Electric or hybrid vehicle with dual safety braking system

Abstract

Electric or hybrid vehicle with dual safety braking system. The invention relates to an electric or hybrid vehicle (1) comprising: - a high-voltage battery (8), - a first low-voltage battery (14) powering a first on-board network (15) to which are connected a first braking device (16) and a first control unit (12) capable of activating the first braking device (16), - a second low-voltage battery (24) powering a second on-board network (25) to which is connected a second braking device (26), the vehicle (1) comprising a second control unit (22) capable of being powered by the second on-board network (25) and of activating the second braking device (26). (Figure 1)

Description

Title of the invention: Electric or hybrid vehicle with dual safety braking system

[0001] The present invention relates to the fields of electricity and the automotive industry, and more specifically concerns an electric or hybrid vehicle adapted to guarantee the necessary safety when autonomous driving of the vehicle is engaged.

[0002] Autonomous vehicles compatible with autonomy levels 4 or 5 established by the International Organization of Motor Vehicle Manufacturers are gaining importance in the field of logistics and in applications requiring so-called last-mile delivery, that is, autonomous movement in a controlled environment such as a duly mapped industrial site. Such a vehicle is capable of driving without human supervision and without physical actuators such as a steering wheel or brake pedal that would allow a driver to regain control of the vehicle.

[0003] It is therefore essential to be able to stop such a vehicle in the event of a safety problem, especially since no human driver can operate it in such a case. Safety redundancy of the braking system is specifically envisaged in such a vehicle, to enable the vehicle to be stopped when one of its braking systems is out of order.

[0004] However, the inventors have found that the proposed braking solutions, even with safety redundancy, do not allow the vehicle to be stopped in all the scenarios they have identified, particularly in the event of electrical failure.

[0005] The present invention aims to remedy at least in part the aforementioned drawbacks by providing an electric or hybrid vehicle, comprising redundancy of braking means, and whose electrical architecture is adapted to this redundancy of braking means so as to make them truly independent, in a low-cost manner.

[0006] To this end, the invention proposes an electric or hybrid vehicle, comprising: - a high-voltage battery capable of powering an electric powertrain of the vehicle, - a first low-voltage battery, a first braking device, a first control unit capable of controlling the vehicle by activating the first braking device, and a first on-board network to which at least the first low-voltage battery and the first control unit are connected, - a first DC-DC converter connected at the input to the high-voltage battery and at the output to the first on-board network, - a second low-voltage battery, a second braking system, and a second on-board network to which at least the second low-voltage battery is connected, - a second DC-DC converter connected at the input to the high-voltage battery and at the output to the second on-board network, the vehicle being characterized in that it includes a second control unit capable of being powered by the second on-board network and of controlling the vehicle by activating the second braking device.

[0007] Thanks to the invention, the vehicle's braking systems are each powered and controlled by independently and reliably powered onboard networks. In particular, when one of the low-voltage batteries can no longer power the onboard network to which it is connected, this onboard network can still be powered by one of the DC-DC converters to which it is connected. Conversely, when one of the DC-DC converters can no longer power the onboard network to which it is connected, this onboard network can still be powered by one of the low-voltage batteries connected to this onboard network. Therefore, the power supply to each braking system and its control unit is secure.

[0008] The first braking device is, for example, a regenerative braking system and the second braking device is, for example, a hydraulic braking system.

[0009] Furthermore, since each braking device is controlled by a separate control unit, even if one of the control units fails, the other control unit can activate the braking device for which it has control means. The control means for each braking device are powered by the on-board network to which the control unit capable of activating that braking device is connected.

[0010] Furthermore, the vehicle architecture proposed by the invention is inexpensive and flexible. Indeed, other DC-DC converters can be connected at the input to the high-voltage battery and at the output to yet another on-board network, powering, for example, other safety equipment, in a similar manner to the first and second DC-DC converters. The DC-DC converters, control units, and low-voltage batteries used in the invention can be identical or virtually identical, which reduces the investment costs for manufacturing the vehicle. Finally, Vehicle development costs are limited due to the simplicity of the proposed architecture.

[0011] In one embodiment of the invention, the first control unit and the second control unit are each capable of preventing the vehicle from moving as soon as an anomaly is detected on either the first or second on-board network. In this embodiment of the invention, each control unit is capable of detecting an anomaly on the on-board network to which it is connected, but also on the on-board network to which the other control unit is connected, for example, via the communication buses linking the vehicle's computers. Indeed, as soon as a computer of a critical vehicle component fails to activate, the first and second control units prevent the vehicle from moving. A critical component is defined as a component whose proper functioning is necessary to ensure at least the safety of third parties, and therefore to ensure emergency braking and / or parking.This ensures that the vehicle cannot be authorized to start as soon as a fault occurs on one of the on-board networks.

