WO2020076207A1

WO2020076207A1 - Method and control device for configuring a vehicle

Info

Publication number: WO2020076207A1
Application number: PCT/SE2019/050874
Authority: WO
Inventors: André Claesson; Linus ÄHRLIG; Robert SJÖDIN; Sami Teppola; Mikko Kallio; Tomas SKEPPSTRÖM; Morgan Colling
Original assignee: Scania Cv Ab
Priority date: 2018-10-08
Filing date: 2019-09-17
Publication date: 2020-04-16
Also published as: DE112019004377T5; CN112805212B; SE542584C2; CN112805212A; SE1851215A1

Abstract

The present disclosure relates to techniques in the context of vehicles, and to a method for configuring a vehicle 1. In particular the method relates to re-configuring a slave drive module of the vehicle to operate as a master drive module and re- configuring the master drive module to operate as a slave drive module upon determining an error condition in the functionality of the master drive module. According to a first aspect, the disclosure relates to a method for configuring a vehicle, comprising at least two drive modules configured to be autonomously operated as independent drive modules. One of the at least two drive modules is configured to operate as a master drive module and the others are configured to operate as slave drive modules. The method comprises monitoring S1 a functionality of the master drive module, and upon determining S2 an error condition in the functionality of the master drive module re-configuring S4 one of the slave drive modules to operate as a master drive module and re-configuring the master drive module to operate as a slave drive module. The disclosure also relates to a corresponding control device, to a vehicle comprising the control device, to a computer program and to a computer-readable medium.

Description

Method and control device for configuring a vehicle

Technical field

The present disclosure relates to techniques in the context of vehicles, and to a method for configuring a vehicle. In particular, the method relates to re-configuring a slave drive module of the vehicle to operate as a master drive module and re- configuring the master drive module to operate as a slave drive module upon determining an error condition in the functionality of the master drive module. The disclosure also relates to a corresponding control device, to a vehicle comprising the control device, to a computer program and a computer-readable medium.

Background

Vehicles of today are typically manufactured for a specific purpose, e.g. a bus is manufactured for transporting people and a truck is manufactured for transporting goods. Such vehicles are commonly manufactured and completely assembled in a factory, or they may be partly assembled in a factory and completed at a body manufacturer. Once the vehicle is assembled, the vehicle may be used for the specific purpose. Thus, a bus may be used as a bus and a garbage truck may be used as a garbage truck. Different vehicles are thus needed for different purposes, which may require a large fleet of vehicles for a hauler, and thereby become very costly.

There are, for example, known solutions where a truck can be rebuilt by changing a concrete mixer to a loading platform. This increases the flexibility and two different functions can be achieved by means of one single vehicle. Also, document US- 2018/0129958 D1 discloses a modular electric vehicle using interchangeable vehicle assembly modules. The user can thereby disassemble and reassemble the vehicle for use in different applications. However, in the future, further development towards even more flexible and secure vehicle solutions might be needed to meet customers’ different vehicle needs in a cost-efficient way.

Summary

It is an object of the disclosure to provide a solution, for use in a modular vehicle, that enables fail-safe operation of the modular vehicle. In particular, the operation of the modular vehicle should be ensured even when an error condition occurs in the functionality of one drive module, such as a master drive module of the modular vehicle.

According to a first aspect, the disclosure relates to a method for configuring a vehicle, comprising at least two drive modules configured to be autonomously operated as independent drive modules. One of the at least two drive modules is configured to operate as a master drive module and the others are configured to operate as slave drive modules. The method comprises monitoring a functionality of the master drive module, and upon determining an error condition in the functionality of the master drive module, re-configuring one of the slave drive modules to operate as a master drive module and re-configuring the master drive module to operate as a slave drive module. Thereby, operation of the vehicle is ensured even if the master drive module is defective.

In some embodiments, the determining comprises determining the error condition by comparing driving parameters calculated and/or determined by the master drive module with reference data. Thereby, autonomous driving controlled by the master drive module can be supervised. In some embodiments, the driving parameter comprises at least one of propulsion torque, steering angle,

suspension and a voltage level. Thus, if those parameters have incongruous values, then a new master module will be assigned.

In some embodiments, the reference data comprises corresponding driving parameters calculated and/or determined by one of the slave drive modules.

Thereby, an internal security system using redundancy is achieved.

In some embodiments, the drive modules comprise wheels and wherein the re- configuring comprises configuring the wheels of a slave drive module in order not to affect maneuverability. Thereby, an error in the master module will not affect the driving behavior, when a new master module is assigned.

In some embodiments, the determining comprises receiving an error command or detecting a software error or a communication error indicative of an error condition. Hence, an error in the software of the master drive module will be handled by the proposed method.

In some embodiments, the determining of an error condition comprises detecting at least one of; a broken fuse, a missing heartbeat, a hardware error, an abnormal voltage level, an abnormal battery charging level and a communication error. Hence, an error in the hardware of the master drive module will be handled by the proposed method.

In some embodiments, the error condition is detected by a control device of one of the drive modules, and the method comprises receiving by the drive module detecting the error, from an off-board control device, an approval to re-configure the master drive module. Thereby, security is enhanced, as the re-configuring must be approved by the off-board unit.

