Electric or hybrid vehicle with double safety braking device

Abstract

The invention relates to an electric or hybrid vehicle (1), comprising: a high-voltage battery (8); a first low-voltage battery (14) supplying a first on-board network (15) to which are connected a first braking device (16) and a first control unit (12) capable of activating the first braking device (16); and a second low-voltage battery (24) supplying a second on-board network (25) to which a second braking device (26) is connected, the vehicle (1) comprising a second control unit (22) which can be powered by the second on-board network (25) and which is able to activate the second braking device (26).

Description

Description Title of the invention: Electric or hybrid vehicle with dual safety braking system

[0001] The present invention relates to the fields of electricity and the automotive industry, and more specifically concerns an electric or hybrid vehicle adapted to ensure the necessary safety when autonomous driving of the vehicle is engaged.

[0002] Autonomous vehicles compatible with levels 4 or 5 of autonomy established by the International Organization of Motor Vehicle Manufacturers (OMA) are gaining importance in the logistics sector and in applications requiring so-called "last-mile" delivery—that is, autonomous movement within a controlled environment such as a properly mapped industrial site. Such a vehicle is capable of driving without human supervision and without physical actuators like a steering wheel or brake pedal that would allow a driver to regain control of the vehicle.

[0003] It is therefore essential to be able to stop such a vehicle in the event of a safety issue, especially since no human driver can intervene in such a situation. Safety redundancy of the braking system is specifically considered in such a vehicle, to allow it to be stopped if one of its braking systems fails.

[0004] However, the inventors found that the proposed braking solutions, even with safety redundancy, do not allow the vehicle to be stopped in all the scenarios they identified, particularly in the event of electrical failure.

[0005] The present invention aims to remedy at least in part the aforementioned drawbacks by providing an electric or hybrid vehicle, comprising redundancy of braking means, and whose electrical architecture is adapted to this redundancy of braking means so as to make them truly independent, in a low-cost manner.

[0006] To this end, the invention proposes an electric or hybrid vehicle, comprising: - a high-voltage battery capable of powering an electric powertrain for the vehicle, - a first low-voltage battery, a first braking device, a first control unit capable of controlling the vehicle by activating the first braking device, and a first on-board network to which at least the first low-voltage battery and the first control unit are connected, - a first DC-DC converter connected at the input to the high-voltage battery and at the output to the first on-board network, - a second low-voltage battery, a second braking system, and a second on-board network to which at least the second low-voltage battery is connected, - a second DC-DC converter connected at the input to the high-voltage battery and at the output to the second on-board network, the vehicle being characterized in that it includes a second control unit capable of being powered by the second on-board network and of controlling the vehicle by activating the second braking device.

[0007] Thanks to this invention, each vehicle braking system is powered and controlled by independently and reliably powered onboard networks. Specifically, if one of the low-voltage batteries fails to supply power to its connected onboard network, that network can still be powered by one of the DC-DC converters to which it is connected. Conversely, if one of the DC-DC converters fails to supply power to its connected onboard network, that network can still be powered by one of the low-voltage batteries connected to it. Therefore, the power supply to each braking system and its control unit is secure.

[0008] The first braking device is, for example, a regenerative braking system and the second braking device is, for example, a hydraulic braking system.

[0009] Furthermore, since each braking system is controlled by a separate control unit, even if one control unit fails, the other can activate the braking system for which it has control means. The control means for each braking system are powered by the vehicle's electrical system to which the control unit capable of activating that braking system is connected.

[0010] Furthermore, the vehicle architecture proposed by the invention is inexpensive and flexible. Indeed, additional DC-DC converters can be connected at the input to the high-voltage battery and at the output to yet another on-board network, powering, for example, other safety equipment, in a similar manner to the first and second DC-DC converters. The DC-DC converters, control units, and low-voltage batteries used in the invention can be identical or nearly identical, thus reducing investment costs for vehicle manufacturing. Finally, Vehicle development costs are limited due to the simplicity of the proposed architecture.

[0011] In one embodiment of the invention, the first and second control units are each capable of preventing the vehicle from moving as soon as an anomaly is detected on either the first or second on-board network. In this embodiment, each control unit is capable of detecting an anomaly on the on-board network to which it is connected, as well as on the on-board network to which the other control unit is connected, for example, via the communication buses linking the vehicle's computers. Indeed, as soon as a computer in a critical vehicle component fails to activate, both the first and second control units prevent the vehicle from moving. A critical component is defined as a component whose proper functioning is necessary to ensure, at a minimum, the safety of third parties, and therefore to provide emergency braking and / or parking.This ensures that the vehicle cannot be allowed to start as soon as a failure occurs on one of the on-board networks.

