CN112805212A

CN112805212A - Method and control device for configuring a vehicle

Info

Publication number: CN112805212A
Application number: CN201980064995.9A
Authority: CN
Inventors: A·克拉松; L·艾尔利格; R·舍丁; S·泰波拉; M·卡利奥; T·斯凯普斯特伦; M·科林
Original assignee: Scania CV AB
Current assignee: Scania CV AB
Priority date: 2018-10-08
Filing date: 2019-09-17
Publication date: 2021-05-14
Anticipated expiration: 2039-09-17
Also published as: WO2020076207A1; CN112805212B; SE1851215A1; DE112019004377T5; SE542584C2

Abstract

The present disclosure relates to the art in the context of vehicles and to a method for configuring a vehicle (1). In particular, the method involves reconfiguring a slave drive module of the vehicle to operate as a master drive module and reconfiguring the master drive module to operate as a slave drive module upon determining an error condition in the functionality of the master drive module. According to a first aspect, the present disclosure relates to a method for configuring a vehicle comprising at least two drive modules configured to be autonomously operated as independent drive modules. One of the at least two drive modules is configured to operate as a master drive module and the other modules are configured to operate as slave drive modules. The method includes monitoring (S1) the functions of the master drive modules, and upon determining (S2) an error condition in the functions of the master drive modules, reconfiguring (S4) one of the slave drive modules to operate as a master drive module, and reconfiguring the master drive module to operate as a slave drive module. The disclosure also relates to a corresponding control device, a vehicle comprising a control device, a computer program and a computer readable medium.

Description

Method and control device for configuring a vehicle

Technical Field

The present disclosure relates to the art in the context of vehicles, and to a method for configuring a vehicle. In particular, the method involves reconfiguring a slave drive module of the vehicle to operate as a master drive module and reconfiguring the master drive module to operate as a slave drive module upon determining an error condition in the functionality of the master drive module. The disclosure also relates to a corresponding control device, a vehicle comprising a control device, a computer program and a computer readable medium.

Background

Today's vehicles are often manufactured for specific purposes, for example buses are manufactured for transportation personnel and trucks are manufactured for transportation of goods. Such vehicles are typically manufactured and fully assembled at the factory, or may be partially assembled at the factory and completed at the body manufacturer. Once the vehicle assembly is complete, the vehicle may be used for a particular purpose. Therefore, the bus can be used as a bus, and the garbage truck can be used as a garbage truck. Different vehicles are therefore required for different uses, which may require a large fleet of vehicles and thus become very expensive.

For example, there are known solutions that make it possible to modify trucks by changing the concrete mixer to a loading platform. This increases flexibility and two different functions can be performed by one vehicle. In addition, document US2018/0129958a1 discloses a modular electric vehicle using interchangeable vehicle assembly modules. The user may thus disassemble and reassemble the vehicle for different applications. However, in the future there may be a need to further develop towards more flexible and safe vehicle solutions that meet the different vehicle needs of the customer in a cost-effective manner.

Disclosure of Invention

It is an object of the present disclosure to provide a solution for a modular vehicle, which enables a fail-safe operation of the modular vehicle. In particular, operation of the modular vehicle should be ensured even when an error condition occurs in the function of one drive module, such as the main drive module of the modular vehicle.

According to a first aspect, the present disclosure relates to a method for configuring a vehicle comprising at least two drive modules configured to be autonomously operated as independent drive modules. One of the at least two drive modules is configured to operate as a master drive module and the other modules are configured to operate as slave drive modules. The method includes monitoring the functionality of the master drive module and, upon determining an error condition in the functionality of the master drive module, reconfiguring one of the slave drive modules to operate as the master drive module and reconfiguring the master drive module to operate as the slave drive module. Thus, even if the main drive module malfunctions, the operation of the vehicle can be ensured.

In some embodiments, the determining includes comparing the determination of the error condition by comparing the driving parameters calculated and/or determined by the primary drive module to reference data. Thereby, autonomous driving controlled by the main drive module can be supervised. In some embodiments, the driving parameter comprises at least one of propulsion torque, steering angle, suspension and voltage level. Thus, if these parameters have inconsistent values, a new master module will be assigned.

In some embodiments, the reference data includes corresponding driving parameters calculated and/or determined by one of the slave drive modules. Thereby, an internal safety system using redundancy is realized.

In some embodiments, the drive module comprises a wheel, wherein the reconfiguring comprises configuring the wheel of the slave drive module to not affect operability. Thus, when a new master module is assigned, errors in the master module will not affect driving behavior.

In some implementations, the determination includes receiving an error command or detecting a software error or a communication error indicating an error condition. Thus, errors in the software of the main driver module will be handled by the proposed method.

In some embodiments, the determination of the error condition includes detecting at least one of: broken fuses, missing heartbeats, hardware errors, voltage level anomalies, battery charge level anomalies, and communication errors. Therefore, errors in the hardware of the master driver module will be handled by the proposed method.