In some embodiments, the determining and the re-configuring is performed by the master drive module or in an off-board system, and wherein the re-configuring comprises instructing one of the slave drive modules to become a master drive module.

In some embodiments, the determining and the re-configuring is performed by one of the slave drive modules and wherein the re-configuring comprises that the slave drive module is taking over control from the master drive module. Thus, the operation of the vehicle can be ensured even if the master drive module does not work at all.

According to a second aspect the disclosure relates to a corresponding control device configured to control a vehicle, comprising at least two drive modules configured to be autonomously operated as independent drive modules. One of the at least two drive modules is configured to operate as a master drive module and the others are configured to operate as slave drive modules. The control device is configured to monitor a functionality of the master drive module, and to upon determining an error condition in the functionality of the master drive module re-configure one of the slave drive modules to operate as a master drive module and re-configuring the master drive module to operate as a slave drive module.

According to a third aspect, the disclosure relates to a vehicle comprising the control device according to the second aspect.

According to a fourth aspect, the disclosure relates to a computer program comprising instructions which, when the program is executed by a computer, cause the computer to carry out the method according to the first aspect.

According to a fifth aspect, the disclosure relates to a computer-readable medium comprising instructions which, when executed by a computer, cause the computer to carry out the method according to the first aspect.

Brief description of the drawings

Fig. 1 illustrates a set of modules, a vehicle assembled from the set of modules, and an offboard system.

Fig. 2a - Fig. 2c schematically illustrate a drive module in a side view, a front view and in a view from above.

Fig. 3 schematically illustrates a drive module in further detail in a side view.

Fig. 4 illustrates communication between control devices of a modular vehicle.

Fig. 5 illustrates one example implementation of a control device according to the second aspect.

Fig. 6 illustrates another example implementation of a control device according to the second aspect.

Fig. 7 illustrates a method for configuring a vehicle device according to the first aspect.

Detailed description

One way of meeting customers’ different vehicle needs in a flexible and cost- efficient way is to use a modularised vehicle assembled from a set of modules. Such a modularised vehicle, herein referred to as a modular vehicle, is typically assembled at the customer’s premises and the customer may thus buy a set of modules from a manufacturer. The modular vehicle can easily be assembled and re-assembled e.g. to perform a certain mission.

A modular vehicle is e.g. assembled by functional modules for performing a certain function (such as carrying a load) and drive modules used for driving the vehicle. Each drive module typically comprises an individual propulsion system and an individual energy storage device, such as a battery.

To make the modules act jointly as one modular vehicle, the control of the drive modules must be coordinated in some way. Therefore, one of the drive modules will be assigned to be a master drive module and the other(s) slave drive modules will be assigned to be slave drive modules. This means that the master drive module determines how to control the vehicle to perform a certain mission or function. The master drive instructs the slave drive modules, e.g. by sending commands to the slave drive modules. However, an error or other in the dysfunction of the master drive module may be fatal to the vehicle and the mission. For example, a software failure in the master drive module may cause all the slave drive modules to behave maliciously as well, because they are controlled by the master drive module.

Therefore, it is herein proposed a method where the master drive module is continually surveyed and wherein another drive module is appointed the master drive module, when an error is detected. For example, the master drive module and slave drive modu!e(s) communicate with each other and monitor each other and when a slave drive module discovers that the master drive module is not working properly, then the slave drive module takes over and becomes the master drive module. Alternatively, the master drive module itself can notice that something is wrong and ask the slave drive module to take over and become the master drive module. Alternatively, an off-board system may determine that the master drive module does not work and thereafter command a slave drive module to become a master drive module. In this way secure operation of the vehicle is assured. For better understanding of the proposed technique the concept of assembling a vehicle from modules will now be explains with reference to the example embodiment of Fig. 1.

Fig. 1 illustrates an example of a system 400 comprising set of modules 20 for assembling a vehicle 1 . An offboard system, herein referred to as a first control device 100, and an example of an assembled vehicle 1 are also illustrated. The set of modules 20 comprises a plurality of drive modules 30 and a plurality of functional modules 40.

The drive modules’ 30 main function is typically to drive (e.g. propel, steer and brake) a vehicle 1. The drive modules 30 comprise a pair of wheels 37 and are configured to be autonomously operated. The functional modules are configured to perform a certain function such as to carry a load, e.g. goods or people. Each module 30, 40 in the set of modules 20 comprises at least one interface 50 releasably connectable to a corresponding interface 50 of another module 30, 40.

By combining drive modules 30 and functional modules 40 different types of vehicles 1 can be achieved. Some vehicles 1 require two or more drive modules 30 and some vehicles 1 only require one drive module 30, depending on the structural configuration of the functional module 40. Each drive module 30 comprises a control device, herein referred to as a second control device 200, and may thus communicate with a control center or off-board system, i.e. the first control device 100. Since the drive modules 30 may be configured to be operated as independently driven units by means of the second control devices 200, the drive modules 30 may be connected to, or disconnected from, the functional module(s) 40 without manual work.

