Advanced Redundancy Technology for a Drive System Using In-Wheel Motors

In electric vehicles that use in-wheel motors, the right and left traction forces become unbalanced if a motor malfunctions by motor lock or loss of traction, generating yaw moment. Control methods were designed to reduce this effect by stopping the motor output on the opposite side of the same axle. By using a prototype “Eliica” car, the maximum yaw rate and lateral acceleration were compared for a breakdown of one motor with the results from the “Sensitivity to lateral wind” indicated in Z108-76 of the Japanese Automobile Standards Organization. Under redundancy control, the test results were confirmed to be below the tolerance limits


INTRODUCTION
Several prototype electric vehicles (EVs) with motors installed in each wheel that exploit the torque characteristics of the in-wheel motor [1] have been developed by KEIO University.Unlike an internal combustion engine, an electric motor can generate maximum torque from standing still to a high speed.
The purpose of our research is to develop redundancy technology for the drive system of EVs that use in-wheel motors by constructing a control method for use in the case of motor malfunction, that optimizes the composition of the drive system parts to maintain the vehicle's advantages and safety.
An EV that uses in-wheel motors has the following three advantages: 1) The freedom of the car's design increases because the motor is excluded from the usual engine compartment.As a result, a vehicle body shape with low air drag and excellent collision safety can be achieved comparatively easily.
2) The independent direct control of the traction force of each wheel can be used for such applications as traction control and dynamic stability control with excellent results [2].
3) When one motor breaks down, driving can continue with the other motors.
The third advantage in particular is achieved in EVs of the in-wheel motor type, in which two or more motors are installed.On the other hand, in such an EV, the right and left traction forces become unbalanced if one motor breaks down and yaw moment is generated in the z-axis, which passes through the center-of-gravity point (CG) of the vehicle.Therefore, a control method for the situation in which a motor breaks down is important for achieving redundancy for a drive system that uses in-wheel motors.
Our intention is to enhance the merits of function and safety of EVs by achieving a redundancy technology for drive systems that use in-wheel motors.
First in this report, the influence on vehicle stability by a motor malfunction is described.Next, the results of a fault tree analysis (FTA) of the case in which the right and left traction forces become unbalanced are presented.Then, based on these results, an optimum formation of a drive system that uses in-wheel motors and a control method of redundancy technology are proposed.Finally, by using a prototype vehicle "Eliica" which these technologies were added, the utility of this study was evaluated.

INFLUENCES ON VEHICLE STABILITY BY UNBALANCED TRACTION FORCES
Figure 1 shows the vehicle model of the eight-wheel-drive (8WD) Eliica.The 8WD has nearly the same dynamics as 4WD, the difference being that 8WD has four axles, which are numbered 1 through 4 from the front, and the first two axles are steered.
The cornering forces and the traction forces that occur on each tire are defined as shown in the figure as C fl1 , C fr1 , C fl2 , C fr2 , C rl1 , C rr1 , C rl2 , C rr2 , and T l1 , T r1 , T l2 , T r2 , T l3 , T r3 , T l4 , T r4 , respectively.The yaw moment generated around the z-axis at the CG can be expressed by equation 1.It can be seen that the right and left traction forces become unbalanced if one motor malfunctions by motor lock or loss of traction and yaw moment is generated.As a result, vehicle stability may deteriorate.while accelerating, if the traction force of a motor on one side is lost, yaw moment of about 1700 Nm is generated.On the other hand, if a malfunction by motor lock occurs, the influence of the braking force from the tire causes the vehicle stability to deteriorate compared to a malfunction by loss of traction.If it is assumed that the coefficient of friction between the tires and the test road is 1.0, yaw moment of about 4400 Nm occurs if a motor locks on one side.The maximum torque that the Eliica can handle at 100 km/h is 90 Nm.