In some embodiments, the error condition is detected by a control device of one of the drive modules, the method including receiving, by the drive module that detected the error, approval to reconfigure the master drive module from the off-board control device. Thereby, safety is increased, since the reconfiguration must be approved by the off-board device.

In some embodiments, the determining and the reconfiguring are performed by a master drive module or in an off-board system, and wherein the reconfiguring includes instructing one of the slave drive modules to become the master drive module.

In some embodiments, the determining and the reconfiguring are performed by one of the slave drive modules, and wherein the reconfiguring includes the slave drive module taking over control from the master drive module. Therefore, even if the main drive module does not operate at all, the operation of the vehicle can be ensured.

According to a second aspect, the present disclosure relates to a corresponding control device configured to control a vehicle comprising at least two drive modules configured to be autonomously operated as independent drive modules. One of the at least two drive modules is configured to operate as a master drive module and the other modules are configured to operate as slave drive modules. The control device is configured to monitor the functions of the master drive modules and, upon determining an error condition in the functions of the master drive modules, reconfigure one of the slave drive modules to operate as a master drive module and reconfigure the master drive module to operate as a slave drive module.

According to a third aspect, the present disclosure relates to a vehicle including the control apparatus according to the second aspect.

According to a fourth aspect, the present disclosure relates to a computer program comprising instructions which, when the program is executed by a computer, cause the computer to carry out the method according to the first aspect.

According to a fifth aspect, the present disclosure relates to a computer-readable medium comprising instructions which, when executed by a computer, cause the computer to perform the method according to the first aspect.

Drawings

FIG. 1 shows a set of modules, a vehicle assembled from the set of modules, and an off-board system.

Fig. 2 a-2 c show schematically the drive module in side, front and top view.

Fig. 3 schematically shows the drive module in further detail in a side view.

FIG. 4 shows communication between the various control devices of the modular vehicle.

Fig. 5 shows an exemplary embodiment of a control device according to the second aspect.

Fig. 6 shows another example embodiment of a control device according to the second aspect.

FIG. 7 shows a method for configuring a vehicular device in accordance with the first aspect.

Detailed Description

One way to meet the different vehicle needs of customers in a flexible and cost-effective manner is to use a modular vehicle assembled from a set of modules. Such modular vehicles, referred to herein as modular vehicles, are typically assembled at the customer so that the customer may purchase a set of modules from the manufacturer. The modular vehicle may be easily assembled and reassembled, for example, to perform a particular task.

A modular vehicle is assembled, for example, from a functional module for performing a specific function, such as load carrying, and a drive module for driving the vehicle. Each drive module typically includes a separate propulsion system and a separate energy storage device, such as a battery.

In order for the modules to operate together as a modular vehicle, the control of the drive modules must be coordinated in some way. Therefore, one of the driver modules is assigned as a master driver module, and the other slave driver modules are assigned as slave driver modules. This means that the primary drive module determines how to control the vehicle to perform a particular task or function. The master drive module instructs the slave drive module, for example by sending a command to the slave drive module. However, errors in the dysfunction of the main drive module or others may be fatal to the vehicle and the task. For example, a software failure in the master drive module may cause all slave drive modules to also exhibit malicious intent because they are controlled by the master drive module.

Therefore, a method is proposed herein, wherein the master drive module is continuously investigated, and wherein, when an error is detected, another drive module is designated as the master drive module. For example, the master drive module and the slave drive module communicate with each other and monitor each other, and when the slave drive module finds that the master drive module is not working normally, the slave drive module takes over to become the master drive module. Alternatively, the master drive module itself may also find itself problematic, requiring the slave drive module to take over and become the master drive module. Alternatively, the off-board system may determine that the master drive module is not operational, and thereafter command the slave drive module to become the master drive module. In this way, safe operation of the vehicle is ensured.

For a better understanding of the proposed technology, the concept of assembling a vehicle from modules will now be explained with reference to the embodiment of fig. 1.

Fig. 1 shows an embodiment of a system 400 comprising a set of modules 20 for assembling a vehicle 1. Also shown are embodiments of an off-board system (herein referred to as first control device 100) and an assembled vehicle 1. The set of modules 20 includes a plurality of driver modules 30 and a plurality of functional modules 40.

The primary function of the drive module 30 is typically to drive (e.g., propel, steer and brake) the vehicle 1. The drive module 30 includes a pair of wheels 37 and is configured to be operated autonomously. Each functional module is configured to perform a specific function, such as carrying goods or people. Each

module

30, 40 of the set of modules 20 comprises at least one interface 50 which is releasably connectable to a corresponding interface 50 of another

module

30, 40.

By combining the drive module 30 and the function module 40, different types of vehicles 1 can be realized. Some vehicles 1 require two or more drive modules 30, while some vehicles 1 require only one drive module 30, depending on the structural configuration of the functional module 40. Each drive module 30 comprises a control device, here referred to as second control device 200, and can therefore communicate with a control center or an on-board system, i.e. the first control device 100. Since the driving module 30 may be configured to operate as a unit that is driven separately by means of the second control apparatus 200, the driving module 30 may be connected to or disconnected from the function module 40 without manual work.

