SE1851215A1 - Method and control device for configuring a modular vehicle - Google Patents

Abstract

The present disclosure relates to techniques in the context of vehicles, and to a method for configuring a vehicle 1. In particular the method relates to re-configuring a slave drive module of the vehicle to operate as a master drive module and reconfiguring the master drive module to operate as a slave drive module upon determining an error condition in the functionality of the master drive module. According to a first aspect, the disclosure relates to a method for configuring a vehicle, comprising at least two drive modules configured to be autonomously operated as independent drive modules. One of the at least two drive modules is configured to operate as a master drive module and the others are configured to operate as slave drive modules. The method comprises monitoring S1 a functionality of the master drive module, and upon determining S2 an error condition in the functionality of the master drive module re-configuring S4 one of the slave drive modules to operate as a master drive module and re-configuring the master drive module to operate as a slave drive module. The disclosure also relates to a corresponding control device, to a vehicle comprising the control device, to a computer program and to a computer-readable medium.

Description

Method and control device for configuring a vehicle Technical field The present disclosure relates to techniques in the context of vehicles, and to amethod for configuring a vehicle. ln particular, the method relates to re-configuringa slave drive module of the vehicle to operate as a master drive module and re-configuring the master drive module to operate as a slave drive module upondetermining an error condition in the functionality of the master drive module. Thedisclosure also relates to a corresponding control device, to a vehicle comprisingthe control device, to a computer program and a computer-readable medium.

BackgroundVehicies of today are fypioaiiy rrianufactured for a specific purpose, eg. a hus is rnanufaotured for transporting people and a truck is rnanufactured for transportinggoods. Such vehicies are corrimcniy rnanufactured and ccrripieteiy assernioied in afactory, or they rnay ioe partiy assernhied in a factory and cornpieted at a bodymanufacturer. Once the vehicie is assernoied, the vehicie rriay ioe used for thespecific purpose. Thus, a hus rriay he used as a hus and a garhage truck rriay heused as a garoage truck. Different vehicies are thus needed for different purposes,vvhich rnay require a iarge fieet of vehicies for a hauier, and therehy pecorne very costiy.

There are, for exarripte, itnotvn soiutions vvhere a truck can he rehuiit hy changinga concrete rnixer to a toading ptatforrri. This increases the fiexihiiity and tvvo differentfunctions can he achieved hy rneans ct one singte vehicie. Aiso, document US-âuttš/'uiâïåšàšâ Ai discioses a rnoduiar eiectric veriicie using interchangeahievehicie assemhiy rnoduies. The user can therehy disasserrthie and reassenthie thevehicie for use in different appiications. i-iovveven in the future, further developmenttowards even more flexible and secure vehicle solutions might be needed to meet customers" different vehicle needs in a cost-efficient way.

Summarylt is an object of the disclosure to provide a solution, for use in a modular vehicle, that enables fail-safe operation of the modular vehicle. ln particular, the operation 2 of the modular vehicle should be ensured even when an error condition occurs inthe functionality of one drive module, such as a master drive module of the modularvehicle.

According to a first aspect, the disclosure relates to a method for configuring avehicle, comprising at least two drive modules configured to be autonomouslyoperated as independent drive modules. One of the at least two drive modules isconfigured to operate as a master drive module and the others are configured tooperate as slave drive modules. The method comprises monitoring a functionalityof the master drive module, and upon determining an error condition in thefunctionality of the master drive module, re-configuring one of the slave drivemodules to operate as a master drive module and re-configuring the master drivemodule to operate as a slave drive module. Thereby, operation of the vehicle is ensured even if the master drive module is defective. ln some embodiments, the determining comprises determining the error conditionby comparing driving parameters calculated and/or determined by the masterdrive module with reference data. Thereby, autonomous driving controlled by themaster drive module can be supervised. ln some embodiments, the drivingparameter comprises at least one of propulsion torque, steering angle,suspension and a voltage level. Thus, if those parameters have incongruousvalues, then a new master module will be assigned. ln some embodiments, the reference data comprises corresponding drivingparameters calculated and/or determined by one of the slave drive modules.Thereby, an internal security system using redundancy is achieved. ln some embodiments, the drive modules comprise wheels and wherein the re-configuring comprises configuring the wheels of a slave drive module in order notto affect maneuverability. Thereby, an error in the master module will not affect the driving behavior, when a new master module is assigned. ln some embodiments, the determining comprises receiving an error command or detecting a software error or a communication error indicative of an error 3 condition. Hence, an error in the software of the master drive module will behandled by the proposed method. ln some embodiments, the determining of an error condition comprises detectingat least one of; a broken fuse, a missing heartbeat, a hardware error, an abnormalvoltage level, an abnormal battery charging level and a communication error.Hence, an error in the hardware of the master drive module will be handled bythe proposed method. ln some embodiments, the error condition is detected by a control device of one ofthe drive modules, and the method comprises receiving by the drive moduledetecting the error, from an off-board control device, an approval to re-configurethe master drive module. Thereby, security is enhanced, as the re-configuringmust be approved by the off-board unit. ln some embodiments, the determining and the re-configuring is performed by themaster drive module or in an off-board system, and wherein the re-configuringcomprises instructing one of the slave drive modules to become a master drive module. ln some embodiments, the determining and the re-configuring is performed byone of the slave drive modules and wherein the re-configuring comprises that theslave drive module is taking over control from the master drive module. Thus, theoperation of the vehicle can be ensured even if the master drive module does notwork at all.