ANALYSIS OF BREAKDOWN FACTORS THAT CAUSE UNBALANCED TRACTION FORCES
1 The factors that would cause the right and left traction forces to become unbalanced were analyzed by fault tree analysis (FTA), which is a recognized technique to anatomize quantitatively over the entire system the breakdown factors leading to a specified defect phenomenon.Figure 2 shows the resulting fault tree.
The following three defect incidents were identified: 1) The traction force of a wheel on one side is lost by a malfunction of the motor or the inverter.
2) The motor output of a wheel on one side is limited by a temperature increase of the motor or the inverter.
3) A wheel on one side is locked by a stuck reduction gear, bearing, or brake.
Furthermore, the basic phenomena that lead to these defects were analyzed.A basic phenomenon is a top-level breakdown factor.These are shown within circle symbols in the figure .The purpose of FTA is to optimize the design of the basic phenomena so that the top-level breakdown probability is zero.However, as good as that design may be, there is a need to realize a redundancy control that can allow continued safe driving if a top-level breakdown occurs.To achieve this, the next chapter examines methods to control the above three defect phenomena caused by top-level breakdowns.

REDUNDANCY TECHNOLOGY FOR THE DRIVE SYSTEM
In this chapter, first the drive-system components of an EV using in-wheel motors are compared with those of a conventional EV, and the system composition that is most suitable for EVs is suggested.Next, methods to control the defect phenomena that lead to unbalanced right and left traction forces that are inextricably linked to the system hardware composition are proposed.

Optimization of the Drive-System Components
Figures 3 and 4 show the compositions of the drive systems of conventional EVs and of the Eliica [3].The drive system of a typical EV consists of one motor, an inverter, and a pair of batteries, which are all controlled by a single control unit.On the other hand, the advantage of the 8WD Eliica, with eight in-wheel motors, is that it can continue driving unless all motors break down.However, it is necessary for the inverter, batteries, and vehicle controller to be made redundant so that the multiple motors can be advantages.
As shown in Figure 4, a pair of batteries supplies two inverters on the same axle, and a vehicle controller controls each pair of front and rear axles.In addition, to govern the two vehicle controllers, a management device was created.If a battery fails, the drive can continue in 6WD.Moreover, yaw moment is not generated, because the power supplies to the motors on the same axle are shut at the same time.The processing contents of the two vehicle controllers are installed in the management device.The management device verifies the control contents of the two vehicle controllers, and if the vehicle controllers are not in accord, the control is separated and the vehicle continues running by 4WD.With the minimum 2WD, Eliica can satisfy a standard value of acceleration and slope ability defined in a technical standard for a vehicle.
Error detection and torque control of a motor are the roles of an inverter, and the monitoring and ordering of an inverter are the duties of a vehicle controller.Therefore, if the communication speed between vehicle controllers and inverters is slow, control after detection of trouble is late, and sufficient deterrent of yaw moment is not provided.For this research, a Controller Area Network (CAN) with fast transmission speed and superior reliability was adopted.The two-headed arrows in Figure 4 show the machinery connected in CAN.The single-headed arrows indicate serial communication (RS232C).Multiple devices are connected to CAN on the same bus, and messages are transmitted by unique ID.By using this system, an ID system exclusively for torque order was made, so the torque order value from a vehicle controller could be transmitted to each inverter at the same time.In addition, by using CAN, the communication state is watched with hardware.Therefore, there is less CPU load in comparison with serial communication.By adopting CAN as the communication method and dividing the vehicle controller into two, a complete redundancy control in less than 10 ms after the two vehicle controllers detect a malfunction of a motor was achieved.Here, redundancy of the drive system components is provided by the hardware composition.

Redundancy Control Methods in the Event of a Motor Malfunction
This section explains the redundancy technology for control of the three defect phenomena when right and left traction forces become unbalanced.The FTA analysis in chapter 3 revealed these phenomena, which cannot be controlled by only using hardware composition.