The principle of assembling the vehicle 1 from the

modules

30, 40 will now be described. An operator may receive tasks from a customer to transport goods from one location to another. The operator enters information relating to the task into the first control device 100 via a user interface, such as a touch screen or similar interface. It is noted that this is merely an example, and that the received task may be automatically translated and/or input into the first control device 100. The first control device 100 then determines which function is to be performed and thus which type of vehicle 1 is required to complete the task. In the present embodiment, the desired vehicle 1 may be a truck. The first control means 100 selects which

modules

30, 40 are used for the desired truck. The type of vehicle 1 and

modules

30, 40 required to complete the task may be selected, for example, based on information relating to cargo, distance traveled, and/or geographic location. The first control device 100 then converts the task into a command for one or both of the selected drive modules 30 to be physically and electrically connected with the selected function module 40. In the present embodiment, the vehicle 1 includes two drive modules. The second control devices 200 of the drive modules 30 each receive commands and convert the commands into control signals for the respective drive module 30. Thereby controlling the driving module 30 to make physical and electrical connection with the function module 40. Connecting the control drive module 30 to the function module 40 may include controlling the drive module 30 to confirm the location of the selected function module 40 and move to that location. The location of the selected functional module 40 may be determined based on information received in a command to connect the drive module 30 with the functional module 40. Alternatively, a command to connect the driver module 30 and the function module 40 is transmitted to both the driver module 30 and the function module 40, whereupon the function module 40 prepares for the connection and starts transmitting a signal. The drive module 30 may then determine the location of the functional module from the transmitted signal. The driver module 30 is thus autonomously operated to find the selected functional module 40 and to connect with that functional module 40. The at least one sensor device 60 arranged at the drive module 30 and/or the functional module 40 may be configured to sense when a physical and/or electrical connection has been performed. The at least one sensor device 60 may send a signal to the second control device 200 indicating that a connection has been made. Based on the signal from the at least one sensor device 60, the second control apparatus 200 may send a verification signal to the first control apparatus 100 to verify the connection. The first control device 100 may then generate a unique vehicle identification for the assembled vehicle 1. The vehicle 1 is thus assembled and the vehicle 1 is ready to perform a task. The generated unique vehicle identification may then be stored in a database or record associated with the off-board system (i.e., first control device 100). The generated unique vehicle identification may also be communicated to the

modules

30, 40 of the vehicle 1. The unique vehicle identification may optionally be displayed by one or

more modules

30, 40 of the vehicle 1.

Fig. 2 a-2 c schematically show a drive module 30 according to an embodiment in a side view, a front view and a top view. The drive module 30 includes a body 38. Wheels 37 are arranged on two opposite sides of the drive module 30. The body 38 may have first and

second sides

31, 32 facing in opposite directions. The body 38 may have third and

fourth sides

33, 34 facing in opposite directions, wherein the third side 33 and the fourth side 34 may extend perpendicular to the first and

second sides

31, 32. The body 38 may also have fifth and

sixth sides

35, 36 facing in opposite directions. The fifth and

sixth sides

35, 36 may extend perpendicular to the first and

second sides

31, 32 and the third and

fourth sides

33, 34. The first and second side surfaces 31, 32 may be referred to as side surfaces. The third and

fourth sides

33, 34 may be referred to as front and rear surfaces, respectively. The fifth side 35 may be referred to as a top surface and the sixth side 36 may be referred to as a bottom surface. Each

side

31, 32, 33, 34, 35, 36 may each have a flat or curved shape, and may have the shape of an indentation and a protrusion. Instead of the above-described vertical extension of the respective side faces 31, 32, 33, 34, 35, 36, the respective side faces 31, 32, 33, 34, 35, 36 may also extend at any angle relative to each other.

Fig. 3 schematically shows the drive module 30 in further detail in a side view. The drive module 30 comprises at least one (only one shown) propulsion system 91, an energy storage device 70, an interface 50, at least one sensor and a second control device 200.

The propulsion system 91 comprises, for example, an electric motor connected to the wheels 37. In some embodiments, each wheel 37 is individually driven by its own motor. The electric motor may also operate as a generator and generate electrical energy when engaging the wheels 37. Thus, the propulsion system is typically the primary braking system of the vehicle 1.

However, since the brake function system may be insufficient or fail for some reason in some cases, an auxiliary brake system is required. This auxiliary braking system is referred to herein as a braking system. The braking system includes, for example, standard disc brakes and electromechanical actuators that require a reliable power supply.

Energy storage device 70 is configured to provide energy to propulsion system 91. The energy storage device 70 is, for example, a battery that can be charged with electric energy.

The at least one sensor 39 is configured to provide data relating to the drive module 30 and its surroundings. For example, the at least one sensor 39 is configured to monitor fuses, voltage levels, battery charge levels, and communications with other modules. The sensors 39 may also monitor steering and/or wheel suspension in the drive module 30.

