored in the form of volatile or non-volatile storage, such as a storage device like a ROM, whether erasable or overwritable or not, or in the form of memory such as RAM, memory chips, devices, or integrated circuits, or on an optically or magnetically readable medium, such as a CD, DVD, magnetic disk, or magnetic tape. It is understood that the storage devices and storage media are embodiments of machine-readable memory suitable for storing a program or programs that, when executed, implement embodiments of the present invention.Accordingly, embodiments provide a program comprising code for implementing a system or method according to any of the preceding claims, as well as a machine-readable memory in which this program is stored. Furthermore, embodiments according to the invention can be transmitted electronically via a data carrier, such as via a communication signal transmitted over a wired or wireless connection, and embodiments can include such a device.

[0060] All of the features disclosed in this document (including any accompanying claims, abstracts and drawings) and / or all of the steps of any such disclosed methods and processes may be combined in any way, except for combinations in which at least some of these features and / or steps are mutually exclusive.

Claims

[1] Watchdog control unit (218) for an electrically powered vehicle (200), wherein the control unit (218) comprises the following: Input means configured to receive a first input indicating at least one vehicle control input, and a second input indicating vehicle acceleration and / or vehicle rotation rate (200), the second input indicating a vehicle yaw rate; and Control means that are communicatively coupled with the input means, wherein the control means are operable to initiate operation of the vehicle (200) in a safe mode when a fault condition is detected, wherein the fault condition is detected depending on the first and the second input, where the functionality of the vehicle (200) is at least partially restricted when the vehicle (200) is operated in safe mode. [2] Control unit (218) according to claim 1, wherein the control unit is configured to prevent the operation of at least one electric machine (204A-D) of the electric vehicle (200), thereby initiating the operation of the vehicle (200) in the safe mode. [3] Control unit (218) according to claim 2, wherein the control means are functional to open a switch (210) between a battery (206) of the electric vehicle (200) and the electric machine (204A-D) when the fault condition is detected, thereby initiating the operation of the vehicle (200) in the safe mode. [4] Control unit (218) according to claim 2, wherein the control means are functional to send a cancellation signal to a control unit (208) which is functional to control the electric machine (204A-D) when the fault condition is detected, thereby initiating the operation of the vehicle (200) in the safe mode. [5] Control unit (218) according to claim 4, wherein the cancellation signal causes the control unit to substantially prevent the electric machine (204A-D) from generating positive torque. [6] Control unit (218) according to one of claims 2-5, wherein the electric vehicle (200) comprises several electric machines (204A-D), wherein the several electric machines (204A-D) comprise a first group of one or more electric machines (204A, 204B) and a second group of one or more electric machines (204C, 204D), wherein when the vehicle (200) is operated in safe mode, the operation of the first group of electric machines (204A, 204B) is prevented and the operation of the second group of electric machines (204C, 204D) is not prevented. [7] Control unit (218) according to claim 6, wherein the first group of electric machines (204A, 204B) is configured to supply torque to one or more front wheels (202A, 202B) of the vehicle (200), and the second group of electric machines (204C, 204D) is configured to supply torque to one or more rear wheels (202C, 202D) of the vehicle (200). [8] Control unit (218) according to claim 6, wherein the first group of electric machines (204A, 204B) is configured to supply torque to one or more rear wheels of the vehicle (200), and the second group of electric machines (204C, 204D) is configured to supply torque to one or more front wheels of the vehicle (200). [9] Control unit (218) according to one of the preceding claims, wherein the fault condition is detected when the vehicle yaw rate exceeds a first threshold value. [10] Control unit (218) according to claim 9, wherein the fault condition is detected when the vehicle yaw rate exceeds the first threshold value over a threshold period. [11] Control unit (218) according to claim 9 or 10, wherein the first threshold varies depending on a currently selected driving mode of the vehicle (200). [12] Control unit (218) according to one of claims 9-11, wherein: the first input includes an input indicating a current steering angle; and The first threshold value varies depending on the current steering angle. [13] Control unit (218) according to any of the preceding claims, wherein: the first input includes one or more inputs of the current position of the accelerator pedal (214) and the current position of the brake pedal (216); the second input includes an input indicating vehicle acceleration, with the error condition being detected if the vehicle acceleration is outside an expected range; and The expected range varies depending on the accelerator pedal position and the brake pedal position. [14] Electrically powered vehicle (200) comprising a watchdog control unit (218) according to any of the preceding claims. [15] Vehicle (200) according to claim 14, comprising the following: several wheels (202A-D); several electric machines (204A-D), each of the electric machines (204A-D) being linked to one of the wheels; and Powertrain control means (208) capable of receiving multiple powertrain control signals indicating multiple vehicle parameters, including the at least one vehicle control input, wherein the powertrain control means is capable of providing individual torque request signals to each of the electric machines (204A-D), wherein the individual torque request signals are calculated as a function of the powertrain control signals. [16] Vehicle (200) according to claim 15, wherein the powertrain control means (208) is capable of providing individual request signals for regenerative braking to each of the electric machines (204A-D), wherein the individual request signals for regenerative braking are calculated depending on the powertrain control signals. [17] Vehicle (200) according to claim 15 or 16, wherein, when the vehicle (200) is operated in the safe mode, several vehicle systems are deactivated successively and a vehicle response to the deactivation of each of the systems is monitored by powertrain control means (208), the watchdog control unit (218) and / or another control means. [18] Vehicle (200) according to any one of claims 14 to 17, wherein the watchdog control unit (218) is further configured to monitor the communication status of one or more subsystem control units of the vehicle (200). [19] Vehicle (200) according to claim 18, wherein the watchdog control unit (218) is functional to initiate the operation of the vehicle (200) in safe mode upon detection of a loss of communication with one of the subsystem control units. [20] Vehicle (200) according to one of claims 14 to 19, further comprising one or more accelerometers (220) which are communicatively coupled to the watchdog control unit (218). [21] Method for controlling an electrically powered vehicle (200), comprising the following: Receiving a first input indicating at least one vehicle control input, and a second input indicating vehicle acceleration and / or vehicle rotation speed (200), and indicating a vehicle yaw rate; and Initiating the operation of the vehicle (200) in a safe mode thereof when a fault condition is detected, wherein the fault condition is detected depending on the first and the second input, where the functionality of the vehicle (200) is at least partially restricted when the vehicle (200) is operated in safe mode. [22] The method of claim 21, comprising the following: Causing the operation of at least one electric machine (204A-D) of the electric vehicle to be prevented when the fault condition is detected, thereby initiating the operation of the vehicle (200) in the safe mode. [23] Method according to claim 21 or 22, wherein the vehicle comprises: several wheels (202A-D); several electric machines (204A-D), each of the electric machines (204A-D) being linked to one of the wheels; and Powertrain control means (208) capable of receiving multiple powertrain control signals indicating multiple vehicle parameters, including the at least one vehicle control input, wherein the method comprises providing individual torque request signals to each of the electric machines (204A-D), the individual torque request signals being calculated as a function of the powertrain control signals. [24] Computer program product, executable on a processor to implement a method according to any one of claims 21 to 23. [25] Non-transient computer-readable medium carrying computer-readable code which, when executed by a computer, causes a vehicle (200) to perform the method according to any one of claims 21 to 23. [26] Processor arranged to implement the method according to any one of claims 21 to 23 or the computer program product according to claim 24.

Images