[0012] In one embodiment of the invention, the electric or hybrid vehicle according to the invention further comprises: - a first control unit, capable of operating the first DC-DC converter while being powered by the first on-board network, and a first communication bus linking the first control unit to the first command unit, - a second control unit, capable of operating the second DC-DC converter while being powered by the second on-board network, and a second communication bus linking the second control unit to the second command unit, and a read-only communication link connecting the first communication bus to the second control unit.

[0013] Thus, while driving, as soon as one of the low-voltage batteries fails, the DC-DC converter to which it is connected will no longer supply power to the corresponding on-board electrical system the next time the vehicle is started, and starting will not be permitted. Conversely, as soon as one of the DC-DC converters stops supplying current while driving, the low-voltage battery to which it is connected will discharge rapidly, also preventing the vehicle from starting the next time it is started.

[0014] Indeed, read-only communication between the first communication bus and the second control unit makes it possible to condition the starting of the vehicle on the proper functioning of the two on-board networks.

[0015] Furthermore, it avoids significantly altering the operation of each control unit, and in particular, it avoids modifying the messages that each unit transmits or receives. For example, the communication link allows the second control unit to read-only data from the first communication bus, without the first control unit processing the data transmitted on the second communication bus. Everything therefore occurs as if the second control unit, and more generally the second on-board network, did not exist for the first control unit. The second control unit can thus take into account what is happening on the first on-board network, even if it is not connected to it, in order to stop the vehicle when a problem is detected on it.Each communication bus is powered by the on-board network to which the control unit and the command unit it serves are connected; the two communication buses are independent of each other.

[0016] Although the first and second communication buses are independent, i.e., they do not communicate with each other, the vehicle's computers, except for the second control unit and the second command unit, are all interconnected via the first communication bus. This allows for minimal modification of the vehicle's initial architecture to integrate the invention. The second braking system, in particular, is thus connected to both communication buses while also being powered by the second on-board network. Alternatively, at least the computers for the vehicle's critical components are interconnected via the first communication bus. This includes the first control unit, the first command unit, and the vehicle's braking and steering systems.

[0017] Alternatively, in addition to this read-only communication, a read-only communication between the second communication bus and the first control unit can be added. In this embodiment, at least one vehicle computer is, for example, connected to both communication buses while being powered by the first on-board network.

[0018] In one embodiment of the invention, the vehicle further comprises first sensors capable of providing first data on the state of the first low-voltage battery to the first control unit and on the first DC-DC converter to the first control unit, the first sensors being powered by the first on-board network, and second sensors capable of providing second data on the state of the second low-voltage battery to the second control unit and on the second DC-DC converter to the second control unit, the second sensors being powered by the second on-board network. Each on-board network can thus be controlled independently of each other using their own sensors, which are for example temperature, voltage and current sensors.

[0019] The second control unit is, for example, capable of synchronizing an activation of the second control unit with an activation of the first control unit by the first control unit, based on at least one of the second data points related to the second low-voltage battery. In other words, when the second low-voltage battery allows it, i.e., when its condition is normal, the second control unit initiates the activation of the other vehicle equipment on the second on-board network in a manner synchronized with the first control unit. Thus, the on-board networks are functional simultaneously, which allows the control units to be operational as soon as a problem occurs on one of the on-board networks.The second control unit uses, for example, the read-only communication link with the first control unit to synchronize the activation of the second control unit with the activation of the first control unit.

[0020] The first control unit is for example capable of developing a first initial output voltage setpoint for the first DC-DC converter as a function of at least one data related to the high-voltage battery and at least one of the first data, and the second control unit is capable of developing a second initial output voltage setpoint for the second DC-DC converter as a function of said at least one data related to the high-voltage battery and at least one of the second data, independently of a development of the first initial output voltage setpoint carried out by the first control unit.

[0021] Thus, the first and second control units independently manage the power supply to the on-board network to which they are connected, depending on the state of the high-voltage battery, the state of the first or second low-voltage battery, and, when the first or second DC-DC converter is activated, its state. The state of the high-voltage battery is provided by a high-voltage battery management device connected to the first communication bus; this state can be read by the second control unit on the communication link between the first communication bus and the second control unit.

[0022] The first control unit is, for example, capable of determining a first corrected output voltage setpoint for the first DC-DC converter as a function of a voltage difference between, on the one hand, the initial first output voltage setpoint and, on the other hand, a voltage on the first on-board network, and as a function of limitations related to the first DC-DC converter, and the second control unit is capable of determining a second corrected output voltage setpoint for the second DC-DC converter as a function of a voltage difference between on the one hand the initial second output voltage setpoint and on the other hand a voltage on the second on-board network, and as a function of limitations related to the second DC-DC converter.