According to a second aspect the disclosure relates to a corresponding controldevice configured to control a vehicle, comprising at least two drive modulesconfigured to be autonomously operated as independent drive modules. One ofthe at least two drive modules is configured to operate as a master drive moduleand the others are configured to operate as slave drive modules. The controldevice is configured to monitor a functionality of the master drive module, and toupon determining an error condition in the functionality of the master drive module 4 re-configure one of the slave drive modules to operate as a master drive module and re-configuring the master drive module to operate as a slave drive module.

According to a third aspect, the disclosure relates to a vehicle comprising the controldevice according to the second aspect.

According to a fourth aspect, the disclosure relates to a computer programcomprising instructions which, when the program is executed by a computer, causethe computer to carry out the method according to the first aspect.

According to a fifth aspect, the disclosure relates to a computer-readable mediumcomprising instructions which, when executed by a computer, cause the computerto carry out the method according to the first aspect.

Brief description of the drawinqs Fig. 1 illustrates a set of modules, a vehicle assembled from the set of modules,and an offboard system.

Fig. 2a - Fig. 2c schematically illustrate a drive module in a side view, a front viewand in a view from above.

Fig. 3 schematically illustrates a drive module in further detail in a side view.

Fig. 4 illustrates communication between control devices of a modular vehicle.

Fig. 5 illustrates one example implementation of a control device according to thesecond aspect.

Fig. 6 illustrates another example implementation of a control device according tothe second aspect.

Fig. 7 illustrates a method for configuring a vehicle device according to the firstaspect.

Detailed descriptionOne way of meeting customers" different vehicle needs in a flexible and cost- efficient way is to use a modularised vehicle assembled from a set of modules.Such a modularised vehicle, herein referred to as a modular vehicle, is typicallyassembled at the customer"s premises and the customer may thus buy a set of 5 modules from a manufacturer. The modular vehicle can easily be assembled and re-assembled e.g. to perform a certain mission.

A moduiar vehicie is e.g. assembied by funotionai moduies for performing a certainfunction (such as carrying a ioad) and drive rnoduies used for driving the vehicle.Each drive module typically comprises an individual propulsion system and anindividual energy storage device, such as a battery.

To make the modules act jointly as one modular vehicle, the control of the drivemodules must be coordinated in some way. Therefore, one of the drive moduiesvviii be assigned to be a master drive moduie and the otheds) siave drive moduiesviriii be assigned to be siave drive rrioduies. This means that the master drive inoduiedetermines how to controi the vehioie to perform a certain rriission or function. Themaster drive instructs the siave drive rnoduies, e.g. by sending commands to thesiave drive rrioduies. Hovvever, an error or other in the dysfunction of the masterdrive moduie rnay be tatai to the vehicie and the mission. For exarnpie, a softwarefaiiure in the master drive moduie may cause aii the siave drive moduies to behavemaiioiousiy as vveii, because they are controiied by the master drive moduie.

Theretore, it is herein proposed a method vvhere the master drive moduie iscontinuaiiy surveyed and vvherein another drive mcduie is appointed the inasterdrive moduie, when an error is detected. For exampie, the master drive moduie andsiave drive moduiets) communicate vvith each other and monitor each other andvvhen a siave drive moduie discovers that the rnaster drive moduie is not workingproperty, then the siave drive moduie takes over and becomes the master drivemoduie. Aiternativeiy, the master drive moduie itseif can notice that something isvvrong and ask the siave drive moduie to take over and become the master drivemoduie. Aiternativeiy, an off~board system may determine that the master drivemoduie does not work and thereaiter oommand a siave drive moduie to become a master drive moduie. in this tvay secure operation of the vehicie is assured. 6 For better understanding of the proposed technique the concept of assembling avehicle from modules will now be explains with reference to the example embodiment of Fig. 1.

Fig. t iiiustrates an exarnoie of a system 400 comorising set of rnoduies 20 forassembiing a vehicie i. An offiooard system, herein referred to as a first controidevice 100, and an exampie of an assembied vehicie 'i are aiso iiiustrated. The setof moduies 20 comprises a piuraiity of drive moduies 30 and a piuraiity of functionaimoduies 40.

The drive modules" 30 main function is typically to drive (e.g. propel, steer andbrake) a vehicle 1. The drive modules 30 comprise a pair of wheels 37 and areconfigured to be autonomously operated. The functional modules are configured toperform a certain function such as to carry a load, e.g. goods or people. Eachmodule 30, 40 in the set of modules 20 comprises at least one interface 50releasably connectable to a corresponding interface 50 of another module 30, 40.

By combining drive rnoduies 30 and functionai moduies 40 different tyoes ofvehicies t can be achieved. Some vehicies i require tvvo or more drive moduies 30and some vehicies t oniy require one drive moduie 30, depending on tiie structuraiconfiguration of the funotionai moduie 40. Each drive rnoduie 30 comprises a controidevice, herein referred to as a second controi device 200, and rnay thuscommunicate with a controi center or off-board system, i.e. the first controi device100. Since the drive modules 30 may be configured to be operated asindependently driven units by means of the second control devices 200, the drivemodules 30 may be connected to, or disconnected from, the functional module(s) 40 without manual work.