[0012] In one embodiment of the invention, the electric or hybrid vehicle according to the invention further comprises: - a first control unit, capable of operating the first DC-DC converter while being powered by the first on-board network, and a first communication bus linking the first control unit to the first command unit, - a second control unit, capable of controlling the second DC-DC converter by being powered by the second on-board network, and a second communication bus linking the second control unit to the second control unit, and a read-only communication link linking the first communication bus to the second control unit.

[0013] Therefore, while driving, as soon as one of the low-voltage batteries fails, the DC-DC converter to which it is connected will no longer power the corresponding onboard electrical system the next time the vehicle is started, and starting will not be permitted. Conversely, as soon as one of the DC-DC converters stops supplying current while driving, the low-voltage battery to which it is connected will discharge rapidly, thus also preventing the vehicle from starting the next time it is started.

[0014] Indeed, read-only communication between the first communication bus and the second control unit makes it possible to condition the vehicle's start-up on the proper functioning of both on-board networks.

[0015] Furthermore, it avoids significantly altering the operation of each control unit, and in particular, it prevents modifying the messages it transmits or receives. For example, the communication link allows the second control unit to read-only data from the first communication bus, without the first control unit processing the data transmitted on the second communication bus. Everything therefore proceeds as if the second control unit, and more generally the second on-board network, did not exist for the first control unit. The second control unit can thus take into account what is happening on the first on-board network, even if it is not connected to it, in order to stop the vehicle when a problem is detected.Each communication bus is powered by the on-board network to which the control unit and the command unit it serves are connected, the two communication buses being independent of each other.

[0016] Although the first and second communication buses are independent, meaning they do not communicate with each other, the vehicle's computers, except for the second control unit and the second command unit, are all interconnected via the first communication bus. This allows for minimal modification of the vehicle's initial architecture to integrate the invention. The second braking system, in particular, is therefore connected to both communication buses while also being powered by the second on-board network. Alternatively, at least the computers for the vehicle's critical components are interconnected via the first communication bus. This includes the first control unit, the first command unit, and the vehicle's braking and steering systems.

[0017] Alternatively, in addition to this read-only communication, a read-only communication between the second communication bus and the first control unit can be added. In this embodiment, at least one vehicle computer is, for example, connected to both communication buses while also being accessed via the first on-board network.

[0018] In one embodiment of the invention, the vehicle further comprises first sensors capable of providing initial data on the state of the first low-voltage battery to the first control unit and on the first DC-DC converter to the first control unit, the first sensors being powered by the first on-board network, and second sensors capable of providing second data on the state of the second low-voltage battery to the second control unit and on the second DC-DC converter to the second control unit, the second sensors being powered by the second on-board network. Each on-board network can thus be controlled independently of each other using their own sensors, which are for example temperature, voltage and current sensors.

[0019] The second control unit is, for example, capable of synchronizing an activation of the second control unit with an activation of the first control unit by the first control unit, based on at least one of the second data points related to the second low-voltage battery. In other words, when the second low-voltage battery allows it—that is, when its condition is normal—the second control unit initiates the activation of the other vehicle equipment on the second on-board network in a manner synchronized with the first control unit. Thus, the on-board networks are functional simultaneously, allowing the control units to be operational as soon as a problem occurs on one of the on-board networks.The second control unit uses, for example, the read-only communication link with the first control unit, to synchronize the activation of the second control unit with the activation of the first control unit.

[0020] The first control unit is, for example, capable of developing a first initial output voltage setpoint for the first DC-DC converter as a function of at least one data point related to the high-voltage battery and at least one of the first data points, and the second control unit is capable of developing a second initial output voltage setpoint for the second DC-DC converter as a function of said at least one data point related to the high-voltage battery and at least one of the second data points, independently of a development of the first initial output voltage setpoint carried out by the first control unit.

[0021] Thus, the first and second control units independently manage the power supply to the onboard network to which they are connected, based on the state of the high-voltage battery, the state of the first or second low-voltage battery, and, when the first or second DC-DC converter is activated, its state. The state of the high-voltage battery is provided by a high-voltage battery management device connected to the first communication bus; this state can be read by the second control unit via the communication link between the first communication bus and the second control unit.

[0022] The first control unit is, for example, capable of determining a first corrected output voltage setpoint for the first DC converter - Direct current as a function of a voltage difference between, on the one hand, the initial output voltage setpoint and, on the other hand, a voltage on the first on-board network, and as a function of limitations related to the first DC converter - direct current, and the second control unit is capable of determining a second corrected output voltage setpoint for the second DC-DC converter as a function of a voltage difference between on the one hand the initial second output voltage setpoint and on the other hand a voltage on the second on-board network, and as a function of limitations related to the second DC-DC converter.