[0023] The first or second control unit respectively controls the first or second DC-DC converter with the first or second corrected output voltage setpoint, respectively. Each DC-DC converter is therefore controlled by a dual independent control loop, which allows the DC-DC converter to be switched more quickly into a degraded mode to protect it, and / or to detect a DC-DC converter failure more quickly.

[0024] For example, the first control unit or respectively the second control unit is capable of progressively reducing the first or respectively the second initial output voltage setpoint and stopping the vehicle as soon as: - the voltage on the first or respectively on the second on-board network is above a predetermined voltage threshold, or - a temperature reading representative of a heating of the first or respectively the second DC-DC converter is above a predetermined temperature threshold, or - a current on the first or respectively the second onboard network is above a predetermined current threshold, or - an anomaly is reported by the first or respectively the second control unit.

[0025] Furthermore, the vehicle according to the invention includes, for example, a cooling system common to the first and second DC-DC converters. This reduces the cost of the invention without compromising the independence between the first and second on-board networks.

[0026] The invention also relates to a method for controlling an electric or hybrid vehicle according to the invention, the vehicle being in motion, the control method comprising a step of detecting whether:

[0027] - the voltage on the first or respectively on the second on-board network is at- above a predetermined voltage threshold, or - a temperature reading representative of a heating of the first or respectively the second DC-DC converter is above a predetermined temperature threshold, or - a current on the first or respectively the second onboard network is above a predetermined current threshold, or - an anomaly is reported by the first or respectively the second control unit; The detection step is followed by a step of progressively decreasing the first or second initial output voltage setpoint by the first or second control unit, and braking the vehicle by the first or second control unit until it comes to a stop. The invention also relates to a method for starting an electric or hybrid vehicle according to the invention, the vehicle being previously in standby mode, the starting method comprising the following steps:

[0028] - sending an activation message for the first DC-DC converter continuous via the first control unit, to the first command unit,

[0029] - reading the activation message by the second control unit and sending subsequent to an activation message of the second DC-DC converter by the second control unit, to the second control unit.

[0030] The control and start-up methods have advantages similar to those of the method according to the invention.

[0031] Other features and advantages of the invention will become apparent from the following description on the one hand, and from several illustrative and non-limiting examples of embodiments given with reference to the accompanying schematic drawings on the other hand, in which:

[0032] [Fig. 1] represents an electrical architecture of an electric or hybrid vehicle according to the invention, in an embodiment of the invention, showing how different equipment of the vehicle is powered and interconnected,

[0033] [Fig.2] represents the development of a first corrected voltage setpoint for a first DC-DC converter of the electrical architecture of [Fig.1],

[0034] [Fig.3] represents the development of a second corrected voltage setpoint for a second DC-DC converter of the electrical architecture of [Fig.1],

[0035] [Fig.4] represents a method for starting the electric or hybrid vehicle of [Fig.1], in one embodiment of the invention, and

[0036] [Fig.5] represents a method of controlling the electric or hybrid vehicle of [Fig.1], while driving, in an embodiment of the invention.

[0037] In one embodiment of the invention shown in [Fig. 1], a vehicle The electric or hybrid vehicle according to the invention comprises a high-voltage battery 8, with a voltage VB across its terminals. The voltage VB is, for example, between 200 and 800V. Indeed, a high-voltage battery is defined as a battery capable of supplying enough energy to power an electric traction or propulsion motor. of the vehicle, unlike a service battery with a nominal open-circuit voltage of less than 60V. The high-voltage battery 8 is, for example, a Lithium-ion technology battery.

[0038] A high-voltage battery management device 80, commonly called BMS (from the English "Battery Management System"), supervises the high-voltage battery 8 and is capable of providing, in particular, on a first communication bus 17, the value of the voltage VB to a first control unit 12 of the vehicle 1. The first communication bus 17 is a CAN data bus (from the English "Controller Area Network").

[0039] The first communication bus 17 is powered by a first on-board network 15, with a nominal voltage, for example, of 14V. This first on-board network 15 is powered, when the vehicle 1 is in standby mode, by a first low-voltage battery 14, for example a lead-acid battery or a small lithium-ion battery, with a voltage across its terminals, for example, of 12V.

[0040] A first DC-DC converter 10, connected in input to the terminals of the high-voltage battery 8 and in output to the first on-board network 15, allows the latter to be powered when the vehicle is awake, so as to allow the first low-voltage battery 14 to be recharged and the low-voltage consumers of the vehicle connected to the first on-board network 15 to be powered. These low-voltage consumers include in particular the first control unit 12, a first control unit 11 of the first DC-DC converter 10, a first steering control device not shown and a control circuit of a first braking device 16.

[0041] The first braking device 16 is a regenerative braking system. It therefore includes an inverter, powered at its input by the high-voltage battery 8 and supplying at its output an electric traction or propulsion motor of the vehicle 1. The inverter includes a control circuit for its switches, forming the control circuit of the first braking device 16 and powered by the first on-board network 15, i.e., by low voltage. The control circuit is operated by the first control unit 12 via the first communication bus 15.