The principie of assembiing a vehicie f from moduies 30, 40 vviii novv be described.An operator may receive a mission from a oiient to transport goods from oneiocation to another. The operator enters the information about the mission into thefirst controi device 'i00 via a user interface, such as a touch screen or sirniiar. it isoointed out that this is rnereiy an exarripie, and the received mission rriay 7 auternaticatty he transtated and/er inpetted te the tirst centret device 100. The tirstecritrei device i00 then deterrnines which terictien te he eerterrried and thus whichtyee et vehicie 'i is required te eerneiete the rnissien. in this exarnete, the reeeiredvehicte i iriay he a truck. The tirst centret device i00 seiects which rnedutes 30, 40te tise ter tite required truck. The tyee et vehicie t and the ntedetes 30, 40 requiredte cernetete the rnissien rnav ter exarnpte ee seiected based en interrnatien aheetthe geeds, the distance te travet and/er the geegraehicai tecatien. The tirst centretdevice 100 then eeriverts the rhissien inte a eerrirrtand ter ene er twe setected drivernedutes 30 te ehysicaiiy and eiectrieatty cennect with the seteeted tencticnatrnedeie 40. in this exarnpte, the vehieiet cernerises twe drive nfredeies. The secendecritrei devices 200 et the drive iheduies 30 each receives the eernrnand andcenverts the cernrnand te centret signats ter the respective drive rneduie 30. Thedrive ntedetes 30 are thereey centretted te phystcatty and eiectrieatty cenneet withthe ttinctienat ntiedete 40. Centreiting the drive rnedute 30 te cerrrieet with atuncttenai rnedtiie 40 rrrav eerrierise eentreiitng the drive rnedtiie 30 te identity theeesitieri et the setected tenctienat rnedtiie 40 and rneve te that eesitieri. The eesitienet the seteeted tiinctieriat rneduie 40 rnay he deterntined ieased en interrnattenreceived in the ccrrintand te cennect the drive rnedeie 30 with the ttinctichat rnedute40. Aiternativeiy, the eernrnand te cennect the drive rnediiie 30 and the tenctienatrnedete 40 is transrriitted te heth the drive rnedete 30 and the tenetiehat ihedeie 40,tvherehy the tenctienat rnedete 40 ereeares ter the eenneetien and startstransnittting a signai, The drive rrieduie 30 rnay then deterrnine the eesitten et thettinctienai ntedtiie ieased eri this transrriitted signat. The drive ntedtites 30 are thtisatttenerneusiy eeerated te tind the seiected tunctienat rrieduie 40 and cennect withthat tenctienat rneduie 40. At ieast ene senser device 00 arranged at the drivernedutes 30 and/er the tiinctienai rnedute 40 rnay he centigured te sense when theehysieat and/er eiectrieat cennectich has eeen eertcrnred. The at teast ene senserdevice 60 ihay send a signat te the seeend centret device 200 indicating that theecrineetients) have heen eerierrned. Based en the signat trenr the at teast eneseriser device 00, the secend centret device 200 rriay send a veriticatien signai tethe ttrst centret device t00 ter veriticatien et the cennectients). The tirst centretdevice 100 niay then geherate a unietre vehicie identity ter the asserneied vehicte 8 t. A vehicle 1 is thus aseeritbied and the vehicte 1 is ready to perform the rnissicn.The generated unique vehicle identity rnay then be stered in a database er recordasseciated vvith the cffbcard-system, i.e. the first centret device 100. The generatedunidue vehicle identity rnay else be transrnitted te the rneduies 30, 40 ef the vehicle1. The unique vehicie identity rnay optionaiiy be displayed by dne cr rncre of therneduies 30, 40 of the vehicie t.

Fig. 2a - Fig. 2c schematically illustrate a drive module 30 in a side view, a frontview and in a view from above, according to an embodiment. The drive module 30comprises a body 38. The wheels 37 are arranged on two opposite sides of thedrive module 30. The body 38 may have a first and a second side 31, 32, which arefacing in opposite directions. The body 38 may have a third and a fourth side 33,34, which are facing in opposite directions, wherein the third side 33 and the fourthside 34 may extend perpendicular to the first and the second sides 31 , 32. The body38 may also have a fifth and a sixth side 35, 36, which are facing in oppositedirections. The fifth and the sixth sides 35, 36 may extend perpendicularly to thefirst and the second sides 31 , 32 and the third and fourth sides 33, 34. The first andthe second sides 31, 32 may be referred to as side surfaces. The third and thefourth sides 33, 34 may be referred to as front and rear surfaces respectively. Thefifth side 35 may be referred to as a top surface and the sixth side 36 may bereferred to as a bottom surface. The sides 31, 32, 33, 34, 35, 36 may each have ashape that is flat or curved and may be shaped with indentations and protrusions.lnstead of the perpendicularly extension of the sides 31, 32, 33, 34, 35, 36described above, the sides 31 , 32, 33, 34, 35,36 may extend at any angle in relationto each other.

Fig. 3 schematically illustrates a drive module 30 in further detail in a side view. Thedrive module 30 comprises at least one (only one illustrated) propulsion system 91,an energy storage device 70, an interface 50, at least one sensor 39 and a secondcontrol device 200.

The propulsion system(s) 91 comprises for example an electric machine(s) connected to the wheels 37. ln some embodiments, each wheel 37 is individually 9 driven by its own electric machine. The electric machine(s) may also work asgenerators and generate electric energy when braking the wheels 37. Thus, thepropulsion system is typically the primary braking system of the vehicle 1.

Hett/ever, because the braking furtctiertaiity system may in some situetions beirtstifficiertt dr fait fer seme reaseri, a seeertdary braking system is required. Thisseeehdery brekirtg system is herein referred te es the braking system. The brakingsystem semprises for exampie standard disc braites and eiectremechanicai aetueters thet require reiiabie power stippiy.