The principle of assembling a vehicle 1 from modules 30, 40 will now be described. An operator may receive a mission from a client to transport goods from one location to another. The operator enters the information about the mission into the first control device 100 via a user interface, such as a touch screen or similar. It is pointed out that this is merely an example, and the received mission may automatically be translated and/or inputted to the first control device 100. The first control device 100 then determines which function to be performed and thus which type of vehicle 1 is required to complete the mission. In this example, the required vehicle 1 may be a truck. The first control device 100 selects which modules 30, 40 to use for the required truck. The type of vehicle 1 and the modules 30, 40 required to complete the mission may for example be selected based on information about the goods, the distance to travel and/or the geographical location. The first control device 100 then converts the mission into a command for one or two selected drive modules 30 to physically and electrically connect with the selected functional module 40. In this example, the vehicle 1 comprises two drive modules. The second control devices 200 of the drive modules 30 each receives the command and converts the command to control signals for the respective drive module 30. The drive modules 30 are thereby controlled to physically and electrically connect with the functional module 40. Controlling the drive module 30 to connect with a functional module 40 may comprise controlling the drive module 30 to Identify the position of the selected functional module 40 and move to that position. The position of the selected functional module 40 may be determined based on information received in the command to connect the drive module 30 with the functional module 40. Alternatively, the command to connect the drive module 30 and the functional module 40 is transmitted to both the drive module 30 and the functional module 40, whereby the functional module 40 prepares for the connection and starts transmitting a signal. The drive module 30 may then determine the position of the functional module based on this transmitted signal. The drive modules 30 are thus autonomously operated to find the selected functional module 40 and connect with that functional module 40. At least one sensor device 60 arranged at the drive modules 30 and/or the functional module 40 may be configured to sense when the physical and/or electrical connection has been performed. The at least one sensor device 60 may send a signal to the second control device 200 indicating that the connection(s) have been performed. Based on the signal from the at least one sensor device 60, the second control device 200 may send a verification signal to the first control device 100 for verification of the connection(s). The first control device 100 may then generate a unique vehicle identity for the assembled vehicle 1 . A vehicle 1 is thus assembled and the vehicle 1 is ready to perform the mission. The generated unique vehicle identity may then be stored in a database or record associated with the offboard-system, i.e. the first control device 100. The generated unique vehicle identity may also be transmitted to the modules 30, 40 of the vehicle 1 . The unique vehicle identity may optionally be displayed by one or more of the modules 30, 40 of the vehicle 1

Fig. 2a - Fig. 2c schematically illustrate a drive module 30 in a side view, a front view and in a view from above, according to an embodiment. The drive module 30 comprises a body 38. The wheels 37 are arranged on two opposite sides of the drive module 30. The body 38 may have a first and a second side 31 , 32, which are facing in opposite directions. The body 38 may have a third and a fourth side 33, 34, which are facing in opposite directions, wherein the third side 33 and the fourth side 34 may extend perpendicular to the first and the second sides 31 , 32. The body 38 may also have a fifth and a sixth side 35, 36, which are facing in opposite directions. The fifth and the sixth sides 35, 36 may extend perpendicularly to the first and the second sides 31 , 32 and the third and fourth sides 33, 34. The first and the second sides 31 , 32 may be referred to as side surfaces. The third and the fourth sides 33, 34 may be referred to as front and rear surfaces respectively. The fifth side 35 may be referred to as a top surface and the sixth side 36 may be referred to as a bottom surface. The sides 31 , 32, 33, 34, 35, 36 may each have a shape that is flat or curved and may be shaped with indentations and protrusions. Instead of the perpendicularly extension of the sides 31 , 32, 33, 34, 35, 36 described above, the sides 31 , 32, 33, 34, 35, 36 may extend at any angle in relation to each other.

Fig. 3 schematically illustrates a drive module 30 in further detail in a side view. The drive module 30 comprises at least one (only one illustrated) propulsion system 91 , an energy storage device 70, an interface 50, at least one sensor 39 and a second control device 200.

The propulsion system(s) 91 comprises for example an electric machine(s) connected to the wheels 37. In some embodiments, each wheel 37 is individually driven by its own electric machine. The electric machine(s) may also work as generators and generate electric energy when braking the wheels 37. Thus, the propulsion system is typically the primary braking system of the vehicle 1 .

However, because the braking functionality system may in some situations be insufficient or fail for some reason, a secondary braking system is required. This secondary braking system is herein referred to as the braking system. The braking system comprises for example standard disc brakes and electromechanical actuators that require reliable power supply.

The energy storage device 70 is configured to provide the propulsion system 91 with energy. The energy storage device 70 is for example an electric battery that may be recharged with electric energy.

The at least one sensor 39 is configured to provide data about the drive module 30 and its surroundings. For example, the at least one sensor 39 is configured to monitor fuses, voltage levels, battery charging levels and communication with other modules. The sensors 39 may also monitor steering and/or wheel suspension in the drive module 30.