[0042] The first control unit 12 is a main computer for the vehicle 1, meaning that it controls the electric motor of the vehicle 1, the charging of the high-voltage battery 8, and the steering and braking of the vehicle 1. It is therefore capable of braking and stopping the vehicle 1 in the event of a fault in the high-voltage network, the first on-board network 15, or one of the vehicle's safety devices. For this purpose, the vehicle's safety devices, including the first control unit 11, the control circuit of the first braking device 16, a second braking device 26 (which is here a hydraulic braking system for the vehicle), and the first and a second steering control device not shown, communicates with the first control unit 12 via the first communication bus 17.

[0043] It should be noted that by extension in this application, all control devices that can be activated by the first communication bus 17 are called computers. Thus the first and second braking devices 16, 26 as well as the first and second steering control devices each have a computer connected to the first communication bus 17.

[0044] The vehicle 1 according to the invention also includes a second DC-DC converter 20 suitable for being controlled by a second control unit 21. The second DC-DC converter 20 is connected in input to the terminals of the high-voltage battery 8 and in output to a second on-board network 25, which supplies, when the vehicle 1 is woken up, the second control unit 21 as well as a second control unit 22, the second braking device 26 and the second steering control device.

[0045] When the vehicle 1 is in standby mode, the second on-board network 25 is powered by a second low-voltage battery 24, for example a lead-acid battery or a small 12V lithium-ion battery, which is then recharged by the second DC-DC converter 20 when the latter is activated.

[0046] The second control unit 22 is capable of braking the vehicle 1 and bringing it to a stop in the event of a fault in the high-voltage network, the second on-board network 25, the second braking device 26, or the second steering control device. To this end, the second control unit 21, the second braking device 26, and the second steering control device, and in particular their control units, communicate with the second control unit 22 via a second communication bus 27, independent of the first communication bus 17. In other words, the control unit of the second braking device 26 is capable of communicating with the first communication bus 17 as well as with the second communication bus 27. Similarly, the control unit of the second steering control device is capable of communicating with the first communication bus 17 as well as with the second communication bus 27.This is also a CAN data bus, in this embodiment of the invention.

[0047] Furthermore, in order to make the power supply of the vehicle's computers robust against electrical problems on the first on-board network 15 and on the second on-board network 25, all computers powered by the first on-board network 15 are connected in parallel to this first on-board network 15, and all computers powered by the second on-board network 25 are connected in parallel to this second on-board network 25.

[0048] A read-only communication link 31 allows, in this embodiment of the invention, the second control unit 22 to read the data circulating on the first communication bus 17. The first communication bus 17 and the second communication bus 27 are therefore independent of each other, although the first control unit 12 and the second control unit 22 can detect a failure of a safety-critical device on the vehicle, whether this safety-critical device is powered by the first on-board network 15 or by the second on-board network 25. Such detection is described later with reference to Figures 4 and 5.

[0049] In order to further detect faults in the power supply to the first on-board network 15, the vehicle 1 includes first sensors capable of providing first data on the state of the first low-voltage battery 14 to the first control unit 12 and on the first DC-DC converter 10 to the first control unit 11, the first sensors being powered by the first on-board network 15. This first data, transmitted on the first communication bus 17, includes in particular:

[0050] - a voltage V1 measured on the first on-board network 15 and returned to the first control unit 11 by a voltmeter connected to the terminals of the first on-board network 15;

[0051] - a current II measured on the first on-board network 15 and traced back to the first control unit 11 by an ammeter connected to a positive bus of the first on-board network 15;

[0052] - a temperature Tl of the first direct current converter 10, measured by a temperature sensor arranged for example on a component of the first DC-DC converter 10, and reported to the first control unit 11. Although not shown, a temperature of a heat transfer fluid circulating in a cooling plate of the first DC-DC converter 10 is also reported to the first control unit 11, this temperature of the heat transfer fluid being treated similarly by the first control unit 11 to the temperature Tl of the first DC-DC converter 10, only temperature thresholds associated with this temperature of the heat transfer fluid being different, these thresholds being used for the detection of a failure of the first DC-DC converter 10;

[0053] - a temperature T14 of the first low-voltage battery 14, measured by a temperature sensor arranged for example on a component of the first low-voltage battery 14, and transmitted to the first control unit 12; and

[0054] - a voltage V14 across the terminals of the first low-voltage battery 14, measured by a voltmeter connected to the terminals of the first low voltage battery 14, and connected back to the first control unit 12.