The energy storage device 70 is configured to provide the propulsion system 91with energy. The energy storage device 70 is for example an electric battery thatmay be recharged with electric energy.

The at least one sensor 39 is configured to provide data about the drive module 30and its surroundings. For example, the at least one sensor 39 is configured tomonitor fuses, voltage levels, battery charging levels and communication with othermodules. The sensors 39 may also monitor steering and/or wheel suspension in the drive module 30.

The second control device 200 is configured to operate the drive module 30 as anindependently driven unit. The drive module 30 may transport itself without anyexternally driven unit such as a towing vehicle. The drive module 30 may transportitself by means of the at least one propulsion system 91. The drive module 30 maybe configured to be autonomously operated. Thus, the second control device 200may be configured to control the operation of the drive module 30. The secondcontrol device 200 may be configured to transmit control signals to the varioussystems and components of the drive module 30 for controlling for example thesteering and the propulsion of the drive module 30. The second control device 200may be configured to operate the drive module 30 autonomously based on receivedcommands. The second control device 200 may thus be configured to receivecommands from a remotely located off-board system i.e. the first control device100, and to convert the commands into control signals for controlling the various lO systems and components of the drive module 30. The second control device 200may also be configured to receive data about the drive module 30 and itssurroundings from the at least one sensor 39 and based on this data control thedrive module 30. The sensor may be configured to monitor the operation and todetect errors in various parts of the drive module 30. For example, sensors may bearranged in the propulsion system 91, in the braking system, in the energy storagedevice 70, in the steering system and/or the wheel suspension (not shown) etc. Thesecond control device 200 will be described in further detail in connection with Fig.

The drive module 30 may be configured to be releasably connected to either asecond drive module 30 and/or a functional module 40 for forming an assembledvehicle 1. At least one of the sides 31, 32, 33, 34, 35, 36 of the drive module 30may thus have a shape that allows the drive module 30 to be releasably connectedto the second drive module 30 and/or the functional module 40.

The at least one interface 50 of the drive module 30 is configured to physicallyconnect the drive module 30 with a second drive module 30 and/or a functionalmodule 40. The interface(s) 50 of the drive module 30 may be releasablyconnectable to a corresponding interface 50 of a second drive module 30 and/or afunctional module 40. in Fig. i the drive rnodtiies 30 ere iiteetrated with oniy one interface 50, on one sideot the drive rrtoduie 30. i-iowever, it is to be tinderstood thet each drive rnoduie 30rney corrtprise e pitireiity of interfeees 50 for reieesebie connection with otherrnodoies 40. The interface(s) 50 of the drive rnodutes 30 rney be arranged ondifferent sides of the drive moduie 30 and thus eneoie connection with otherinoduies 30, 40 on rritiitipie sides of the drive rnodoie 30, The interfeoee 50 on thedrive modoies 30 and the tunctionai rnoduies 40 respeotiveiy, ere arranged oncorresponding positions to enabie connection between the rnodoies 30, 40. ln some embodiments, the second control device 200 of the drive module 30 isconfigured to communicate with an additional control device e.g. a control device ll 300 of a functional module 40 being part of the same vehicle 1. A functional module40 may thus comprise a control device, which is referred to as a third control device300. ln some embodiments, the second control device 200 of the drive module 30is configured to communicate with the first control device 100. This is illustrated inFig. 4 where the dashed lines illustrate communication between the control devices100, 200, 300. This communication may be implemented in different ways. ln some embodiments, the at least two interfaces 50 comprises electric interfaces,arranged for transferring electric power and/or transmitting electric signals betweenthe drive module 30 and another module e.g. to a functional module 40 to whichthe drive module is connected.

The electrical interface 50 may be a wired interface or a wireless interface 50, suchas a conductive interface 50. ln other words, by connecting the drive module 30and the functional module 40 electrically the modules 30, 40 may transfer powerbetween each other and share information. The drive module 30 may, for example,control parts of the functional module 40, such as opening and closing of doors,heating and cooling. Electric power and/or electric signals may also be transmittedvia one module further to a further module. ln other words, one drive module 30 ofthe modular vehicle 1 may transmit electric power and/or electric signals via afunctional module 40 and further to another drive module of the same vehicle 1, asillustrated by the connection 51 in Fig. 1. Thus, the connection 51 comprises e.g. atleast one of a cable, bus or electrical line. ln some embodiments, the communication between the modules 30, 40 isimplemented using remote wireless communication, e.g. radio communication. Thewireless communication may be directly between the modules or via the off-boardsystem (i.e. first control device 100). The modules 30, 40 of an assembled vehiclemay communicate with each other and/or the first control device via 4G, 5G, V2V(Vehicle to Vehicle), Wi-Fi or any other wireless communication means. ln some embodiments, the drive module 30 is associated with a registrationnumber. The drive module 30 may thereby be regarded an independent vehicle. ln 12 the case where an assembled vehicle 1 comprises two drive modules, each drivemodule is associated with a distinct registration number. The first control device100 may determine which of the drive modules 30 should show (or announce) itsregistration number. lf the assembled vehicle 1 comprises two drive modules, thefirst control device 100 may appoint one drive module to be master drive moduleand the other to be slave drive module. Typically, the master drive module will becommanded to announce its registration number and the slave drive module willnot show its registration number. The first control device 100 may thus transmitinstructions regarding the registration number of the master drive modules to thesecond control devices 200 one or more of the of the other drive modules 30 in the set of modules 20. ln some embodiments, the first control device 100 is configured to determine aconfiguration and operations for an assembled vehicle 1 based on a mission (orfunction) to be performed by the assembled vehicle 1, and to transmit thedetermined configuration to a second control device 300 being appointed to be amaster drive module. The master drive module will then control the operation of thevehicle 1 while performing the mission.