[0023] The first or second control unit drives the first or second DC-DC converter, respectively, with the first or second corrected output voltage setpoint. Each DC-DC converter is therefore controlled by a dual independent control loop, which allows the DC-DC converter to be switched to a degraded mode more quickly to protect it, and / or to detect a DC-DC converter failure more quickly.

[0024] For example, the first control unit or the second control unit is capable of gradually decreasing the first or second initial output voltage setpoint and stopping the vehicle as soon as: - the voltage on the first or respectively on the second on-board network is above a predetermined voltage threshold, or - a temperature reading representative of a heating of the first or respectively the second DC-DC converter is above a predetermined temperature threshold, or - a current on the first or respectively the second onboard network is above a predetermined current threshold, or - an anomaly is reported by the first or respectively the second control unit.

[0025] Furthermore, the vehicle according to the invention includes, for example, a cooling system common to the first and second DC-DC converters. This reduces the cost of the invention without compromising the independence between the first and second on-board electrical systems.

[0026] The invention also relates to a method for controlling an electric or hybrid vehicle according to the invention, the vehicle being in motion, the control method comprising a step of detecting the fact that:

[0027] - the voltage on the first or respectively on the second on-board network is above a predetermined voltage threshold, or - a temperature reading representative of a heating of the first or respectively the second DC-DC converter is above a predetermined temperature threshold, or - a current on the first or respectively the second onboard network is above a predetermined current threshold, or - An anomaly is reported by the first or second control unit, respectively; the detection step is followed by a step of progressively decreasing the first or second initial output voltage setpoint by the first or second control unit, respectively, and braking the vehicle by the first or second control unit, respectively, until it comes to a stop. The invention also relates to a method for starting an electric or hybrid vehicle according to the invention, the vehicle being previously in standby mode, the starting method comprising the steps of:

[0028] - Sending an activation message for the first DC-DC converter from the first control unit to the first control unit,

[0029] - reading of the activation message by the second control unit and subsequent sending of an activation message of the second DC-DC converter by the second control unit, to the second control unit.

[0030] The control and start-up methods offer advantages similar to those of the method according to the invention.

[0031] Other features and advantages of the invention will become apparent from the following description on the one hand, and from several illustrative and non-limiting examples of embodiments given with reference to the attached schematic drawings on the other hand, in which:

[0032] [Fig.1] represents an electrical architecture of an electric or hybrid vehicle according to the invention, in one embodiment of the invention, showing how different vehicle equipment is powered and interconnected,

[0033] [Fig.2] represents the development of a first corrected voltage setpoint for a first DC-DC converter of the electrical architecture of [Fig.1],

[0034] [Fig.3] represents the development of a second corrected voltage setpoint for a second DC-DC converter of the electrical architecture of [Fig.1],

[0035] [Fig.4] represents a method for starting the electric or hybrid vehicle of the [Fig. 1], in one embodiment of the invention, and

[0036] [Fig. 5] represents a method for controlling the electric or hybrid vehicle of the [Fig.1], rolling, in one embodiment of the invention.

[0037] In one embodiment of the invention shown in [Fig. 1], a vehicle The electric or hybrid vehicle according to the invention comprises a high-voltage battery 8, with a voltage VB across its terminals. The voltage VB is, for example, between 200 and 800V. Indeed, a high-voltage battery is defined as a battery capable of supplying enough energy to power an electric traction or propulsion motor. of the vehicle, unlike a service battery with a nominal open-circuit voltage of less than 60V. The high-voltage battery 8 is, for example, a Lithium-ion technology battery.

[0038] A high-voltage battery management device 80, commonly called BMS (from the English "Battery Management System"), supervises the high-voltage battery 8 and is able to provide, in particular, on a first communication bus 17, the value of the voltage VB to a first control unit 12 of the vehicle 1. The first communication bus 17 is a CAN data bus (from the English "Controller Area Network").

[0039] The first communication bus 17 is powered by a first on-board network 15, with a nominal voltage, for example, of 14V. This first on-board network 15 is powered, when the vehicle 1 is in standby mode, by a first low-voltage battery 14, for example a lead-acid battery or a small lithium-ion battery, with a voltage across its terminals, for example, of 12V.

[0040] A first DC-DC converter 10, connected in input to the terminals of the high-voltage battery 8 and in output to the first on-board network 15, allows the latter to be powered when the vehicle is awake, so as to allow the first low-voltage battery 14 to be recharged and the low-voltage consumers of the vehicle connected to the first on-board network 15 to be powered. These low-voltage consumers include in particular the first control unit 12, a first control unit 11 of the first DC-DC converter 10, a first steering control device not shown and a control circuit of a first braking device 16.

[0041] The first braking device 16 is a regenerative braking system. It therefore includes an inverter, powered at its input by the high-voltage battery 8 and supplying at its output an electric traction or propulsion motor of the vehicle 1. The inverter includes a control circuit for its switches, forming the control circuit of the first braking device 16 and powered by the first on-board network 15, i.e., by low voltage. The control circuit is operated by the first control unit 12 via the first communication bus 15.