[0055] Similarly, in order to further detect faults in the power supply to the second on-board network 25, the vehicle 1 includes second sensors capable of providing second data on the state of the second low-voltage battery 24 to the second control unit 22 and on the second DC-DC converter 20 to the second control unit 21, the second sensors being powered by the second on-board network 25. This second data, transmitted on the second communication bus 27, includes in particular:

[0056] - a voltage V2 measured on the second on-board network 25 and reported to the second control unit 21 by a voltmeter connected to the terminals of the second on-board network 25;

[0057] - a current 12 measured on the second on-board network 25 and returned to the second control unit 21 by an ammeter connected to a positive bus of the second on-board network 25;

[0058] - a temperature T2 of the second DC-DC converter 20, measured by a temperature sensor arranged for example on a component of the second DC-DC converter 20, and reported to the second control unit 21. Although not shown, a temperature of a heat transfer fluid circulating in a cooling plate of the second DC-DC converter 20 is also reported to the second control unit 21, this temperature of the heat transfer fluid being treated similarly by the second control unit 21 to the temperature T2 of the second DC-DC converter 20, only temperature thresholds associated with this temperature of the heat transfer fluid being different, these thresholds being used for the detection of a failure of the second DC-DC converter 20;

[0059] - a temperature T24 of the second low-voltage battery 24, measured by a temperature sensor arranged for example on a component of the second low-voltage battery 24, and fed back to the second control unit 22; and

[0060] - a voltage V24 across the terminals of the second low-voltage battery 24, measured by a voltmeter connected to the terminals of the second low voltage battery 24, and connected back to the second control unit 22.

[0061] We now describe in relation to [Fig.2], the control of the first current-DC-DC converter 10, in order to explain which parameters are monitored by the first control unit 11 and by the first control unit 12.

[0062] The first control unit 12 includes a first determination block DI which develops a first initial output voltage setpoint VI* as a function of the health status of the first low voltage battery 14, the voltage VB across the terminals of the high voltage battery 8, and data provided by the first control unit 11 when it is activated.

[0063] In other words, at startup, before the first control unit 11 is activated, the first initial output voltage setpoint VI* takes into account the state of charge of the high-voltage battery 8 and the state of health of the first low-voltage battery 14 to determine the first initial output voltage setpoint VI*. If the first low-voltage battery 14 is abnormally hot or abnormally discharged, the first control unit 12 will not determine a first initial output voltage setpoint VI* but will prevent startup and will not activate the first DC-DC converter 10. Otherwise, the first control unit 12 activates the first control unit 11 and determines a first initial output voltage setpoint VI*, which it sends to it.

[0064] When the first control unit 11 is activated, it determines a first corrected output voltage setpoint Vl_ref for the first DC-DC converter 10 as a function of a voltage difference between on the one hand the first initial output voltage setpoint VI* and on the other hand the voltage VI on the first on-board network 15, and as a function of limitations related to the first DC-DC converter 10.

[0065] More specifically, the voltage difference between the initial first output voltage setpoint VI* and the voltage V1 on the first on-board network 15 is sent to the input of a first PII regulator, which provides an unclipped first current setpoint II# at its output. This setpoint is sent to the input of a first thresholding filter SI, which provides a final first current setpoint II* at its output. The first thresholding filter SI clips the unclipped first current setpoint II# according to a maximum current threshold Il_max and a maximum temperature threshold Tl_max associated with the first DC-DC converter 10. The final first current setpoint II* is converted by a first converter Cl into the corrected first output voltage setpoint Vl_ref, which is applied at the output of the first DC-DC converter 10.This is converted into s 10 control signals of the first DC-DC converter 10.

[0066] The first control unit 11 transmits the current II flowing on the first on-board network 15, the temperature Tl of the first DC-DC converter 10 and the voltage V1 across the terminals of the first on-board network 15 to the first control unit 12 so that the latter adapts in real time the first The initial output voltage setpoint VI* is determined based on the health status of the high-voltage battery 8, the first low-voltage battery 14, and the first DC-DC converter 10. Specifically, the first control block DI receives this initial data, along with the maximum current threshold Il_max, a maximum voltage threshold Vl_max at the output of the first DC-DC converter 10, the maximum temperature threshold Tl_max, and a maximum power threshold Pl_max at the output of the first DC-DC converter 10, and uses this information to adjust the initial output voltage setpoint VI*. This setpoint can be reduced, for example, if one of these thresholds is exceeded or if the voltage across the high-voltage battery 8 or the first low-voltage battery 14 is too low.

[0067] It should be noted that the second control unit 22, having read-only access to the first communication bus 17, has access to all the initial data transmitted to the first control unit 12 and the first command unit 11, as well as to the initial output voltage setpoint VI*, and can therefore detect an electrical fault on the first on-board network 15. The thresholds related to the limitations of the first DC-DC converter can optionally also be read by the second control unit 22 if they are transmitted by the first command unit 11 to the first control unit 12. It should be noted that numerous embodiments of the invention are conceivable; in particular, certain data can be transmitted directly to one of the control units without going through a communication bus.