The proposed solution wiii now be explained with reference te the flow chart of Fig.7. As described above, this disciosure proposes a method for configuring a vehicle1, such as the vehicle 1 illustrated in Fig.1 to Fig. 4.

However, even though reference is herein made to the vehicle 1 illustrated in Fig.1to Fig. 3, it must be appreciated that the proposed method may be used forcontrolling any vehicle comprising at least two drive modules configured to beautonomously operated as independent drive modules, where one of the at leasttwo drive modules is configured to operate as a master drive module and the other (or others) are configured to operate as slave drive modules.

The method may be implemented as a computer program comprising instructionswhich, when the program is executed by a computer (e.g. a processor in a secondcontrol device 200 (Fig. 5)), cause the computer to carry out the method. According 13 to some embodiments the computer program is stored in a computer-readablemedium (e.g. a memory or a compact disc) that comprises instructions which, whenexecuted by a computer, cause the computer to carry out the method.

The propesed method vviii novv be described vvhiie performed by a second controldevice 200 of a slave drive rrioduie or a master drive rnodoie ot the vehicie t.i-tovvever, it must be appreciated that the method may aiternativeiy, at ieast partiy,be impiemertted iri the first corttroi device tott or third controi device 300 of theveiticie or the impiementation may be distributed among any or att of the controidevices tGÜ, 290, SOU.

The method is typioaiiy performed cchtinuousiy or periodicaiiy during normai vehicieoperation. The method comprises monitoring S1 a functionality of the master drivemodule. Functionality is e.g. driving functionality, physical properties, softwarefunctionality etc. More specifically, the functionality refers to the ability of the masterdrive module to perform its tasks e.g. tasks related to performing a mission. ln otherwords, the functionality of the master drive module is monitored during operation.This may be done in many different ways, e.g. by monitoring hardware, software ordriving as will be apparent by the examples below. lf an error is detected during the monitoring, then the master drive module is"exchanged", and another master drive module is appointed or assigned. ln otherwords, the method further comprises, upon determining S2 an error condition in thefunctionality of the master drive module, re-configuring S4 one of the slave drivemodules to operate as a master drive module and re-configuring the master drive module to operate as a slave drive module.

Different examples of monitoring S1 and determining S2 an error condition in thefunctionality will now be described in further detail. Note that the different ways of monitoring S1 and determining S2 may be combined for increased security. ln some embodiments, the monitored functionality is the functionality of a processorand operation system of the master drive module. ln other words, in some embodiments, the determining S2 comprises receiving an error command or 14 detecting a software error indicative of an error condition. The master drive modulemay e.g. send error commands to the slave modules when a software error orcommunication error is detected in the second control device 200 of the masterdrive module. One example of a software error is expiry of a watchdog timersurveilling a system of the master drive module e.g. a battery system, anautonomous driving system, a propulsion system etc. A watchdog timer is anelectronic timer that is used to detect (and recover from) computer malfunctions.During normal operation, the computer regularly resets the watchdog timer toprevent it from elapsing, or "timing out". lf, due to a hardware fault or program error,the computer fails to reset the watchdog, the timer will elapse and generate atimeout signal. The timeout signal may serve as an indication of an error condition in the corresponding system.

Furthermore, a "heart-beat" periodically transmitted from the master drive moduleto the slave drive modules (and/or the off-board system) is in some embodimentscontinually monitored by the slave drive module(s), to make sure that the masterdrive module is alive. A missing heart beat may indicate that there is a softwareerror in the master drive module or that the communication between the masterdrive module and the slave drive module is interrupted. ln some embodiments, thedetermining S2 an error condition comprises detecting a missing heartbeat or a communication error.

Alternatively, or in addition, hardware properties of the master drive module 1 aremonitored. Examples of hardware that are relevant to monitor is the battery,steering, wheel suspension, engine etc. Some hardware errors may be monitoredby dedicated sensors 39 in the master drive module, which are typically monitoredduring operation of the vehicle 1. For example, internal voltages, internal currentsabove or below a certain threshold could e.g. be an indication of a hardware errorin the master drive module. ln some embodiments, the master drive module maysend a message to the slave modules informing about such an error. Alternatively,the master drive module may re-configure itself when a hardware error is detected. ln other words, in some embodiments, the determining S2 of an error condition comprises detecting abnormal sensor data, a broken fuse, an abnormal voltage level, an error in the wheel suspension or an abnormal battery charging level.

Another possibility is to monitor the autonomous driving of the vehicle 1, which iscontrolled by the master drive module. While operating a modular vehicle, themaster drive module will typically receive a mission to be performed and thendetermine how to drive the vehicle 1 to perform the mission. For example, drivingparameters for the mission, such as speed of the vehicle, propulsion torque and/orthe steering, are determined by the master drive module. These driving parametersmay be compared to reference data. ln some embodiments, the reference data isstatic. For example, driving that deviates significantly from reference drivingparameters, or driving parameters obtained from of a mathematical model could bean indication of an error. Also, abnormal (e.g. jerky or irregular) driving behaviormight be an indicator that something is wrong. ln other words, in someembodiments, the determining S2 comprises determining the error condition bycomparing driving parameters calculated and/or determined by the master drivemodule with reference data.