[0042] The first control unit 12 is the main computer for vehicle 1; that is, it controls the electric motor of vehicle 1, the charging of the high-voltage battery 8, and the steering and braking of vehicle 1. It is therefore capable of braking and stopping vehicle 1 in the event of a fault in the high-voltage network, the first on-board network 15, or one of the vehicle's safety devices. For this purpose, the vehicle's safety devices, including the first control unit 11, the control circuit of the first braking device 16, a second braking device 26 (which in this case is a hydraulic braking system for the vehicle), and the first and a second steering control device not shown, communicates with the first control unit 12 via the first communication bus 17.

[0043] It should be noted that by extension in this application, all control devices that can be activated by the first communication bus 17 are referred to as computers. Thus the first and second braking devices 16, 26 as well as the first and second steering control devices each have a computer connected to the first communication bus 17.

[0044] The vehicle 1 according to the invention also includes a second DC-DC converter 20 suitable for being controlled by a second control unit 21. The second DC-DC converter 20 is connected in input to the terminals of the high-voltage battery 8 and in output to a second on-board network 25, which supplies, when the vehicle 1 is woken up, the second control unit 21 as well as a second control unit 22, the second braking device 26 and the second steering control device.

[0045] When the vehicle 1 is in standby mode, the second on-board network 25 is powered by a second low-voltage battery 24, for example a lead-acid battery or a small 12V lithium-ion battery, which is then recharged by the second DC-DC converter 20 when it is activated.

[0046] The second control unit 22 is capable of braking and stopping the vehicle 1 in the event of a fault in the high-voltage network, the second on-board network 25, the second braking system 26, or the second steering control system. To this end, the second control unit 21, the second braking system 26, and the second steering control system, and in particular their control units, communicate with the second control unit 22 via a second communication bus 27, independent of the first communication bus 17. In other words, the control unit of the second braking system 26 is capable of communicating with both the first communication bus 17 and the second communication bus 27. Similarly, the control unit of the second steering control system is capable of communicating with both the first communication bus 17 and the second communication bus 27.This is also a CAN data bus, in this embodiment of the invention.

[0047] Furthermore, in order to make the power supply of the vehicle's computers robust against electrical problems on the first on-board network 15 and on the second on-board network 25, all computers powered by the first on-board network 15 are connected in parallel to this first on-board network 15, and all computers powered by the second on-board network 25 are connected in parallel to this second on-board network 25.

[0048] In this embodiment of the invention, a read-only communication link 31 allows the second control unit 22 to read the data circulating on the first communication bus 17. The first communication bus 17 and the second communication bus 27 are therefore independent of each other, although the first control unit 12 and the second control unit 22 can detect a failure of a safety-critical device on the vehicle, whether this safety-critical device is powered by the first on-board network 15 or by the second on-board network 25. Such detection is described later with reference to Figures 4 and 5.

[0049] In order to further detect faults in the power supply to the first on-board network 15, the vehicle 1 includes initial sensors capable of providing initial data on the state of the first low-voltage battery 14 to the first control unit 12 and on the first DC-DC converter 10 to the first control unit 11, the initial sensors being powered by the first on-board network 15. This initial data, transmitted on the first communication bus 17, includes in particular:

[0050] - a voltage V 1 measured on the first on-board network 15 and sent back to the first control unit 11 by a voltmeter connected to the terminals of the first on-board network 15;

[0051] - a current II measured on the first on-board network 15 and sent back to the first control unit 11 by an ammeter connected to a positive bus of the first on-board network 15;

[0052] - a temperature Tl of the first DC-DC converter 10, measured by a temperature sensor arranged for example on a component of the first DC-DC converter 10, and reported to the first control unit 11. Although not shown, a temperature of a heat transfer fluid circulating in a cooling plate of the first DC-DC converter 10 is also reported to the first control unit 11, this temperature of the heat transfer fluid being treated similarly by the first control unit 11 to the temperature Tl of the first DC-DC converter 10, only temperature thresholds associated with this temperature of the heat transfer fluid being different, these thresholds being used for the detection of a failure of the first DC-DC converter 10;

[0053] - a temperature T14 of the first low-voltage battery 14, measured by a temperature sensor arranged, for example, on a component of the first low-voltage battery 14, and reported to the first control unit 12; and

[0054] - a voltage V14 across the terminals of the first low voltage battery 14, measured by a voltmeter connected to the terminals of the first low voltage battery 14, and sent back to the first control unit 12.