The second control device 200 is configured to operate the drive module 30 as a separately driven unit. The drive module 30 can transport itself without any external drive unit, such as a towing vehicle. The drive module 30 may transport itself by means of the at least one propulsion system 91. The drive module 30 may be configured to be operated autonomously. Thus, the second control device 200 may be configured to control the operation of the drive module 30. The second control device 200 may be configured to transmit control signals to various systems and components of the drive module 30 to control, for example, steering and propulsion of the drive module 30. The second control device 200 may be configured to autonomously operate the driving module 30 based on the received command. The second control device 200 may thus be configured to receive commands from a remote off-board system (i.e., the first control device 100) and convert the commands into control signals for controlling the various systems and components of the drive module 30. The second control device 200 may also be configured to receive data from the at least one sensor 39 relating to the drive module 30 and its surroundings and to control the drive module 30 based on the data. The sensors may be configured to monitor operation and detect errors in various portions of the drive module 30. For example, the sensors may be disposed in the propulsion system 91, the braking system, the energy storage device 70, the steering system, and/or the wheel suspension (not shown), among others. The second control device 200 will be described in further detail in connection with fig. 5.

The drive module 30 may be configured to releasably connect to the second drive module 30 and/or the functional module 40 to form the assembled vehicle 1. At least one of the

sides

31, 32, 33, 34, 35, 36 of the drive module 30 may thus have a shape allowing the drive module 30 to be releasably connected to the second drive module 30 and/or the functional module 40.

The at least one interface 50 of the drive module 30 is configured to physically connect the drive module 30 with the second drive module 30 and/or the functional module 40. The interface 50 of the drive module 30 may be releasably connectable to a corresponding interface 50 of the second drive module 30 and/or the functional module 40.

In fig. 1, the drive module 30 shows only one interface 50, on one side of the drive module 30. However, it should be understood that each drive module 30 may include a plurality of interfaces 50 for releasably connecting with other modules 40. The interfaces 50 of the drive module 30 may be arranged on different sides of the drive module 30 so as to be able to connect with

other modules

30, 40 on multiple sides of the drive module 30. The interfaces 50 on the driver module 30 and the functional module 40, respectively, are arranged in corresponding positions, so that a connection between the

modules

30, 40 can be achieved.

In some embodiments, the second control device 200 of the drive module 30 is configured to communicate with an additional control device (e.g. the control device 300 of the functional module 40 that is part of the same vehicle 1). Thus, the functional module 40 may comprise a control means, referred to as a third control means 300. In some embodiments, the second control device 200 of the drive module 30 is configured to communicate with the first control device 100. This is illustrated in fig. 4, where the dashed lines show the communication between the

control devices

100, 200, 300. The communication may be implemented in different ways.

In some embodiments, the at least two interfaces 50 comprise electrical interfaces arranged for transmitting electrical power and/or transmitting electrical signals between the drive module 30 and another module (e.g. the functional module 40 to which the drive module is connected).

The electrical interface 50 may be a wired interface or a wireless interface 50, such as a conductive interface 50. In other words, by electrically connecting the driver module 30 and the function module 40, the

modules

30 and 40 can transmit power to each other and share information. The drive module 30 may, for example, control portions of the function module 40, such as opening and closing of doors, heating and cooling. The electrical power and/or electrical signals may further be transmitted via one module to another module. In other words, as indicated by the connection 51 in fig. 1, one drive module 30 of a modular vehicle 1 may transmit electric power and/or electric signals via the functional module 40 and further to another drive module of the same vehicle 1. Thus, the connection 51 comprises at least one of a cable, a bus or an electrical line, for example.

In some embodiments, communication between the

various modules

30, 40 is implemented using long range wireless communication (e.g., radio communication). The wireless communication may be performed directly between the modules or via an off-board system (i.e., first control device 100). The

various modules

30, 40 of the assembled vehicle may communicate with each other and/or the first control device via 4G, 5G, V2V (vehicle-to-vehicle), Wi-Fi, or any other wireless communication means.

In some embodiments, the driver module 30 is associated with a registration number. The drive module 30 may thus be regarded as a separate vehicle. In the case of an assembled vehicle 1 comprising two drive modules, each drive module is associated with a unique registration number. The first control apparatus 100 can determine which one of the respective drive modules 30 should display (or announce) its registration number. If the assembled vehicle 1 includes two drive modules, the first control device 100 may designate one drive module as a master drive module and the other as a slave drive module. Typically, the master drive module will accept instructions to announce its registration number, while the slave drive module will not display its registration number. The first control device 100 may thus transmit instructions relating to the registration number of the master drive module to the second control device 200 of one or more other drive modules 30 in the set of modules 20.

In some embodiments, the first control device 100 is configured to determine the configuration and operation for the equipped vehicle 1 based on the task (or function) to be performed by the equipped vehicle 1, and to transmit the determined configuration to the second control device 300 designated as the primary drive module. The main drive module will then control the operation of the vehicle 1 while performing the task.

The proposed solution will now be explained with reference to the flow chart of fig. 4. As mentioned above, the present disclosure proposes a method for configuring a vehicle 1, such as the vehicle 1 shown in fig. 1 to 4.