The reference data may alternatively be dynamic e.g. it may be determined e.g. bythe master drive module, based on the current mission. For example, if the vehicle1 is supposed to travel a very short distance, then a high speed or high propulsiontorque would be suspicious. For example, while re-arranging the modules 30,40 toassemble the modular vehicle 1, the speed should not exceed 10 km/ h.

Another possibility is to obtain reference data by letting the slave drive moduleperform the same or similar estimations or calculations as the drive module. As themaster drive module and the slave drive modules typically have the same or similarcapability, one option is to also let the slave drive modules also determine how todrive the vehicle 1 to perform the mission, at least partly. One may then comparethe calculations performed by the different drive modules 30. ln other words, insome embodiments, the reference data comprises corresponding drivingparameters calculated and/or determined by one of the slave drive modules. ln some embodiments, the method also comprises obtaining S0 the reference data 16 from the slave drive module. For example, the first control device 100 or the masterdrive module, receives driving parameters from one or more slave drive modules.Deviations between those calculations may then be an indication of an error.Alternatively, the master drive module may send driving parameters or othercalculations to the slave drive module, for comparison to reference data in the slave drive module.

When a new master drive module is appointed, the old drive module will beassigned to be a slave drive module. However, as there is a potential error in theold slave drive module further measures may be taken to assure that the error doesnot affect the driving of the vehicle. One possibility is to center or declutch thewheels of the old master drive module to assure that the maneuverability of thevehicle is not affected by the error. ln other words, in some embodiments, the drivemodules comprise wheels 37 and the re-configuring comprises configuring thewheels of a slave drive module in order not to affect maneuverability. lf the methodis performed in the master drive module, then the master drive module may performthis re-configuration when it hands over control to a slave drive module. lf themethod is performed in a slave drive module or in the off-board system, then there-configuring comprises instructing the old master drive module, which is now aslave drive module, to configure its wheels in order not to affect maneuverability ofthe vehicle 1, or at least to affect it as little as possible. This may e.g. be done bythe drive module configuring its wheels to be in a "neutral" position e.g. straightforward, instead of configuring the wheels as would the drive module have been amaster drive module. The re-configuring may either be triggered directly byhardware e.g. by an actuator triggered by a press loss in a hydraulic control systemor a power failure in an electric control system. An option would be to configuresoftware to cause the wheels to be centered upon the detection of an errorcondition.

As mentioned above, the proposed method may be performed in different parts ofthe system 400. ln some embodiments, the error condition is detected by a control device 200 of one of the drive modules 30 (i.e. a second control device 200), e.g. 17 in a slave drive module. Then the re-configuring S4 comprises that the slave drivemodule takes over control from the master drive module. For example, the re-configuring comprises instructing the master drive module to give up control.Typically, the off-board system is also informed about which drive module is the new master drive module.

However, for example for security reasons, it is not always desirable to let the slavedrive module have mandate to take over without approval from another unit. Hence,an approval from e.g. the off-board system (i.e. the first control device 100) may berequired. Hence, if a slave drive module detects an error condition in thefunctionality of the master drive module, then it may send a request to the firstcontrol device 100 to take over and become the master drive module. ln otherwords, in some embodiments, the method comprises receiving S3 by the drivemodule 30 detecting the error, from an off-board control device, an approval to re-configure the master drive module. Another possibility is that the slave drive modulerequests the first control device to assign a new master drive module when an errorin the master drive module is detected.

The proposed method may alternatively be performed by an off-board system i.e.by the first control device 100. The monitoring S1 then typically comprises receivinginformation from the drive modules 30 (or more specifically from the second controldevices 200 of the drive modules 30). For example, the drive modules may sendinformation about error commands to the first control device 100, informing the firstcontrol device 100 about any of the error conditions mentioned above. Anotherpossibility is that there is a continual communication between the first control device100 and the second control device 200 of the master drive module of the vehicle 1,such as a heart-beat. lf the heart beat is interrupted for a certain time period, thenthe off-board system may re-configure a new master drive module, in an attempt tore-establish communication. ln other words, a new master drive module may beappointed if communication is interrupted. Another possibility is to let the off-boardsystem compare calculations performed by the master drive module and reference data, in a similar way as described above. 18 ln some embodiments, the determining S2 and the re-configuring S4 is performedby the master drive module or in an off-board system. Then the decision may bemade without any approval. More specifically, the master drive module or the off-board system may simply inform one of the slave drive modules that the one slavedrive module now is the master drive module. ln other words, in some embodimentsthe re-configuring comprises instructing one of the slave drive modules to becomea master drive module. lf the re-configuring is performed by the master drivemodule, then the off-board system is typically informed that a new master drive module is now appointed.

The proposed solution is applicable on all sorts of road vehicles. However, thedisclosure may relate to heavy vehicles, such as buses, trucks etc. Specifically, thepresent disclosure may relate to vehicles for use on public roads.

Now turning to Fig. 5 which illustrates an example implementation a control deviceconfigured to implement the proposed method. ln this example the control deviceis embodied as a second control device 200 for use in a vehicle 1, such as themodular vehicle described in Fig. 1 to Fig. 3. The second control device is either a slave drive module or a master drive module. ln some embodiments, the second control device 200 is a "unit" in a functionalsense. Hence, in some embodiments the second control device 200 is a controlarrangement comprising several physical control devices that operate incorporation. The second control device 200 comprises hardware and software. Thehardware basically comprises various electronic components on a Printed CircuitBoard, PCB. The most important of those components is typically a processor 210 along with a memory 220.