The second control device 200 is configured to operate the drive module 30 as an independently driven unit. The drive module 30 may transport itself without any externally driven unit such as a towing vehicle. The drive module 30 may transport itself by means of the at least one propulsion system 91 . The drive module 30 may be configured to be autonomously operated. Thus, the second control device 200 may be configured to control the operation of the drive module 30. The second control device 200 may be configured to transmit control signals to the various systems and components of the drive module 30 for controlling for example the steering and the propulsion of the drive module 30. The second control device 200 may be configured to operate the drive module 30 autonomously based on received commands. The second control device 200 may thus be configured to receive commands from a remotely located off-board system i.e. the first control device 100, and to convert the commands into control signals for controlling the various systems and components of the drive module 30. The second control device 200 may also be configured to receive data about the drive module 30 and its surroundings from the at least one sensor 39 and based on this data control the drive module 30. The sensor may be configured to monitor the operation and to detect errors in various parts of the drive module 30. For example, sensors may be arranged in the propulsion system 91 , in the braking system, in the energy storage device 70, in the steering system and/or the wheel suspension (not shown) etc. The second control device 200 will be described in further detail in connection with Fig. 5.

The drive module 30 may be configured to be releasably connected to either a second drive module 30 and/or a functional module 40 for forming an assembled vehicle 1 . At least one of the sides 31 , 32, 33, 34, 35, 36 of the drive module 30 may thus have a shape that allows the drive module 30 to be releasably connected to the second drive module 30 and/or the functional module 40.

The at least one interface 50 of the drive module 30 is configured to physically connect the drive module 30 with a second drive module 30 and/or a functional module 40. The interface(s) 50 of the drive module 30 may be releasably connectable to a corresponding interface 50 of a second drive module 30 and/or a functional module 40.

In Fig. 1 the drive modules 30 are illustrated with only one interface 50, on one side of the drive module 30. However, it is to be understood that each drive module 30 may comprise a plurality of interfaces 50 for releasable connection with other modules 40. The interface(s) 50 of the drive modules 30 may be arranged on different sides of the drive module 30 and thus enable connection with other modules 30, 40 on multiple sides of the drive module 30. The interfaces 50 on the drive modules 30 and the functional modules 40 respectively, are arranged on corresponding positions to enable connection between the modules 30, 40.

In some embodiments, the second control device 200 of the drive module 30 is configured to communicate with an additional control device e.g. a control device 300 of a functional module 40 being part of the same vehicle 1 . A functional module 40 may thus comprise a control device, which is referred to as a third control device 300. In some embodiments, the second control device 200 of the drive module 30 is configured to communicate with the first control device 100. This is illustrated in Fig. 4 where the dashed lines illustrate communication between the control devices 100, 200, 300. This communication may be implemented in different ways.

In some embodiments, the at least two interfaces 50 comprises electric interfaces, arranged for transferring electric power and/or transmitting electric signals between the drive module 30 and another module e.g. to a functional module 40 to which the drive module is connected.

The electrical interface 50 may be a wired interface or a wireless interface 50, such as a conductive interface 50. In other words, by connecting the drive module 30 and the functional module 40 electrically the modules 30, 40 may transfer power between each other and share information. The drive module 30 may, for example, control parts of the functional module 40, such as opening and closing of doors, heating and cooling. Electric power and/or electric signals may also be transmitted via one module further to a further module. In other words, one drive module 30 of the modular vehicle 1 may transmit electric power and/or electric signals via a functional module 40 and further to another drive module of the same vehicle 1 , as illustrated by the connection 51 in Fig. 1 . Thus, the connection 51 comprises e.g. at least one of a cable, bus or electrical line.

In some embodiments, the communication between the modules 30, 40 is implemented using remote wireless communication, e.g. radio communication. The wireless communication may be directly between the modules or via the off-board system (i.e. first control device 100). The modules 30, 40 of an assembled vehicle may communicate with each other and/or the first control device via 4G, 5G, V2V (Vehicle to Vehicle), Wi-Fi or any other wireless communication means.

In some embodiments, the drive module 30 is associated with a registration number. The drive module 30 may thereby be regarded an independent vehicle. In the case where an assembled vehicle 1 comprises two drive modules, each drive module is associated with a distinct registration number. The first control device 100 may determine which of the drive modules 30 should show (or announce) its registration number. If the assembled vehicle 1 comprises two drive modules, the first control device 100 may appoint one drive module to be master drive module and the other to be slave drive module. Typically, the master drive module will be commanded to announce its registration number and the slave drive module will not show its registration number. The first control device 100 may thus transmit instructions regarding the registration number of the master drive modules to the second control devices 200 one or more of the of the other drive modules 30 in the set of modules 20.

In some embodiments, the first control device 100 is configured to determine a configuration and operations for an assembled vehicle 1 based on a mission (or function) to be performed by the assembled vehicle 1 , and to transmit the determined configuration to a second control device 300 being appointed to be a master drive module. The master drive module will then control the operation of the vehicle 1 while performing the mission.

The proposed solution will now be explained with reference to the flow chart of Fig. 7. As described above, this disclosure proposes a method for configuring a vehicle 1 , such as the vehicle 1 illustrated in Fig.1 to Fig. 4.