[0055] Similarly, in order to further detect faults in the power supply to the second on-board network 25, the vehicle 1 includes second sensors capable of providing second data on the status of the second low-voltage battery 24 to the second control unit 22 and on the second DC-DC converter 20 to the second control unit 21, the second sensors being powered by the second on-board network 25. This second data, transmitted on the second communication bus 27, includes in particular:

[0056] - a voltage V2 measured on the second on-board network 25 and sent back to the second control unit 21 by a voltmeter connected to the terminals of the second on-board network 25;

[0057] - a current 12 measured on the second on-board network 25 and sent back to the second control unit 21 by an ammeter connected to a positive bus of the second on-board network 25;

[0058] - a temperature T2 of the second DC-DC converter 20, measured by a temperature sensor arranged for example on a component of the second DC-DC converter 20, and reported to the second control unit 21. Although not shown, a temperature of a heat transfer fluid circulating in a cooling plate of the second DC-DC converter 20 is also reported to the second control unit 21, this temperature of the heat transfer fluid being treated similarly by the second control unit 21 to the temperature T2 of the second DC-DC converter 20, only temperature thresholds associated with this temperature of the heat transfer fluid being different, these thresholds being used for the detection of a failure of the second DC-DC converter 20;

[0059] - a temperature T24 of the second low-voltage battery 24, measured by a temperature sensor arranged, for example, on a component of the second low-voltage battery 24, and transmitted to the second control unit 22; and

[0060] - a voltage V24 across the terminals of the second low voltage battery 24, measured by a voltmeter connected to the terminals of the second low voltage battery 24, and sent back to the second control unit 22.

[0061] We now describe in relation to [Fig.2], the control of the first current-DC to current-DC converter 10, in order to explain which parameters are monitored by the first control unit 11 and by the first control unit 12.

[0062] The first control unit 12 includes a first determination block DI which develops a first initial output voltage setpoint VI* as a function of the health status of the first low voltage battery 14, the voltage VB across the terminals of the high voltage battery 8, and data provided by the first control unit 11 when it is activated.

[0063] In other words, at startup, before the first control unit 11 is activated, the initial output voltage setpoint VI* takes into account the state of charge of the high-voltage battery 8 and the health status of the first low-voltage battery 14 to determine the initial output voltage setpoint VI*. If the first low-voltage battery 14 is abnormally hot or abnormally discharged, the first control unit 12 will not determine an initial output voltage setpoint VI* but will prevent startup and will not activate the first DC-DC converter 10. Otherwise, the first control unit 12 activates the first control unit 11 and determines an initial output voltage setpoint VI*, which it sends to it.

[0064] When the first control unit 11 is activated, it determines a first corrected output voltage setpoint Vl_ref for the first DC-DC converter 10 as a function of a voltage difference between on the one hand the first initial output voltage setpoint VI* and on the other hand the voltage VI on the first on-board network 15, and as a function of limitations related to the first DC-DC converter 10.

[0065] More specifically, the voltage difference between the initial output voltage setpoint VI* and the voltage VI on the first onboard network 15 is sent to the input of a first PII regulator, which provides an unclipped initial current setpoint II# at its output. This setpoint is then sent to the input of a first thresholding filter SI, which provides a final initial current setpoint II* at its output. The first thresholding filter SI clips the unclipped initial current setpoint II# based on a maximum current threshold Il_max and a maximum temperature threshold Tl_max associated with the first DC-DC converter 10. The final initial current setpoint II* is converted by a first converter Cl into the corrected initial output voltage setpoint Vl_ref, which is applied at the output of the first DC-DC converter 10.This is converted into s 10 control signals of the first DC-DC converter 10.

[0066] The first control unit 11 transmits the current II flowing on the first on-board network 15, the temperature Tl of the first DC-DC converter 10, and the voltage VI across the terminals of the first on-board network 15 to the first control unit 12 so that the latter can adapt the first The initial output voltage setpoint VI* is determined based on the health status of the high-voltage battery 8, the first low-voltage battery 14, and the first DC-DC converter 10. Specifically, the first control block DI receives this initial data, along with the maximum current threshold Il_max, a maximum voltage threshold Vl_max at the output of the first DC-DC converter 10, the maximum temperature threshold Tl_max, and a maximum power threshold Pl_max at the output of the first DC-DC converter 10. This data is then used to adjust the initial output voltage setpoint VI*. For example, this setpoint can be reduced if one of these thresholds is exceeded or if the voltage across the high-voltage battery 8 or the first low-voltage battery 14 is too low.

[0067] It should be noted that the second control unit 22, having read-only access to the first communication bus 17, has access to all the initial data transmitted to the first control unit 12 and the first command unit 11, as well as to the initial output voltage setpoint VI*, and can therefore detect an electrical fault on the first on-board network 15. The thresholds related to the limitations of the first DC-DC converter can also be read by the second control unit 22 if they are transmitted from the first command unit 11 to the first control unit 12. It should be noted that numerous embodiments of the invention are conceivable; in particular, certain data can be transmitted directly to one of the control units without going through a communication bus.