However, even though reference is made herein to the vehicle 1 shown in fig. 1 to 3, it must be understood that the proposed method may be used for controlling any vehicle comprising at least two drive modules configured to be autonomously operated as separate drive modules, wherein one of the at least two drive modules is configured to operate as a master drive module and the other (or others) is configured to operate as a slave drive module.

The method may be implemented as a computer program comprising instructions which, when the program is executed by a computer, such as a processor in the second control apparatus 200 of fig. 5, cause the computer to perform the method. According to some embodiments, a computer program is stored on a computer readable medium (e.g., a memory or an optical disk) that includes instructions, which when executed by a computer, cause the computer to perform the method.

The proposed method will now be described when executed by the second control device 200 of a slave or master drive module of the vehicle 1. However, it must be understood that the method may alternatively, at least partially, be implemented in the first control device 100 or the third control device 300 of the vehicle, or the embodiment may be specified in any or all of the

control devices

100, 200, 300.

The method is typically performed continuously or periodically during normal operation of the vehicle. The method includes monitoring S1 a function of the primary drive module. The functions refer to, for example, a driving function, physical characteristics, a software function, and the like. More specifically, the functionality refers to the ability of the master drive module to perform its tasks (e.g., tasks related to performing the tasks). In other words, the function of the main drive module is monitored during operation. This may be done in many different ways (e.g., by monitoring hardware, software, or driving), as will be apparent in the embodiments below.

If an error is detected during monitoring, the primary drive module is "swapped" to designate or assign another primary drive module. In other words, the method further includes, upon determining S2 an error condition in the functionality of the master drive module, reconfiguring S4 one of the slave drive modules to operate as the master drive module, and reconfiguring the master drive module to operate as the slave drive module.

Various embodiments of monitoring S1 and determining an error condition in the S2 function will now be described in further detail. Note that different ways of monitoring S1 and determining S2 may be combined for improved safety.

In some embodiments, the monitored functions are functions of the processor and operating system of the master driver module. In other words, in some embodiments, determining S2 includes receiving an error command or detecting a software error indicating an error condition. The master drive module may for example send an error command to the slave module when a software error or a communication error is detected in the second control means 200 of the master drive module. One example of a software error is monitoring the expiration of a watchdog timer of a system (e.g., battery system, autopilot system, propulsion system, etc.) of the main drive module. A watchdog timer is an electronic timer used to detect (and recover from) a computer failure. During normal operation, the computer periodically resets the watchdog timer to prevent its lapse or "timeout". If the computer fails to reset the watchdog due to a hardware failure or a program error, a timer will elapse and generate a timeout signal. The time-out signal may be indicative of an error condition in the corresponding system.

Furthermore, the "heartbeat" that is periodically transmitted from the master drive module to the slave drive module (and/or the off-board system) is continuously monitored by the slave drive module in some embodiments to ensure that the master drive module is active. A missing heartbeat may indicate that there is a software error in the master driver module or that communication between the master driver module and the slave driver module is interrupted. In some implementations, determining S2 an error condition includes detecting a missing heartbeat or communication error.

Alternatively, or additionally, the hardware properties of the master drive module 1 are monitored. Examples of hardware relevant to monitoring are batteries, steering, wheel suspension, engines, etc. Some hardware errors may be monitored by a dedicated sensor 39 in the primary drive module, which is typically monitored during operation of the vehicle 1. For example, an internal voltage, internal current above or below a certain threshold may be an indication of a hardware error in the main drive module, for example. In some embodiments, the master drive module may send a message to the slave module informing of such an error. Alternatively, the master drive module may reconfigure itself when a hardware error is detected. In other words, in some embodiments, determining S2 an error condition includes detecting abnormal sensor data, a broken fuse, an abnormal voltage level, an error in wheel suspension, or an abnormal battery charge level.

Another possibility is to monitor the autonomous driving of the vehicle 1 controlled by the main drive module. In operating a modular vehicle, the primary drive module will typically receive a task to be performed and then determine how to drive the vehicle 1 to perform the task. For example, driving parameters for the task, such as the speed, propulsion torque, and/or steering of the vehicle, are determined by the primary drive module. These driving parameters may be compared with reference data. In some embodiments, the reference data is static. For example, driving that deviates significantly from a reference driving parameter or a driving parameter obtained from a mathematical model may be an indication of error. In addition, abnormal (e.g., jarring or irregular) driving behavior may be an indicator that something is wrong. In other words, in some embodiments, determining S2 includes determining an error condition by comparing the driving parameters calculated and/or determined by the primary drive module to reference data.

The reference data may alternatively be dynamic, e.g. it may be determined by e.g. the main drive module based on the current task. For example, if the vehicle 1 should travel a very short distance, a high speed or a high propulsion torque will be suspect. For example, when rearranging the

modules

30, 40 to assemble the modular vehicle 1, the speed should not exceed 10 km/h.