However, even though reference is herein made to the vehicle 1 illustrated in Fig.1 to Fig. 3, it must be appreciated that the proposed method may be used for controlling any vehicle comprising at least two drive modules configured to be autonomously operated as independent drive modules, where one of the at least two drive modules is configured to operate as a master drive module and the other (or others) are configured to operate as slave drive modules.

The method may be implemented as a computer program comprising instructions which, when the program is executed by a computer (e.g. a processor in a second control device 200 (Fig. 5)), cause the computer to carry out the method. According to some embodiments the computer program is stored in a computer-readable medium (e.g. a memory or a compact disc) that comprises instructions which, when executed by a computer, cause the computer to carry out the method.

The proposed method will now be described while performed by a second control device 200 of a slave drive module or a master drive module of the vehicle 1 . However, it must be appreciated that the method may alternatively, at least partly, be implemented in the first control device 100 or third control device 300 of the vehicle or the implementation may be distributed among any or all of the control devices 100, 200, 300.

The method is typically performed continuously or periodically during normal vehicle operation. The method comprises monitoring S1 a functionality of the master drive module. Functionality is e.g. driving functionality, physical properties, software functionality etc. More specifically, the functionality refers to the ability of the master drive module to perform its tasks e.g. tasks related to performing a mission. In other words, the functionality of the master drive module is monitored during operation. This may be done in many different ways, e.g. by monitoring hardware, software or driving as will be apparent by the examples below.

If an error is detected during the monitoring, then the master drive module is “exchanged”, and another master drive module is appointed or assigned. In other words, the method further comprises, upon determining S2 an error condition in the functionality of the master drive module, re-configuring S4 one of the slave drive modules to operate as a master drive module and re-configuring the master drive module to operate as a slave drive module.

Different examples of monitoring S1 and determining S2 an error condition in the functionality will now be described in further detail. Note that the different ways of monitoring S1 and determining S2 may be combined for increased security.

In some embodiments, the monitored functionality is the functionality of a processor and operation system of the master drive module. In other words, in some embodiments, the determining S2 comprises receiving an error command or detecting a software error indicative of an error condition. The master drive module may e.g. send error commands to the slave modules when a software error or communication error is detected in the second control device 200 of the master drive module. One example of a software error is expiry of a watchdog timer surveilling a system of the master drive module e.g. a battery system, an autonomous driving system, a propulsion system etc. A watchdog timer is an electronic timer that is used to detect (and recover from) computer malfunctions. During normal operation, the computer regularly resets the watchdog timer to prevent it from elapsing, or "timing out". If, due to a hardware fault or program error, the computer fails to reset the watchdog, the timer will elapse and generate a timeout signal. The timeout signal may serve as an indication of an error condition in the corresponding system.

Furthermore, a“heart-beat” periodically transmitted from the master drive module to the slave drive modules (and/or the off-board system) is in some embodiments continually monitored by the slave drive module(s), to make sure that the master drive module is alive. A missing heart beat may indicate that there is a software error in the master drive module or that the communication between the master drive module and the slave drive module is interrupted. In some embodiments, the determining S2 an error condition comprises detecting a missing heartbeat or a communication error.

Alternatively, or in addition, hardware properties of the master drive module 1 are monitored. Examples of hardware that are relevant to monitor is the battery, steering, wheel suspension, engine etc. Some hardware errors may be monitored by dedicated sensors 39 in the master drive module, which are typically monitored during operation of the vehicle 1 . For example, internal voltages, internal currents above or below a certain threshold could e.g. be an indication of a hardware error in the master drive module. In some embodiments, the master drive module may send a message to the slave modules informing about such an error. Alternatively, the master drive module may re-configure itself when a hardware error is detected. In other words, in some embodiments, the determining S2 of an error condition comprises detecting abnormal sensor data, a broken fuse, an abnormal voltage level, an error in the wheel suspension or an abnormal battery charging level.

Another possibility is to monitor the autonomous driving of the vehicle 1 , which is controlled by the master drive module. While operating a modular vehicle, the master drive module will typically receive a mission to be performed and then determine how to drive the vehicle 1 to perform the mission. For example, driving parameters for the mission, such as speed of the vehicle, propulsion torque and/or the steering, are determined by the master drive module. These driving parameters may be compared to reference data. In some embodiments, the reference data is static. For example, driving that deviates significantly from reference driving parameters, or driving parameters obtained from of a mathematical model could be an indication of an error. Also, abnormal (e.g. jerky or irregular) driving behavior might be an indicator that something is wrong. In other words, in some embodiments, the determining S2 comprises determining the error condition by comparing driving parameters calculated and/or determined by the master drive module with reference data.

The reference data may alternatively be dynamic e.g. it may be determined e.g. by the master drive module, based on the current mission. For example, if the vehicle 1 is supposed to travel a very short distance, then a high speed or high propulsion torque would be suspicious. For example, while re-arranging the modules 30,40 to assemble the modular vehicle 1 , the speed should not exceed 10 km / h.