[0068] We now describe in relation to [Fig.3] the control of the second DC-DC converter 20, very similar to that of the first DC-DC converter 10, but which relies on the data transmitted both on the first communication bus 17 and on the second communication bus 27.

[0069] The second control unit 22 includes a second determination block D2 which develops a second initial output voltage setpoint V2* based on the health status of the second low-voltage battery 24, the voltage VB across the terminals of the high-voltage battery 8, and data provided by the second control unit 21 when it is activated, independently of the development of the first initial output voltage setpoint VI* performed by the first control unit 12. The voltage VB across the terminals of the high-voltage battery 8 is read by the second control unit 22 on the first communication bus 17, while the health status of the second low-voltage battery 24 and the data provided by the second control unit 21 are read by the second control unit 22 on the second communication bus 27.

[0070] At startup, before the second control unit 21 is activated, the second initial output voltage setpoint V2* takes into account the state of charge of the high-voltage battery 8 and the health status of the second low-voltage battery 24 to determine the second initial output voltage setpoint V2*. If the second low-voltage battery 24 is abnormally hot or abnormally discharged, the second control unit 22 will not determine a second initial output voltage setpoint V2* but will prevent startup and will not activate the second DC-DC converter 20. Otherwise, the second control unit 22 activates the second control unit 21 synchronously with the activation of the first control unit 12, and determines a second initial output voltage setpoint V2* which it sends to the second control unit 21.

[0071] When the second control unit 21 is activated, it determines a second corrected output voltage setpoint V2_ref for the second DC-DC converter 20 as a function of a voltage difference between on the one hand the initial second output voltage setpoint V2* and on the other hand the voltage V2 on the second on-board network 25, and as a function of limitations related to the second DC-DC converter 20.

[0072] More specifically, the voltage difference between the initial second output voltage setpoint V2* and the voltage V2 on the second onboard network 25 is sent to the input of a second regulator PI2, which provides an unclipped second current setpoint 12# at its output. This setpoint is sent to the input of a second thresholding filter S2, which provides a final second current setpoint 12* at its output. The second thresholding filter S2 clips the unclipped second current setpoint 12# based on a maximum current threshold I2_max and a maximum temperature threshold T2_max associated with the second DC-DC converter 20. The final second current setpoint 12* is converted by a second converter C2 into the corrected second output voltage setpoint V2_ref, which is applied to the output of the second DC-DC converter 20.This is converted into s20 control signals for the second DC-DC converter 20.

[0073] The second control unit 21 transmits the current 12 flowing on the second on-board network 25, the temperature T2 of the second DC-DC converter 20, and the voltage V2 across the terminals of the second on-board network 25 to the second control unit 22 so that the latter can adapt in real time the second initial output voltage setpoint V2* according to the health status of the high-voltage battery 8, that of the second low-voltage battery 24, and the state of the second DC-DC converter 20. In particular, the The second control block D2 receives this second set of data, along with the maximum current threshold I2_max, a maximum voltage threshold V2_max at the output of the second DC-DC converter 20, the maximum temperature threshold T2_max, and a maximum power threshold P2_max at the output of the second DC-DC converter 20. It then uses this data and these thresholds to adjust the initial output voltage setpoint V2*. For example, this setpoint can be reduced if one of the thresholds is exceeded or if the voltage across the high-voltage battery 8 or the second low-voltage battery 24 is too low.

[0074] With reference to [Fig.4], we now describe a method 100 for starting vehicle 1, vehicle 1 being previously in standby mode.

[0075] In a first step 102, the first control unit 12 receives a message requesting the start of vehicle 1, for example due to a user pressing a start button on vehicle 1.

[0076] In a second step 104, the first control unit 12 checks the health status of the first low-voltage battery 14 and the high-voltage battery 8. If these batteries are functional, the first control unit 12 sends a wake-up message to the first control unit 11 on the first communication bus 17, and the following steps 106 and 108 proceed; otherwise, the first control unit 12 prevents the vehicle 1 from starting. In this example of use of the invention, it is assumed that in this second step 104, the first control unit 12 sends a wake-up message to the first control unit 11.

[0077] Following this transmission, the second control unit 22, which is assumed here to be functional, reads this wake-up message and also sends a wake-up message but to the second control unit 21, on the second communication bus 27, during a step 106, if the state of the second low-voltage battery 24 allows it, which is assumed in this example of use of the invention.

[0078] During subsequent steps 108 and 110, which run in parallel, the first control unit 11 and the second control unit 21 each perform a self-diagnostic check. If one of the control units 11 or 22 detects a fault during this self-diagnostic check, it sends a fault message to the control unit 12 or 22 that has sent it a wake-up message, on the corresponding communication bus. If the first control unit 11 sends a fault message to the first control unit 12, the latter prevents the vehicle 1 from starting.