Another possibility is to obtain the reference data by letting the slave drive module perform the same or similar evaluation or calculation as the drive module. Since the master drive module and the slave drive module typically have the same or similar capabilities, one option is to also have the slave drive module at least partially determine how to drive the vehicle 1 to perform the task. One can then compare the calculations performed by the different driver modules 30. In other words, in some embodiments, the reference data comprises corresponding driving parameters calculated and/or determined by one of the slave drive modules. In some embodiments, the method further comprises obtaining S0 reference data from the slave drive module. For example, the first control device 100 or master drive module receives driving parameters from one or more slave drive modules. Deviations between these calculations may then be an indication of errors. Alternatively, the master drive module may send driving parameters or other calculations to the slave drive module for comparison with reference data in the slave drive module.

When a new master drive module is designated, the old drive module will be designated as the slave drive module. However, since there is a potential error in the old slave drive module, further measures may be taken to ensure that the error does not affect the driving of the vehicle. One possibility is to center or disengage the wheels of the old main drive module to ensure that the operability is not affected by the error. In other words, in some embodiments, the drive module includes wheels 37, and the reconfiguration includes configuring the wheels of the slave drive module so as not to affect operability. If the method is performed in the master drive module, the master drive module may perform the reconfiguration when control is handed over to the slave drive module. If the method is performed in a slave drive module or in an off-board system, the reconfiguration includes instructing the old master drive module, which is now the slave drive module, to configure its wheels so as not to affect, or at least to affect as little as possible, the maneuverability of the vehicle 1. This may be done, for example, by the drive module configuring its wheels to be in a "neutral" position, e.g., straight, rather than configuring the wheels as if the drive module were the primary drive module. This reconfiguration may be triggered directly by hardware, such as an actuator, or by a pressure loss in the hydraulic control system or a power failure in the electrical control system. Another option is to configure the software to center the wheel when an error condition is detected.

As mentioned above, the proposed method may be performed in different parts of the system 400. In some embodiments, the error condition is detected by the control device 200 (i.e., the second control device 200) in one of the drive modules 30 (e.g., a slave drive module). Then, reconfiguring S4 includes the slave drive module taking over control from the master drive module. For example, the reconfiguration includes instructing the master drive module to relinquish control. Typically, the off-board system will also be informed which drive module is the new master drive module.

However, it is not always desirable to have a slave drive module with authorization to take over without approval from another unit, for example for security reasons. Thus, approval from, for example, an off-board system (i.e., first control device 100) may be required. Thus, if the slave drive module detects an error condition in the function of the master drive module, it may send a request to the first control device 100 to take over and become the master drive module. In other words, in some embodiments, the method includes receiving S3 approval to reconfigure the master drive module from the off-board control device by the drive module 30 that detected the error. Another possibility is that the slave driver module requests the first control device to assign a new master driver module when an error in the master driver module is detected.

The proposed method may alternatively be performed by an off-board system, i.e. by the first control device 100. The monitoring S1 then generally includes the slave drive module 30 (or more specifically the second control device 200 of the slave drive module 30) receiving the information. For example, the driver module may send information about the error command to the first control device 100, informing the first control device 100 about any error conditions described above. Another possibility is that there is a continuous communication, for example a heartbeat, between the first control device 100 and the second control device 200 of the main drive module of the vehicle 1. If the heartbeat is interrupted for a certain period of time, the in-vehicle system may reconfigure a new master drive module to attempt to reestablish communication. In other words, if the communication is interrupted, a new master drive module is designated. Another possibility is for the off-board system to cause the calculations performed by the primary drive module and the reference data to be compared in a similar manner to that described above.

In some embodiments, the determining S2 and reconfiguring S4 are performed by the master drive module or in an off-board system. The decision can then be made without any approval. More specifically, the master drive module or the off-board system may simply inform one of the slave drive modules that the slave drive module is now the master drive module. In other words, in some embodiments, the reconfiguration includes instructing one of the slave drive modules to become the master drive module. If the reconfiguration is performed by the master drive module, the off-board system is typically notified that a new master drive module is now designated.

The proposed solution is applicable to all types of road vehicles. However, the present disclosure may relate to heavy vehicles, such as buses, trucks, and the like. In particular, the present disclosure may relate to vehicles for public roads.

Turning now to fig. 5, which shows an exemplary embodiment, a control device is configured to implement the proposed method. In this embodiment, the control device is embodied as a second control device 200 for a vehicle 1, such as the modular vehicle described in fig. 1 to 3. The second control device is a slave drive module or a master module.

In some embodiments, the second control device 200 is a "unit" in a functional sense. Thus, in some embodiments, the second control device 200 is a control apparatus comprising a plurality of physical control devices operating in cooperation. The second control device 200 includes hardware and software. The hardware basically includes various electronic components on a Printed Circuit Board (PCB). The most important of these components are typically the processor 210 and the memory 220.

The second control device 200 further comprises one or more communication interfaces 230 enabling the second control device 200 to communicate with

other modules

30, 40 of the modular vehicle 1 or other vehicles. As described above, the communication mode between the modules is wireless, conductive or wired. The wired communication may implement a standard protocol such as Controller Area Network (CAN). CAN is a robust vehicle bus standard intended to allow microcontrollers and devices to communicate with each other in applications without a host. The wireless communication between the modules may be implemented using any short-range communication protocol, such as bluetooth or 802.11.