Another possibility is to obtain reference data by letting the slave drive module perform the same or similar estimations or calculations as the drive module. As the master drive module and the slave drive modules typically have the same or similar capability, one option is to also let the slave drive modules also determine how to drive the vehicle 1 to perform the mission, at least partly. One may then compare the calculations performed by the different drive modules 30. In other words, in some embodiments, the reference data comprises corresponding driving parameters calculated and/or determined by one of the slave drive modules. In some embodiments, the method also comprises obtaining SO the reference data from the slave drive module. For example, the first control device 100 or the master drive module, receives driving parameters from one or more slave drive modules. Deviations between those calculations may then be an indication of an error. Alternatively, the master drive module may send driving parameters or other calculations to the slave drive module, for comparison to reference data in the slave drive module.

When a new master drive module is appointed, the old drive module will be assigned to be a slave drive module. However, as there is a potential error in the old slave drive module further measures may be taken to assure that the error does not affect the driving of the vehicle. One possibility is to center or declutch the wheels of the old master drive module to assure that the maneuverability of the vehicle is not affected by the error. In other words, in some embodiments, the drive modules comprise wheels 37 and the re-configuring comprises configuring the wheels of a slave drive module in order not to affect maneuverability. If the method is performed in the master drive module, then the master drive module may perform this re-configuration when it hands over control to a slave drive module. If the method is performed in a slave drive module or in the off-board system, then the re-configuring comprises instructing the old master drive module, which is now a slave drive module, to configure its wheels in order not to affect maneuverability of the vehicle 1 , or at least to affect it as little as possible. This may e.g. be done by the drive module configuring its wheels to be in a“neutral” position e.g. straight forward, instead of configuring the wheels as would the drive module have been a master drive module. The re-configuring may either be triggered directly by hardware e.g. by an actuator triggered by a press loss in a hydraulic control system or a power failure in an electric control system. An option would be to configure software to cause the wheels to be centered upon the detection of an error condition.

As mentioned above, the proposed method may be performed in different parts of the system 400. In some embodiments, the error condition is detected by a control device 200 of one of the drive modules 30 (i.e. a second control device 200), e.g. in a slave drive module. Then the re-configuring S4 comprises that the slave drive module takes over control from the master drive module. For example, the re- configuring comprises instructing the master drive module to give up control. Typically, the off-board system is also informed about which drive module is the new master drive module.

However, for example for security reasons, it is not always desirable to let the slave drive module have mandate to take over without approval from another unit. Hence, an approval from e.g. the off-board system (i.e. the first control device 100) may be required. Hence, if a slave drive module detects an error condition in the functionality of the master drive module, then it may send a request to the first control device 100 to take over and become the master drive module. In other words, in some embodiments, the method comprises receiving S3 by the drive module 30 detecting the error, from an off-board control device, an approval to re- configure the master drive module. Another possibility is that the slave drive module requests the first control device to assign a new master drive module when an error in the master drive module is detected.

The proposed method may alternatively be performed by an off-board system i.e. by the first control device 100. The monitoring S1 then typically comprises receiving information from the drive modules 30 (or more specifically from the second control devices 200 of the drive modules 30). For example, the drive modules may send information about error commands to the first control device 100, informing the first control device 100 about any of the error conditions mentioned above. Another possibility is that there is a continual communication between the first control device 100 and the second control device 200 of the master drive module of the vehicle 1 , such as a heart-beat. If the heart beat is interrupted for a certain time period, then the off-board system may re-configure a new master drive module, in an attempt to re-establish communication. In other words, a new master drive module may be appointed if communication is interrupted. Another possibility is to let the off-board system compare calculations performed by the master drive module and reference data, in a similar way as described above. In some embodiments, the determining S2 and the re-configuring S4 is performed by the master drive module or in an off-board system. Then the decision may be made without any approval. More specifically, the master drive module or the off- board system may simply inform one of the slave drive modules that the one slave drive module now is the master drive module. In other words, in some embodiments the re-configuring comprises instructing one of the slave drive modules to become a master drive module. If the re-configuring is performed by the master drive module, then the off-board system is typically informed that a new master drive module is now appointed.

The proposed solution is applicable on all sorts of road vehicles. However, the disclosure may relate to heavy vehicles, such as buses, trucks etc. Specifically, the present disclosure may relate to vehicles for use on public roads.

Now turning to Fig. 5 which illustrates an example implementation a control device configured to implement the proposed method. In this example the control device is embodied as a second control device 200 for use in a vehicle 1 , such as the modular vehicle described in Fig. 1 to Fig. 3. The second control device is either a slave drive module or a master drive module.

In some embodiments, the second control device 200 is a“unit” in a functional sense. Hence, in some embodiments the second control device 200 is a control arrangement comprising several physical control devices that operate in corporation. The second control device 200 comprises hardware and software. The hardware basically comprises various electronic components on a Printed Circuit Board, PCB. The most important of those components is typically a processor 210 along with a memory 220.

The second control device 200 also comprises one or more communication interfaces 230, enabling the second control device 200 to communicate with other modules 30, 40 of the modular vehicle 1 , or of other vehicles. The communication between the modules is as mentioned above wireless, conductive or wired. Wired communication may be implemented standard protocols such as Controller Area Network, CAN. CAN is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other in applications without a host computer. Wireless communication between the modules may be implemented using any short-range communication protocol such as Bluetooth or 802.1 1 .