The second control device 200 also comprises one or more communicationinterfaces 230, enabling the second control device 200 to communicate with othermodules 30, 40 of the modular vehicle 1, or of other vehicles. The communicationbetween the modules is as mentioned above wireless, conductive or wired. Wiredcommunication may be implemented standard protocols such as Controller Area 19 Network, CAN. CAN is a robust vehicle bus standard designed to allowmicrocontrollers and devices to communicate with each other in applicationswithout a host computer. Wireless communication between the modules may beimplemented using any short-range communication protocol such as Bluetooth or802.11.

The one or more communication interfaces 230 is also configured to enablewireless communication with the first control device 100, i.e. with the off-boardsystem. The wireless communication between the second control device 200 andthe first control device is e.g. implemented using 4G, 5G, V2V (Vehicle to Vehicle) or any other suitable wireless communication protocol.

The second control device 200, or more specifically the processor 110 of thesecond control device 200, is configured to cause the second control device 200 toperform all aspects of the method described above and below. This is typically doneby running computer program code stored in the memory 220 in the processor 210 of the second control device 200.

More particularly, the second control device 200 is configured to monitor afunctionality of the master drive module. lf the method is performed by the slavedrive module, this implies receiving e.g. driving data, sensor data, a heart-beat, anerror command or other relevant data, from the master drive module using the communication interface 230.

The second control device 200 is further configured to upon determining an errorcondition in the functionality of the master drive module re-configure one of theslave drive modules to operate as a master drive module and to re-configure the master drive module to operate as a slave drive module. ln some embodiments, the second control device is configured to determine theerror condition by comparing driving parameters calculated and/or determined bythe master drive module with reference data. ln some embodiments, the drivingparameter comprises at least one of propulsion torque, steering angle,suspension, voltage level. ln some embodiments, the reference data comprises corresponding driving parameters calculated and/or determined by one of the slave drive modules. ln some embodiments, the second control device 200 is configured configure thewheels of a slave drive module in order not to affect maneuverability of the vehicle1 lf the method is performed by the master drive module, this implies sending an instruction to the slave drive module using the communication interface 230. ln some embodiments, the second control device 200 is configured to determinethe error condition based on a received error command or detecting a missing heartbeat, a communication error or other software error. ln some embodiments, the second control device 200 is configured to detect (ordetermine) at least one of; abnormal sensor data, a broken fuse, an abnormalvoltage level, an abnormal battery charging level or other hardware error. ln some embodiments, the second control device 200 is configured to receive anapproval to re-configure the master drive module from an off-board system. ln some embodiments, the second control device 200 is comprised in the slavedrive module 30 and the second control device is configured to take over control from the master drive module. ln some embodiments, the second control device, 200 is comprised in the masterdrive module 30 the second control device is configured to instruct one of the slave drive modules to become a master drive module. ln some embodiments, this disclosure relates to a vehicle 1, comprising at least twodrive modules 30 configured to be autonomously operated as independent drivemodules 30. One of the at least two drive modules is configured to operate as amaster drive module and the others are configured to operate as slave drivemodules, the second control device being configured. The vehicle 1 furthercomprises a control device 200 configured to (at least partly) perform any or all ofthe aspects of the method illustrated in Fig. 7. 21 Now turning to Fig. 6 which illustrates another example implementation a controldevice configured to implement the proposed method. ln this example the controldevice is embodied as a first control device 100, i.e. in an off-board system. ln some embodiments, the first control device 100 is a "unit" in a functional sense.Hence, in some embodiments the first control device 100 is a control arrangementcomprising several physical control devices that operate in corporation. The firstcontrol device 100 comprises hardware and software. The hardware basicallycomprises various electronic components on a Printed Circuit Board, PCB. Themost important of those components is typically a processor 110 along with a memory 120.

The first control device 100 also comprises a communication interface 130,enabling the first control device 100 to communicate with the modules 30, 40 of themodular vehicle 1 and with other external entities such as traffic systems etc. Thecommunication interface 130 e.g. enables internet connection. The communication of the first control device 100 is e.g. implemented using lnternet Protocol, IP.

The first control device 100, or more specifically the processor 1 10 of the first controldevice 100, is configured to cause the first control device 100 to perform all aspectsof the method described above and below. This is typically done by runningcomputer program code stored in the memory 120 in the processor 110 of the first control device 100.

More particularly, in some embodiments, the first control device 100 is configuredto to monitor a functionality of the master drive module, and to upon determiningan error condition in the functionality of the master drive module re-configure oneof the slave drive modules to operate as a master drive module and re-configuringthe master drive module to operate as a slave drive module. l\/lore specifically, thefirst control device 100 sends an instruction to one of the drive modules (or morespecifically to a second control device 200 of one of the drive modules 30), e.g. toa new drive module of the vehicle 1 to re-configure itself as being a master drive 22 module. ln some embodiments, the first control device 100 is also configured toinform the other drive modules 200 about the change in master drive module.

The monitoring and the determining of an error condition are then performed in asimilar way as when performed by the second control device 20, with thedifference that the first control device 100 needs to receive required data from the master and slave modules using the communication interface 130.

The terminology used in the description of the embodiments as illustrated in theaccompanying drawings is not intended to be limiting of the described method;control arrangement or computer program. Various changes, substitutions and/oralterations may be made, without departing from invention embodiments as definedby the appended claims.