The one or more communication interfaces 230 are also configured to enable wireless communication with the first control device 100, i.e. with an off-board system. The wireless communication between the second control device 200 and the first control device is implemented using, for example, 4G, 5G, V2V (Vehicle to Vehicle), or any other suitable wireless communication protocol.

The second control apparatus 200, or more specifically, the processor 110 of the second control apparatus 200, is configured to cause the second control apparatus 200 to perform all aspects of the methods described above and below. This is typically done by running computer program code stored in the memory 220 in the processor 210 of the second control device 200.

More specifically, the second control device 200 is configured to monitor the function of the main drive module. If the method is performed by a slave drive module, this means that the communication interface 230 is used to receive e.g. driving data, sensor data, heartbeat, error commands or other relevant data from the master drive module.

The second control apparatus 200 is further configured to reconfigure one of the slave drive modules to operate as a master drive module and reconfigure the master drive module to operate as a slave drive module upon determining an error condition in the functionality of the master drive module.

In some embodiments, the second control device is configured to determine the error condition by comparing the driving parameters calculated and/or determined by the main drive module with reference data. In some embodiments, the driving parameter comprises at least one of propulsion torque, steering angle, suspension, voltage level. In some embodiments, the reference data includes corresponding driving parameters calculated and/or determined by one of the slave drive modules.

In some embodiments, the second control device 200 is configured to configure the wheels of the slave drive module so as not to affect the operability of the vehicle 1. If the method is performed by a master drive module, this means that instructions are sent to the slave drive module using the communication interface 230.

In some embodiments, the second control device 200 is configured to determine an error condition based on a received error command or detection of a missing heartbeat, communication error, or other software error.

In some embodiments, the second control device 200 is configured to detect (or determine) at least one of: abnormal sensor data, broken fuses, abnormal voltage levels, abnormal battery charge levels, or other hardware errors.

In some embodiments, the second control device 200 is configured to receive approval to reconfigure the primary drive module from the off-board system.

In some embodiments, the second control device 200 is included in the slave drive module 30 and is configured to take over control from the master drive module.

In some embodiments, the second control device, 200, is included in the main drive module 30. The second control device is configured to instruct one of the slave drive modules to become the master drive module.

In some embodiments, the present disclosure relates to a vehicle 1 comprising at least two drive modules 30 configured to be autonomously operated as independent drive modules 30. One of the at least two drive modules is configured to operate as a master drive module and the other modules are configured to operate as slave drive modules, the second control means being configured. The vehicle 1 further comprises a control device 200 configured to (at least partially) perform any or all aspects of the method shown in fig. 7.

Turning now to fig. 6, which shows another example embodiment, a control device is configured to implement the proposed method. In this embodiment, the control device is embodied as a first control device 100, i.e. in an off-board system.

In some embodiments, the first control device 100 is a "unit" in a functional sense. Thus, in some embodiments, the first control device 100 is a control apparatus that includes a plurality of physical control devices that operate in cooperation. The first control device 100 includes hardware and software. The hardware basically includes various electronic components on a Printed Circuit Board (PCB). The most important of these components are typically the processor 110 and the memory 120.

The first control device 100 further comprises a communication interface 130 enabling the first control device 100 to communicate with the

modules

30, 40 of the modular vehicle 1 and with other external entities, such as traffic systems and the like. The communication interface 130 may enable, for example, an internet connection. The communication of the first control device 100 is implemented using, for example, an Internet Protocol (IP).

The first control device 100, or more specifically the processor 110 of the first control device 100, is configured to cause the first control device 100 to perform all aspects of the methods described above and below. This is typically done by running computer program code stored in the memory 120 of the processor 110 of the first control device 100.

More specifically, in some embodiments, the first control apparatus 100 is configured to monitor the functions of the master drive modules and upon determining an error condition in the functions of the master drive modules, reconfigure one of the slave drive modules to operate as a master drive module and reconfigure the master drive module to operate as a slave drive module. More specifically, the first control device 100 sends an instruction to one of the drive modules (or more specifically, to the second control device 200 of one of the drive modules 30), for example, to a new drive module of the vehicle 1, to reconfigure itself as a main drive module. In some embodiments, the first control device 100 is further configured to notify the other drive modules 200 about the change in the master drive module.

The monitoring and determination of the error condition is then performed in a similar manner as when performed by the second control apparatus 20, except that the first control apparatus 100 needs to receive the required data from the master module and the slave module using the communication interface 130.

The terminology used in the description of the embodiments illustrated in the accompanying drawings is not intended to be limiting of the described methods, control apparatus or computer programs. Various changes, substitutions and/or alterations may be made herein without departing from the embodiments of the invention as defined by the appended claims.