The one or more communication interfaces 230 is also configured to enable wireless communication with the first control device 100, i.e. with the off-board system. The wireless communication between the second control device 200 and the first control device is e.g. implemented using 4G, 5G, V2V (Vehicle to Vehicle) or any other suitable wireless communication protocol.

The second control device 200, or more specifically the processor 1 10 of the second control device 200, is configured to cause the second control device 200 to perform all aspects of the method described above and below. This is typically done by running computer program code stored in the memory 220 in the processor 210 of the second control device 200.

More particularly, the second control device 200 is configured to monitor a functionality of the master drive module. If the method is performed by the slave drive module, this implies receiving e.g. driving data, sensor data, a heart-beat, an error command or other relevant data, from the master drive module using the communication interface 230.

The second control device 200 is further configured to upon determining an error condition in the functionality of the master drive module re-configure one of the slave drive modules to operate as a master drive module and to re-configure the master drive module to operate as a slave drive module.

In some embodiments, the second control device is configured to determine the error condition by comparing driving parameters calculated and/or determined by the master drive module with reference data. In some embodiments, the driving parameter comprises at least one of propulsion torque, steering angle,

suspension, voltage level. In some embodiments, the reference data comprises corresponding driving parameters calculated and/or determined by one of the slave drive modules.

In some embodiments, the second control device 200 is configured configure the wheels of a slave drive module in order not to affect maneuverability of the vehicle 1 If the method is performed by the master drive module, this implies sending an instruction to the slave drive module using the communication interface 230.

In some embodiments, the second control device 200 is configured to determine the error condition based on a received error command or detecting a missing heartbeat, a communication error or other software error.

In some embodiments, the second control device 200 is configured to detect (or determine) at least one of; abnormal sensor data, a broken fuse, an abnormal voltage level, an abnormal battery charging level or other hardware error.

In some embodiments, the second control device 200 is configured to receive an approval to re-configure the master drive module from an off-board system.

In some embodiments, the second control device 200 is comprised in the slave drive module 30 and the second control device is configured to take over control from the master drive module.

In some embodiments, the second control device, 200 is comprised in the master drive module 30 the second control device is configured to instruct one of the slave drive modules to become a master drive module.

In some embodiments, this disclosure relates to a vehicle 1 , comprising at least two drive modules 30 configured to be autonomously operated as independent drive modules 30. One of the at least two drive modules is configured to operate as a master drive module and the others are configured to operate as slave drive modules, the second control device being configured. The vehicle 1 further comprises a control device 200 configured to (at least partly) perform any or all of the aspects of the method illustrated in Fig. 7. Now turning to Fig. 6 which illustrates another example implementation a control device configured to implement the proposed method. In this example the control device is embodied as a first control device 100, i.e. in an off-board system.

In some embodiments, the first control device 100 is a“unit” in a functional sense. Hence, in some embodiments the first control device 100 is a control arrangement comprising several physical control devices that operate in corporation. The first control device 100 comprises hardware and software. The hardware basically comprises various electronic components on a Printed Circuit Board, PCB. The most important of those components is typically a processor 1 10 along with a memory 120.

The first control device 100 also comprises a communication interface 130, enabling the first control device 100 to communicate with the modules 30, 40 of the modular vehicle 1 and with other external entities such as traffic systems etc. The communication interface 130 e.g. enables internet connection. The communication of the first control device 100 is e.g. implemented using Internet Protocol, IP.

The first control device 100, or more specifically the processor 1 10 of the first control device 100, is configured to cause the first control device 100 to perform all aspects of the method described above and below. This is typically done by running computer program code stored in the memory 120 in the processor 1 10 of the first control device 100.

More particularly, in some embodiments, the first control device 100 is configured to to monitor a functionality of the master drive module, and to upon determining an error condition in the functionality of the master drive module re-configure one of the slave drive modules to operate as a master drive module and re-configuring the master drive module to operate as a slave drive module. More specifically, the first control device 100 sends an instruction to one of the drive modules (or more specifically to a second control device 200 of one of the drive modules 30), e.g. to a new drive module of the vehicle 1 to re-configure itself as being a master drive module. In some embodiments, the first control device 100 is also configured to inform the other drive modules 200 about the change in master drive module.

The monitoring and the determining of an error condition are then performed in a similar way as when performed by the second control device 20, with the difference that the first control device 100 needs to receive required data from the master and slave modules using the communication interface 130.

The terminology used in the description of the embodiments as illustrated in the accompanying drawings is not intended to be limiting of the described method; control arrangement or computer program. Various changes, substitutions and/or alterations may be made, without departing from invention embodiments as defined by the appended claims.