[0068] We now describe in relation to [Fig.3] the control of the second DC-DC converter 20, very similar to that of the first DC-DC converter 10, but which is based on the data transmitted both on the first communication bus 17 and on the second communication bus 27.

[0069] The second control unit 22 includes a second determination block D2 which develops a second initial output voltage setpoint V2* based on the health status of the second low-voltage battery 24, the voltage VB across the terminals of the high-voltage battery 8, and data provided by the second control unit 21 when it is activated, independently of the development of the first initial output voltage setpoint VI* performed by the first control unit 12. The voltage VB across the terminals of the high-voltage battery 8 is read by the second control unit 22 on the first communication bus 17, while the health status of the second low-voltage battery 24 and the data provided by the second control unit 21 are read by the second control unit 22 on the second communication bus 27.

[0070] At startup, before the second control unit 21 is activated, the second initial output voltage setpoint V2* takes into account the state of charge of the high-voltage battery 8 and the state of health of the second low-voltage battery 24 to determine the second initial output voltage setpoint V2*. If the second low-voltage battery 24 is abnormally hot or abnormally discharged, the second control unit 22 will not determine a second initial output voltage setpoint V2* but will prevent startup and will not activate the second DC-DC converter 20. Otherwise, the second control unit 22 activates the second control unit 21 synchronously with the activation of the first control unit 12, and determines a second initial output voltage setpoint V2* which it sends to the second control unit 21.

[0071] When the second control unit 21 is activated, it determines a second corrected output voltage setpoint V2_ref for the second DC-DC converter 20 as a function of a voltage difference between on the one hand the initial second output voltage setpoint V2* and on the other hand the voltage V2 on the second on-board network 25, and as a function of limitations related to the second DC-DC converter 20.

[0072] More specifically, the voltage difference between the initial second output voltage setpoint V2* and the voltage V2 on the second on-board network 25 is sent to the input of a second regulator PI2, which provides an output of a second unclipped current setpoint 12#. This setpoint is sent to the input of a second thresholding filter S2, which provides an output of a final second current setpoint 12*. The second thresholding filter S2 clips the unclipped second current setpoint 12# based on a maximum current threshold I2_max and a maximum temperature threshold T2_max associated with the second DC-DC converter 20. The final second current setpoint 12* is converted by a second converter C2 into the corrected second output voltage setpoint V2_ref, which is applied to the output of the second DC-DC converter 20.This is converted into s20 control signals for the second DC-DC converter 20.

[0073] The second control unit 21 transmits the current 12 flowing on the second on-board network 25, the temperature T2 of the second DC-DC converter 20, and the voltage V2 across the terminals of the second on-board network 25 to the second control unit 22 so that the latter adapts in real time the second initial output voltage setpoint V2* according to the health status of the high-voltage battery 8, that of the second low-voltage battery 24, and the state of the second DC-DC converter 20. In particular, the The second control block D2 receives this second set of data, along with the maximum current threshold I2_max, a maximum voltage threshold V2_max at the output of the second DC-DC converter 20, the maximum temperature threshold T2_max, and a maximum power threshold P2_max at the output of the second DC-DC converter 20. It then uses this data and these thresholds to adjust the initial output voltage setpoint V2*. For example, this setpoint can be reduced if one of the thresholds is exceeded or if the voltage across the high-voltage battery 8 or the second low-voltage battery 24 is too low.

[0074] With reference to [Fig.4], a method 100 for starting vehicle 1 is now described, vehicle 1 being previously in standby mode.

[0075] During a first step 102, the first control unit 12 receives a message requesting the vehicle 1 to start, for example due to a user pressing a button to start the vehicle 1.

[0076] In a second step 104, the first control unit 12 checks the health status of the first low-voltage battery 14 and the high-voltage battery 8. If these batteries are functional, the first control unit 12 sends a wake-up message to the first control unit 11 on the first communication bus 17 and proceeds to the following steps 106 and 108; otherwise, the first control unit 12 prevents the vehicle 1 from starting. In this example of use of the invention, it is assumed that in this second step 104, the first control unit 12 sends a wake-up message to the first control unit 11.

[0077] Following this transmission, the second control unit 22, which is assumed here to be functional, reads this wake-up message and also sends a wake-up message but to the second control unit 21, on the second communication bus 27, during a step 106, if the state of the second low-voltage battery 24 allows it, which is assumed in this example of use of the invention.

[0078] During subsequent steps 108 and 110, which run in parallel, the first control unit 11 and the second control unit 21 each perform a self-diagnostic check. If either control unit 11 or 22 detects a fault during this self-diagnostic check, it sends a fault message to the control unit 12 or 22 that has sent it a wake-up message, on the corresponding communication bus. If the first control unit 11 sends a fault message to the first control unit 12, the latter prevents the vehicle 1 from starting.