[0079] In this example of use of the invention, it is assumed that the first control unit 11 and the second control unit 21 do not send a fault message to the first and second control units 12 and 22, respectively, and the following steps are then a step 112 of sending an activation message to the first control unit 11 by the first control unit 12 on the first bus of communication 17, followed by a step 114 of reading by the second control unit 22 of this activation message, and sending by the second control unit 22 of an activation message to the second control unit 21 on the second communication bus 27. The first and second control units 21, 22 then activate in parallel during steps 116, 118 respectively.

[0080] Following the activation step 116 of the first control unit 21, the first DC-DC converter 10 powers all the connected control units. The first control unit 12 then verifies that all the vehicle's control units are awake, except for the second control unit 21 and the second control unit 22, by reading the first communication bus 17. It is this verification step that allows the first control unit 12 to prevent the vehicle 1 from starting in the following cases:

[0081] - the second control unit has a fault and could not activate the second DC-DC converter 20, so steps 106, 110, 114 and 118 were not carried out, and as a result the computers supplied by the second on-board network 25 such as that of the second braking device 26 or the second steering control device could not wake up after step 116.

[0082] - the state of the second low voltage battery 24 does not allow nominal operation of the second on-board network 25, steps 110, 114 and 118 are therefore not carried out, no wake-up message having been sent during step 106 by the second control unit 22, and as a result the computers supplied by the second on-board network 25 such as that of the second braking device 26 or the second steering control device could not wake up after step 116.

[0083] - the second control unit 21 sent a fault message to the second control unit 22, during the self-diagnostic step 110, steps 114 and 118 not being carried out, and as a result the computers supplied by the second on-board network 25 such as that of the second braking device 26 or the second steering control device could not wake up after step 116.

[0084] We can therefore understand how the first control unit 12 and the second control unit 22 are each capable of preventing the vehicle 1 from starting as soon as an anomaly is detected on either of the first or second on-board networks 15, 25, despite the independence of the two on-board networks 15, 25 and the two communication buses 17, 27.

[0085] With reference to [Fig.5], a method 200 for controlling vehicle 1 is now described, the vehicle being in the driving phase.

[0086] A first step 202 of the control process 200 is a detection step by the first or respectively the second control unit 12, 22 of the fact that:

[0087] - the voltage respectively VI, V2 on the first or respectively on the second on-board network 15, 25 is above the maximum voltage threshold respectively Vl_max, V2_max, or - the temperature respectively Tl, T2 of the first or respectively of the second DC-DC converter 10, 20 is above the maximum temperature threshold respectively Tl_max, T2_max, or

[0088] - the output power of the first or respectively the second DC-DC converter 10, 20 is above the maximum power threshold respectively Pl_max, P2_max, or - the current respectively II, 12 on the first or respectively the second on-board network 15, 25 is too close to the maximum current threshold respectively Il_max, I2_max, for example less than 50 amps of this maximum current, or - an anomaly is reported by the first or respectively the second control unit 11, 21 to the first or respectively second control unit 12, 22;

[0089] The next step is then, when the first or respectively the second control unit 11, 21 allows it, i.e. it has not failed, a step 204 of switching to degraded mode of the first or respectively second DC-DC converter 10, 20. For this, the first or respectively the second control unit 12, 22 progressively limits the first or respectively the second initial output voltage setpoint VI*, V2*.

[0090] In parallel with this step 204 of switching to degraded mode, the first or respectively the second control unit 12, 22 activates 206 the first or respectively the second braking device 16, 26, as well as the first or respectively the second steering control device, to perform 208 an emergency parking of the vehicle 1.

[0091] It should be noted that the second control unit 22, having read-only access to the messages circulating on the first communication bus 17, can take the initiative to carry out emergency parking in the event that the first control unit 12 does not react when a fault is detected on the first on-board network 15 also by the second control unit 22, for a predetermined period after this detection.

[0092] Conversely, the first control unit 12 is capable of braking the vehicle and stopping it if it detects that the second steering control device is no longer responding, for example because the second on-board network 25 is no longer functional.

[0093] In general, the first control unit 12 and the second control unit 22 are each capable of stopping the vehicle as soon as one of the vehicle's computers connected to the first communication bus 17 stops working, since the first control unit 12 supervises these computers, except itself, through the first communication bus 17, and since the second control unit 22 supervises these computers through the read-only communication link 31.

[0094] Of course, the invention is not limited to the examples just described, and numerous modifications can be made to these examples without departing from the scope of the invention. In particular, the vehicle according to the invention includes, as an alternative, a single steering control device. The features of the various embodiments mentioned in this application can be combined to carry out the invention, provided that these embodiments are not incompatible with each other.