The term“or” as used herein, is to be interpreted as a mathematical OR, i.e. , as an inclusive disjunction; not as a mathematical exclusive OR (XOR), unless expressly stated otherwise. In addition, the singular forms "a", "an" and "the" are to be interpreted as“at least one”, thus also possibly comprising a plurality of entities of the same kind, unless expressly stated otherwise. It will be further understood that the terms "includes", "comprises", "including" and/ or "comprising", specifies the presence of stated features, actions, integers, steps, operations, elements, and/ or components, but do not preclude the presence or addition of one or more other features, actions, integers, steps, operations, elements, components, and/ or groups thereof. A single unit such as e.g. a processor may fulfil the functions of several items recited in the claims.

Claims

1. A method, performed by a control device (100, 200) for configuring a vehicle (1 ), comprising at least two drive modules (30) configured to be autonomously operated as independent drive modules (30); wherein one of the at least two drive modules is configured to operate as a master drive module and the others are configured to operate as slave drive modules, the method comprising:

- monitoring (S1 ) a functionality of the master drive module, and upon determining (S2) an error condition in the functionality of the master drive module:

- re-configuring (S4) one of the slave drive modules to operate as a

master drive module and re-configuring the master drive module to operate as a slave drive module.

2. The method according to claim 1 , wherein the determining (S2) comprises determining the error condition by comparing driving parameters calculated and/or determined by the master drive module with reference data.

3. The method according to claim 2, wherein the driving parameter comprises at least one of propulsion torque, steering angle, suspension, voltage level.

4. The method according to claim 2 or 3, wherein the reference data comprises corresponding driving parameters calculated and/or determined by one of the slave drive modules.

5. The method according to any of the preceding claims, wherein the drive

modules comprise wheels (37) and wherein the re-configuring comprises configuring the wheels of a slave drive module in order not to affect

maneuverability of the vehicle (1 )

6. The method according to any of the preceding claims, wherein the determining (S2) comprises receiving an error command or detecting a missing heartbeat, a communication error or other software error indicative of an error condition.

7. The method according to any of the preceding claims, wherein the determining (S2) an error condition comprises detecting at least one of; abnormal sensor data, a broken fuse, an abnormal voltage level, an abnormal battery charging level or other hardware error.

8. The method according to any of the preceding claims, wherein the error

condition is detected by a control device (200) of one of the drive modules (30), and wherein the method comprises:

- receiving (S3) by the drive module (30) detecting the error, from an off- board control device, an approval to re-configure the master drive module.

9. The method according to any of the preceding claims, wherein the determining (S2) and the re-configuring (S4) is performed by the master drive module or in an off-board system, and wherein the re-configuring comprises instructing one of the slave drive modules to become a master drive module.

10. The method according to any of the preceding claims, wherein the determining (S2) and the re-configuring (S4) is performed by one of the slave drive modules and wherein the re-configuring comprises the slave drive module taking over control from the master drive module.

11. A control device (100, 200) configured to control a vehicle (1 ), comprising at least two drive modules (30) configured to be autonomously operated as independent drive modules (30); wherein one of the at least two drive modules is configured to operate as a master drive module and the others are configured to operate as slave drive modules, the control device being configured

- to monitor a functionality of the master drive module, and to

upon determining an error condition in the functionality of the master drive module: - re-configure one of the slave drive modules to operate as a master drive module and re-configuring the master drive module to operate as a slave drive module.

12. The control device (100, 200) according to claim 1 1 , wherein the control

device is configured to determine the error condition by comparing driving parameters calculated and/or determined by the master drive module with reference data.

13. The control device (100, 200) according to claim 12, wherein the driving

parameter comprises at least one of propulsion torque, steering angle, suspension, voltage level.

14. The control device (100, 200) according to claim 12 or 13, wherein the

reference data comprises corresponding driving parameters calculated and/or determined by one of the slave drive modules.

15. The control device (100, 200) according to any one of claims 1 1 to 14, wherein the control device (100, 200) is configured configure the wheels of a slave drive module in order not to affect maneuverability of the vehicle (1 )

16. The control device (100, 200) according to any one of claims 1 1 to 15, wherein the control device (100, 200) is configured to determine the error condition based on a received error command or detecting a missing heartbeat, a communication error or other software error.

17. The control device (100, 200) according to any one of claims 1 1 to 16, wherein the control device (100, 200) is configured to detect at least one of; abnormal sensor data, a broken fuse, an abnormal voltage level, an abnormal battery charging level or other hardware error.

18. The control device (200) according to any one of claims 1 1 to 17, wherein the control device (200) is comprised in one of the one or more drive modules and wherein the control device (200) is configured to receive an approval to re- configure the master drive module from an off-board system.

19. The control device (200) according to any one of claims 11 to 18, wherein the control device (200) is comprised in the slave drive module (30) and wherein the control device is configured to take over control from the master drive module.

20. The control device (100, 200) according to any one of claims 11 to 17, wherein the control device (100, 200) is comprised in the master drive module (30) or in an off-board system, and wherein the control device is configured to instruct one of the slave drive modules to become a master drive module.

21. A computer program comprising instructions which, when the program is

executed by a control device, cause the control device to carry out the method of any one of the claims 1 to 10.

22. A computer-readable storage medium comprising instructions which, when executed by a control device, cause the control device to carry out the method of any one of the claims 1 to 10.

23. A vehicle (1 ) comprising the control device (200) according to any of claims according to claim 11 -19.