[0079] In this example of use of the invention, it is assumed that the first control unit 11 and the second control unit 21 do not send a fault message to the first and second control units 12 and 22, respectively, and the following steps are then a step 112 of sending an activation message to the first control unit 11 by the first control unit 12 on the first bus of communication 17, followed by a step 114 of reading by the second control unit 22 of this activation message, and sending by the second control unit 22 of an activation message to the second control unit 21 on the second communication bus 27. The first and second control units 21, 22 then activate in parallel during steps 116, 118 respectively.

[0080] Following the activation step 116 of the first control unit 21, the first DC-DC converter 10 supplies power to all the computers connected to it. The first control unit 12 then verifies that all the vehicle's computers are awake, except for the second control unit 21 and the second control unit 22, by reading the first communication bus 17. It is this verification step that allows the first control unit 12 to prevent the vehicle 1 from starting in the following cases:

[0081] - the second control unit has a fault and was unable to activate the second DC-DC converter DC 20, steps 106, 110, 114 and 118 not being carried out, and as a result the computers supplied by the second on-board network 25 such as that of the second braking device 26 or the second steering control device could not wake up after step 116.

[0082] - the condition of the second low-voltage battery 24 does not allow operation nominal of the second on-board network 25, steps 110, 114 and 118 not being carried out, no wake-up message having been sent during step 106 by the second control unit 22, and as a result the computers supplied by the second on-board network 25 such as that of the second braking device 26 or the second steering control device could not wake up after step 116.

[0083] - the second control unit 21 sent a fault message to the second control unit 22, during self-diagnostic step 110, steps 114 and 118 not being carried out, and as a result the computers supplied by the second on-board network 25 such as that of the second braking device 26 or the second steering control device could not wake up after step 116.

[0084] It is therefore understood how the first control unit 12 and the second control unit 22 are each capable of preventing the vehicle 1 from starting as soon as an anomaly is detected on either of the first or second on-board networks 15, 25, despite the independence of the two on-board networks 15, 25 and the two communication buses 17, 27.

[0085] With reference to [Fig.5], a method 200 for controlling vehicle 1 is now described, the vehicle being in the driving phase.

[0086] A first step 202 of the control process 200 is a detection step by the first or respectively the second control unit 12, 22 of the fact that:

[0087] - the voltage respectively VI, V2 on the first or respectively on the second network on board 15, 25 is above the maximum voltage threshold respectively Vl_max, V2_max, or - the temperature respectively Tl, T2 of the first or respectively of the second DC-DC converter 10, 20 is above the maximum temperature threshold respectively Tl_max, T2_max, or

[0088] - the output power of the first or respectively of the second converter direct current - direct current 10, 20 is above the maximum power threshold respectively Pl_max, P2_max, or - the current respectively II, 12 on the first or respectively the second on-board network 15, 25 is too close to the maximum current threshold respectively Il_max, I2_max, for example less than 50 amps of this maximum current, or - an anomaly is reported by the first or respectively the second control unit 11,21 to the first or respectively second control unit 12, 22;

[0089] The next step is then, when the first or respectively the second control unit 11, 21 allows it, i.e. it has not gone into fault, a step 204 of switching to degraded mode of the first or respectively second DC-DC converter 10, 20. For this, the first or respectively the second control unit 12, 22 progressively limits the first or respectively the second initial output voltage setpoint VI*, V2*.

[0090] In parallel with this step 204 of switching to degraded mode, the first or respectively the second control unit 12, 22 actuates 206 the first or respectively the second braking device 16, 26, as well as the first or respectively the second steering control device, to perform 208 an emergency parking of the vehicle 1.

[0091] It should be noted that the second control unit 22, having read-only access to the messages circulating on the first communication bus 17, can take the initiative to carry out emergency parking in the event that the first control unit 12 does not react when a fault is detected on the first on-board network 15 also by the second control unit 22, for a predetermined period after this detection.

[0092] Conversely, the first control unit 12 is capable of braking the vehicle and stopping it if it detects that the second steering control device is no longer responding, for example because the second on-board network 25 is no longer functional.

[0093] Generally, the first control unit 12 and the second control unit 22 are each capable of stopping the vehicle as soon as one of the vehicle's computers connected to the first communication bus 17 stops working, since the first control unit 12 supervises these computers, except itself, through the first communication bus 17, and since the second control unit 22 supervises these computers through the read-only communication link 31.

[0094] Of course, the invention is not limited to the examples just described, and many modifications can be made to these examples without departing from the scope of the invention. In particular, the vehicle according to the invention includes, as an alternative, a single steering control device. The features of the different embodiments mentioned in this application can be combined to carry out the invention, provided that these embodiments are not incompatible with each other.