The term "OR" as used herein should be interpreted as a mathematical OR, i.e., as an inclusive conjunction; rather than the mathematically exclusive or (xor), unless explicitly stated otherwise. Furthermore, the singular forms "a", "an" and "the" should be construed as "at least one" and thus may include a plurality of similar entities unless expressly stated otherwise. It will be further understood that the terms "comprises," "comprising," "includes" and/or "including," when used in this specification, specify the presence of stated features, actions, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, actions, integers, steps, operations, elements, components, and/or groups thereof. A single unit, such as a processor, may fulfill the functions of several items recited in the claims.

Claims

1. A method performed by a control device (100, 200) for configuring a vehicle (1) comprising at least two drive modules (30) configured to be autonomously operated as independent drive modules (30); wherein one of the at least two drive modules is configured to operate as a master drive module and the other modules are configured to operate as slave drive modules, the method comprising:

-monitoring (S1) the function of the main drive module, and upon determining (S2) an error condition in the main drive module function:

-reconfiguring (S4) one of the slave drive modules to operate as a master drive module, and reconfiguring the master drive module to operate as a slave drive module.

2. The method of claim 1, wherein determining (S2) includes determining an error condition by comparing the driving parameters calculated and/or determined by the primary drive module with reference data.

3. The method of claim 2, wherein the driving parameters include at least one of propulsion torque, steering angle, suspension, voltage level.

4. A method according to claim 2 or 3, wherein the reference data comprises corresponding driving parameters calculated and/or determined by one of the slave drive modules.

5. The method according to any of the preceding claims, wherein the drive module comprises a wheel (37), and wherein said reconfiguring comprises configuring the wheels of the slave drive module so as not to affect the maneuverability of the vehicle (1).

6. The method according to any of the preceding claims, wherein determining (S2) comprises receiving an error command or detecting a missing heartbeat, a communication error or other software error indicating an error condition.

7. The method according to any one of the preceding claims, wherein determining (S2) an error condition comprises detecting at least one of: abnormal sensor data, broken fuses, abnormal voltage levels, abnormal battery charge levels, or other hardware errors.

8. Method according to any of the preceding claims, wherein an error condition is detected by a control device (200) of one of the drive modules (30), and wherein the method comprises:

-receiving (S3) an approval to reconfigure the master drive module from the off-board control device by the drive module (30) detecting the error.

9. The method of any of the preceding claims, wherein determining (S2) and reconfiguring (S4) are performed by a master drive module or in an off-board system, and wherein the reconfiguring comprises indicating one of the slave drive modules to be the master drive module.

10. The method according to any of the preceding claims, wherein the determining (S2) and the reconfiguring (S4) are performed by one of the slave drive modules, and wherein the reconfiguring comprises the slave drive module taking over control from the master drive module.

11. A control device (100, 200) configured to control a vehicle (1) comprising at least two drive modules (30) configured to be autonomously operated as independent drive modules (30); wherein one of the at least two drive modules is configured to operate as a master drive module and the other modules are configured to operate as slave drive modules, the control device being configured to:

-monitoring the function of the main drive module and, upon determining an error condition in the function of the main drive module:

reconfiguring one of the slave drive modules to operate as a master drive module and reconfiguring the master drive module to operate as a slave drive module.

12. The control device (100, 200) according to claim 11, wherein the control device is configured to determine the error condition by comparing driving parameters calculated and/or determined by the main drive module with reference data.

13. The control device (100, 200) according to claim 12, wherein the driving parameter comprises at least one of propulsion torque, steering angle, suspension, voltage level.

14. The control device (100, 200) according to claim 12 or 13, wherein the reference data comprises corresponding driving parameters calculated and/or determined by one of the slave drive modules.

15. The control device (100, 200) according to any of claims 11 to 14, wherein the control device (100, 200) is configured to configure the wheels of the slave drive modules so as not to affect the maneuverability of the vehicle (1).

16. The control device (100, 200) according to any of claims 11 to 15, wherein the control device (100, 200) is configured to determine an error condition based on a received error command or detection of a missing heartbeat, communication error or other software error.

17. The control device (100, 200) according to any of claims 11 to 16, wherein the control device (100, 200) is configured to detect at least one of: abnormal sensor data, broken fuses, abnormal voltage levels, abnormal battery charge levels, or other hardware errors.

18. The control device (200) according to any one of claims 11-17, wherein the control device (200) is comprised in one of the one or more drive modules, and wherein the control device (200) is configured to receive an approval to reconfigure the primary drive module from an off-board system.

19. The control device (200) according to any of claims 11 to 18, wherein the control device (200) is comprised in a slave drive module (30), and wherein the control device is configured to take over control from the master drive module.

20. The control device (100, 200) according to any of claims 11 to 17, wherein the control device (100, 200) is comprised in a master drive module (30) or in an off-board system, and wherein the control device is configured to instruct one of the slave drive modules to become the master drive module.

21. A computer program comprising instructions which, when the program is executed by control apparatus, cause the control apparatus to perform the method according to any one of claims 1 to 10.

22. A computer readable storage medium comprising instructions which, when executed by a control apparatus, cause the control apparatus to perform the method according to any one of claims 1 to 10.

23. A vehicle (1) comprising a control device (200) according to any one of claims 11-19.