Claims

Demands

1. Electric or hybrid vehicle (1), comprising: - a high-voltage battery (8) capable of powering an electric powertrain of the vehicle (1), - a first low-voltage battery (14), a first braking device (16), a first control unit (12) capable of controlling the vehicle (1) by activating the first braking device (16), and a first on-board network (15) to which at least the first low-voltage battery (14) and the first control unit (12) are connected, - a first DC-DC converter (10) connected at the input to the high-voltage battery (8) and at the output to the first on-board network (15), - a second low-voltage battery (24), a second braking device (26), and a second on-board network (25) to which at least the second low-voltage battery (24) is connected, - a second DC-DC converter (20) connected in input to the high-voltage battery (8) and in output to the second on-board network (25), the vehicle (1) being characterized in that it includes a second control unit (22) capable of being powered by the second on-board network (25) and of controlling the vehicle (1) by activating the second braking device (26).

2. Electric or hybrid vehicle (1) according to claim 1, wherein the first control unit (12) and the second control unit (22) are each capable of prohibiting the vehicle (1) from moving as soon as an anomaly on the first or second on-board network (15, 25) is detected.

3. Electric or hybrid vehicle (1) according to claim 1 or 2, further comprising: - a first control unit (11), capable of controlling the first DC-DC converter (10) by being powered by the first on-board network (15), and a first communication bus (17) linking the first control unit (12) to the first control unit (11), - a second control unit (21), capable of controlling the second DC-DC converter (20) by being powered by the second on-board network (25), and a second communication bus (27) linking the second control unit (22) to the second command unit (21), and a read-only communication link (31, 32) linking the first communication bus (17) to the second control unit (22).

4. Electric or hybrid vehicle (1) according to claim 3, further comprising first sensors capable of providing first data on a state of the first low-voltage battery (14) to the first control unit (12) and on the first DC-DC converter (10) to the first control unit (11), the first sensors being powered by the first on-board network (15), and second sensors capable of providing second data on a state of the second low-voltage battery (24) to the second control unit (22) and on the second DC-DC converter (20) to the second control unit (21), the second sensors being powered by the second on-board network (25).

5. Electric or hybrid vehicle (1) according to claim 4, wherein the second control unit (22) is capable of synchronizing an activation of the second control unit (21) with an activation of the first control unit (11) by the first control unit (12), according to at least one of the second data related to the second low-voltage battery (24).

6. Electric or hybrid vehicle (1) according to claim 4 or 5, wherein the first control unit (12) is capable of developing a first initial output voltage setpoint (VI*) for the first DC-DC converter (10) as a function of at least one data point (VB) related to the high-voltage battery (8) and at least one of the first data points, and the second control unit (22) is capable of developing a second initial output voltage setpoint (V2*) for the second DC-DC converter (20) as a function of said at least one data point (VB) related to the high-voltage battery (8) and at least one of the second data points, independently of a development of the first initial output voltage setpoint (VI*) carried out by the first control unit (12).

7. Electric or hybrid vehicle (1) according to claim 6, wherein the first control unit (11) is capable of determining a first corrected output voltage setpoint (Vl_ref) for the first DC-DC converter (10) as a function of a voltage difference between, on the one hand, the first initial output voltage setpoint (VI*) and, on the other hand, a voltage (VI) on the first on-board network (15), and as a function of limitations related to the first DC-DC converter (10), and the second control unit (21) is capable of determining a second corrected output voltage setpoint (V2_ref) for the second DC-DC converter (20) as a function of a voltage difference between, on the one hand, the second initial output voltage setpoint (V2*) and, on the other hand, a voltage (V2) on the second on-board network (25),and depending on limitations related to the second DC-DC converter (20).

8. Electric or hybrid vehicle (1) according to claim 6 or 7, wherein the first control unit (12) or respectively the second control unit (22) is capable of progressively decreasing the first or respectively the second initial output voltage setpoint (VI*, V2*) and stopping the vehicle (1) as soon as: - the voltage (VI, N) on the first or respectively on the second on-board network (15, 25) is above a predetermined voltage threshold, or - a temperature value (T1, T2) representative of a heating of the first or respectively of the second DC-DC converter (10, 20) is above a predetermined temperature threshold, or - a current (II, 12) on the first or respectively the second on-board network (15, 25) is above a predetermined current threshold, or - an anomaly is reported by the first or respectively the second control unit (11, 21).

9. Electric or hybrid vehicle (1) according to any of claims 1 to 8, further comprising a cooling system common to the first and second DC-DC converter (10, 20).

10. Electric or hybrid vehicle (1) according to any one of claims 1 to 9, wherein the first braking device (16) is a regenerative braking system and the second braking device (26) is a hydraulic braking system.

Images