Claims

Demands

1. Electric or hybrid vehicle (1), comprising: - a high-voltage battery (8) capable of powering an electric powertrain of the vehicle (1), - a first low-voltage battery (14), a first braking device (16), a first control unit (12) capable of controlling the vehicle (1) by activating the first braking device (16), and a first on-board network (15) to which at least the first low-voltage battery (14) and the first control unit (12) are connected, - a first DC-DC converter (10) connected in input to the high-voltage battery (8) and in output to the first on-board network (15), - a second low-voltage battery (24), a second braking device (26), and a second on-board network (25) to which at least the second low-voltage battery (24) is connected,- a second DC-DC converter (20) connected at the input to the high-voltage battery (8) and at the output to the second on-board network (25), the vehicle (1) being characterized in that it comprises a second control unit (22) capable of being powered by the second on-board network (25) and of controlling the vehicle (1) by activating the second braking device (26).

2. Electric or hybrid vehicle (1) according to claim 1, wherein the first control unit (12) and the second control unit (22) are each capable of prohibiting the vehicle (1) from moving as soon as an anomaly on the first or second on-board network (15, 25) is detected.

3. An electric or hybrid vehicle (1) according to claim 1 or 2, further comprising: - a first control unit (11), capable of controlling the first DC-DC converter (10) while being powered by the first on-board network (15), and a first communication bus (17) linking the first control unit (12) to the first control unit (11), - a second control unit (21), capable of controlling the second DC-DC converter (20) while being powered by the second on-board network (25), and a second communication bus (27) linking the second control unit (22) to the second command unit (21), and a read-only communication link (31, 32) linking the first communication bus (17) to the second control unit (22).

4. Electric or hybrid vehicle (1) according to claim 3, further comprising first sensors capable of providing first data on a state of the first low-voltage battery (14) to the first control unit (12) and on the first DC-DC converter (10) to the first control unit (11), the first sensors being powered by the first on-board network (15), and second sensors capable of providing second data on a state of the second low-voltage battery (24) to the second control unit (22) and on the second DC-DC converter (20) to the second control unit (21), the second sensors being powered by the second on-board network (25).

5. Electric or hybrid vehicle (1) according to claim 4, wherein the second control unit (22) is capable of synchronizing an activation of the second control unit (21) with an activation of the first control unit (11) by the first control unit (12), according to at least one of the second data related to the second low-voltage battery (24).

6. Electric or hybrid vehicle (1) according to claim 4 or 5, wherein the first control unit (12) is capable of developing a first initial output voltage setpoint (VI*) for the first DC-DC converter (10) as a function of at least one data point (VB) related to the high-voltage battery (8) and at least one of the first data points, and the second control unit (22) is capable of developing a second initial output voltage setpoint (V2*) for the second DC-DC converter (20) as a function of said at least one data point (VB) related to the high-voltage battery (8) and at least one of the second data points, independently of a development of the first initial output voltage setpoint (VI*) carried out by the first control unit (12).

7.

8.

9. Electric or hybrid vehicle (1) according to claim 6, wherein the first control unit (11) is capable of determining a first corrected output voltage setpoint (V1_ref) for the first DC-DC converter (10) as a function of a voltage difference between, on the one hand, the first initial output voltage setpoint (V1*) and, on the other hand, a voltage (V1) on the first on-board network (15), and as a function of limitations related to the first DC-DC converter (10), and the second control unit (21) is capable of determining a second corrected output voltage setpoint (V2_ref) for the second DC-DC converter (20) as a function of a voltage difference between, on the one hand, the second initial output voltage setpoint (V2*) and, on the other hand, a voltage (V2) on the second on-board network (25),and depending on limitations related to the second DC-DC converter (20). Electric or hybrid vehicle (1) according to claim 6 or 7, wherein the first control unit (12) or respectively the second control unit (22) is capable of progressively reducing the first or respectively the second initial output voltage setpoint (VI*, V2*) and stopping the vehicle (1) as soon as: - the voltage (VI, V2) on the first or respectively on the second on-board network (15, 25) is above a predetermined voltage threshold, or - a temperature value (T1, T2) representative of a heating of the first or respectively of the second DC-DC converter (10, 20) is above a predetermined temperature threshold, or - a current (II, 12) on the first or respectively the second on-board network (15, 25) is above a predetermined current threshold, or - an anomaly is reported by the first or respectively the second control unit (11, 21). (1) electric or hybrid vehicle according to any one of claims 1 to 8, further comprising a cooling system common to the first and second DC-DC converter (10, 20). 22

10. Electric or hybrid vehicle (1) according to any one of claims 1 to 9, wherein the first braking device (16) is a regenerative braking system and the second braking device (26) is a hydraulic braking system.

Images