The term "or" as used herein, is to be interpreted as a mathematical OR, i.e., as aninclusive disjunction; not as a mathematical exclusive OR (XOR), unless expresslystated otherwise. ln addition, the singular forms "a", "an" and "the" are to beinterpreted as "at least one", thus also possibly comprising a plurality of entities ofthe same kind, unless expressly stated otherwise. lt will be further understood thatthe terms "includes", "comprises", "including" and/ or "comprising", specifies thepresence of stated features, actions, integers, steps, operations, elements, and/ orcomponents, but do not preclude the presence or addition of one or more otherfeatures, actions, integers, steps, operations, elements, components, and/ orgroups thereof. A single unit such as e.g. a processor may fulfil the functions of several items recited in the claims.

Claims (23)

1. _ 23 laims

2. A method, performed by a control device (100, 200) for configuring a vehicle(1), comprising at least two drive modules (30) configured to be autonomouslyoperated as independent drive modules (30); wherein one of the at least twodrive modules is configured to operate as a master drive module and theothers are configured to operate as slave drive modules, the methodcomprising: - monitoring (S1) a functionality of the master drive module, and upon determining (S2) an error condition in the functionality of the master drive module: - re-configuring (S4) one of the slave drive modules to operate as a master drive module and re-configuring the master drive module to operate as a slave drive module. _ The method according to claim 1, wherein the determining (S2) comprises determining the error condition by comparing driving parameters calculatedand/or determined by the master drive module with reference data.

3. The method according to claim 2, wherein the driving parameter comprises at least one of propulsion torque, steering angle, suspension, voltage level.

4. The method according to claim 2 or 3, wherein the reference data comprisescorresponding driving parameters calculated and/or determined by one of the slave drive modules.

5. The method according to any of the preceding claims, wherein the drivemodules comprise wheels (37) and wherein the re-configuring comprisesconfiguring the wheels of a slave drive module in order not to affectmaneuverability of the vehicle (1)

6. The method according to any of the preceding claims, wherein the determining(S2) comprises receiving an error command or detecting a missing heartbeat, a communication error or other software error indicative of an error condition. 24

7. The method according to any of the preceding claims, wherein the determining(S2) an error condition comprises detecting at least one of; abnormal sensordata, a broken fuse, an abnormal voltage level, an abnormal battery charging level or other hardware error.

8. The method according to any of the preceding claims, wherein the errorcondition is detected by a control device (200) of one of the drive modules(30), and wherein the method comprises:- receiving (S3) by the drive module (30) detecting the error, from an off-board control device, an approval to re-configure the master drive module.

9. The method according to any of the preceding claims, wherein the determining(S2) and the re-configuring (S4) is performed by the master drive module or inan off-board system, and wherein the re-configuring comprises instructing oneof the slave drive modules to become a master drive module.

10.The method according to any of the preceding claims, wherein the determining

11. (S2) and the re-configuring (S4) is performed by one of the slave drivemodules and wherein the re-configuring comprises the slave drive module taking over control from the master drive module. .A control device (100, 200) configured to control a vehicle (1), comprising at least two drive modules (30) configured to be autonomously operated asindependent drive modules (30); wherein one of the at least two drive modulesis configured to operate as a master drive module and the others areconfigured to operate as slave drive modules, the control device beingconfigured - to monitor a functionality of the master drive module, and to upon determining an error condition in the functionality of the master drive module: - re-configure one of the slave drive modules to operate as a masterdrive module and re-configuring the master drive module to operate as a slave drive module.

12.The control device (100, 200) according to claim 11, wherein the controldevice is configured to determine the error condition by comparing drivingparameters calculated and/or determined by the master drive module withreference data.

13.The control device (100, 200) according to claim 12, wherein the drivingparameter comprises at least one of propulsion torque, steering angle, suspension, voltage level.

14.The control device (100, 200) according to claim 12 or 13, wherein thereference data comprises corresponding driving parameters calculated and/ordetermined by one of the slave drive modules.

15.The control device (100, 200) according to any one of claims 11 to 14, whereinthe control device (100, 200) is configured configure the wheels of a slave drive module in order not to affect maneuverability of the vehicle (1)

16.The control device (100, 200) according to any one of claims 11 to 15, whereinthe control device (100, 200) is configured to determine the error conditionbased on a received error command or detecting a missing heartbeat, a communication error or other software error.

17.The control device (100, 200) according to any one of claims 11 to 16, whereinthe control device (100, 200) is configured to detect at least one of; abnormalsensor data, a broken fuse, an abnormal voltage level, an abnormal batterycharging level or other hardware error.

18.The control device (200) according to any one of claims 11 to 17, wherein the control device (200) is comprised in one of the one or more drive modules and 26 wherein the control device (200) is configured to receive an approval to re- configure the master drive module from an off-board system.

19.The control device (200) according to any one of claims 11 to 18, wherein thecontrol device (200) is comprised in the slave drive module (30) and whereinthe control device is configured to take over control from the master drive module.

20.The control device (100, 200) according to any one of claims 11 to 17, whereinthe control device (100, 200) is comprised in the master drive module (30) orin an off-board system, and wherein the control device is configured to instruct one of the slave drive modules to become a master drive module.

21. .A computer program comprising instructions which, when the program isexecuted by a control device, cause the control device to carry out the method of any one of the claims 1 to 10.

22.A computer-readable storage medium comprising instructions which, whenexecuted by a control device, cause the control device to carry out the method of any one of the claims 1 to 10.

23.A vehicle (1) comprising the control device (200) according to any of claims according to claim 11-19.