Functional safety management of torque vectoring on the Lotus Evora 414E Hybrid.
The powerful (1,000 Nm) torque vectoring driveline of the Lotus 414E has the potential to improve the vehicle ‘s dynamic response and stability but also creates some potential hazards, for example, a fault in the system which generates incorrect torque on one or both rear wheels could disturb the vehicle’s intended path.
This is one of many potential hazards identified by Lotus as part of the integration and development of the 414E functional safety control strategies.
What is functional safety?
Safe operation of the vehicle requires the hardware and system to be operating correctly in response to its inputs, including the safe response to hazards caused by the environment, driver, hardware or control system.
A safety function needs to be put in place (within the control systems) to address and mitigate each identified potential hazard. Functional safety is achieved when every identified safety hazard has a function in place and meets the level of performance required
Lotus uses virtual and hardware in the loop (HiL) testing to identify, simulate and prove out the functional safety control systems, in advance and support of physical testing.
What is virtual testing?
Traditionally each engineering function group develops its own hardware and systems, and tests them in isolation. Integration and commissioning starts when the individual systems are connected in an engineering prototype car and only then can the vehicle development process start refining the performance and safety functions. This process is long and costly as some issues found during development may require new hardware to be built and then integrated into the engineering prototypes.
With a virtual testing process each function group contribute computer data models (as they are developed) of their components (e.g. Simulink, C , Dymola or Simpack). These models are combined within a virtual workshop into virtual vehicles. This data modelling stage helps resolve cross functional issues much earlier, and as individual components are tested, refined and proven the virtual prototype vehicle can be continuously tested with the new components.
This process is known as model in the loop (MiL) testing and can be conducted entirely on a computer.
These virtual vehicles can then be simulated on virtual roads and circuits by both virtual and real drivers, bringing the test track to the desk of every engineer. This enables the vehicle control system development to progress before building the first prototype vehicle.
This parallel process not only shortens the development time and results in a more robust solution, it can identify design changes early enough to be incorporated in the final release.
Any industry standard test like lane change, real driving route or bespoke manoeuvre can be simulated and any particular hazard can be programmed to occur during these tests to see how the system reacts. Even extreme tests, not feasible or safe for the real vehicle can be carried out in the virtual environment, and thousands of tests, varying vehicle or test parameters, can be carried out in hours and repeatedly re-run as required.
The raw data models have to be compiled (effectively compressed) for use in the production ECUs (electronic control units). Electrical interfaces can then link the physical ECUs to the virtual vehicle model and in this way the real hardware can be used as part of the virtual vehicle simulation as if it was being driven in a real vehicle.
This is known as hardware in the loop (HiL) and is another important part of the Lotus virtual testing toolbox.
Virtual testing on the 414E
The software toolbox we use is based on the IPG CarMaker software system which provides a flexible platform for building the vehicle with roads, manoeuvres, a driver model and automated test manager.
In addition to the data models supplied with the software, any additional models can be added (e.g. a vehicle dynamic control system) or can be substituted by another model (e.g. a bespoke powertrain model).
This is complemented by the HiL system in which the 414E controllers “in the Loop” operate exactly as they would do in the real car, thus testing both the code and communications between controllers.
To support early development of algorithms, both on the bench and later in the first prototypes, Lotus uses a very powerful ’rapid prototyping” system allowing the control algorithms still in their raw data model form to control the vehicle. This speeds up both development of the algorithm and early prototype development as modifications can be incorporated “on the fly” by the test engineers.
Functional Safety of the 414E
Each rear wheel of the 414E is separately driven by powerful axial flux electric motors. This gives the opportunity for controlled torque vectoring to enhance the vehicle’s agility and stability, but presents some potential hazards and control challenges for the four Lotus ECUs. Lotus identified potential hazards and driving situations, with associated ASIL (automotive safety integrity level) functional safety ratings for the 414E vehicle applicable to its restricted use on the test track by skilled drivers.
Pass/fail criteria similar to those used in developing ESC (electronic stability control) were agreed, principally being a large change in yaw rate which the driver would find difficult to control and hazards where the driver would not be able keep the vehicle in lane.
Methods to identify when faults occur, and strategies to mitigate their effects on the vehicle, were developed and programmed.
Virtual test routines to establish effectiveness of mitigation were run to simulate these hazards and evaluate the effectiveness of these strategies.
There are numerous variables that need to be tested, these included Lotus mitigation switched on or off, ESP on or off, different speeds and road friction levels, straight line, curves of different radii and open and closed loop virtual drivers.
The open loop driver gives no or minimal steering correction whereas the closed loop driver simulates a typical skilled driver attempting to maintain control. Depending on the system speed of response, the driver can sometimes make the situation worse.
For the 414E, virtual testing involved 61 automated scenarios resulting in a total of over 2,700 test runs. The fidelity, plausibility and calibration of each of the data models is correlated as far as possible, using real world testing on the Lotus track and in Lotus test laboratories. Test manoeuvres and pass criteria were automated allowing rapid and repeatable testing. Log files recorded key data from each test. The Status of the test (passed, failed or aborted) is automatically reported in a “traffic light” system.
To further improve interpretation of the tests the logged data was used to populate a matrix which quickly showed not only if there was a the failure to meet the criteria, but which criteria failed and its severity.
As development progresses
Lotus virtual testing can help integrate systems, develop the potential effectiveness of mitigation strategies and help pre-empt cross system conflicts ahead of prototype running for safer and quicker vehicle development.
The 414E program is now carrying out dynamic and durability testing with a prototype vehicle, incorporating the functional safety control strategies developed using virtual and HiL testing.
Virtual testing helped to define the testing schedule for the real vehicle and virtual testing continues to run in parallel with the 414E development, as the data models are refined with feedback from the real-world data to help improve its not only the functional safety but also performance and economy.
Authors: Richard Hurdwell and James Waters