Redundancy Control Methods
The first redundancy control method is for when the traction force of a wheel on one side is lost, for which the breakdown factors are usually from malfunctions of  However, the vehicle controllers of Eliica are divided to control each of the four motors on the front and rear axles independently.In addition, calculation of the torque to instruct each motor becomes complicated because the treads are different between the front and rear axles.Therefore, Plan A was measured because of the stand point of simplicity and controllability.
The second redundancy control method is for when a motor's output is limited.An inverter limits a motor's output by a temperature rise of the motor or inverter, or by a drop of input voltage to the inverter.The vehicle controller converts the torque instruction based on the accelerator signal and sends the value to all inverters.Ideally, all inverters should limit the output of their respective motors by the same timing, but in reality this varies because of different precisions of individual temperature sensors, A/D converters, and so on.As a result, the right and left traction forces become unbalanced.When a motor's output is limited, a flag is turned on at the limit of the motor's output and actual torque that is set in the inverter's messages by CAN communication.When the flag is on, a vehicle controller compares the actual torques of the four inverters with the instruction torque, and calculates the limit applied, and instructs smaller torque on the motor on the same axle.
The third redundancy control method is for when a motor on one side becomes stuck.A motor sticks when the reduction gears of the motor, the bearings, or the brakes become stuck.A vehicle controller watches the error flags and the rotational speeds of the four motors by using CAN information from the four inverters.If the rotational speed of either motor becomes zero and the vehicle controller judges it to be stuck, it stops the opposite motor on the same axle.A vehicle controller does not stop a normal motor on the same axle and should provide regenerative braking if equation 1 is obeyed.However, there was a tendency for the yaw rate and lateral acceleration to become worse than for a state without control as a result of this evaluation, when regenerative braking was applied during cornering.Therefore, a control method to stop the traction force was adopted.

Flow Chart of the Control Algorithm
Figure 5 shows a flow chart of this control algorithm.First, the vehicle controller diagnoses the state of each device when the ignition switch is turned on.If errors are not detected, the vehicle becomes READY.In STEP 1, the vehicle controller reads the state of the shift switch in 'NEUTRAL' position.When a shift position of 'DRIVE' or 'REVERSE' is chosen, the process advances to STEP 2.

Fig. 5 Flow chart of redundancy control
In STEP 2, the vehicle controller reads the position of the accelerator and calculates the instruction torque to be sent to the inverters with a previously programmed conversion table.
In STEP 3, the vehicle controller reads data, including the maximum and minimum cell voltage, the cell temperature, the state of charge (SOC), and any error codes from the management units of the four pairs of batteries, then it diagnoses any malfunctions.If the vehicle controller detects a malfunction of the batteries, it stops driving the inverter connected to the broken pair of batteries and shuts down the circuit.
In STEP 4, the vehicle controller reads data, including the actual torque, temperatures of the motors and inverters, rotational speeds, and any error codes from the inverters, then judges whether there are any malfunctions of the motors and inverters.The actual torque is calculated by multiplication of a torque constant that is particular to a motor and the phase current of the motor.
If the vehicle controller detects a malfunction of the motors or inverters, it specifies the cause of the problem with error codes.If a motor on one side becomes stuck or loses traction force, the opposite motor on the same axle is stopped.If a motor's output on one side becomes limited, the vehicle controller has the opposite inverter limit the torque to the maximum that its motor can produce at that moment.
Finally in STEP 5, if trouble was not detected, it just transmits the torque conversion value determined at STEP 2. If a problem is detected, the torque conversion value found in STEP 2 is divided by the coefficient of motor torque (Ct), where Nm is the number of inoperative motors, and the calculated instruction torque is sent to the working inverters.This procedure insulates the driver from problems with the acceleration in the event of a malfunction.It results in sustaining the acceleration when the accelerator is pressed that is equivalent to the usual acceleration of 0.2g that is frequently experienced in city driving, although the maximum acceleration is less than normal.In addition, in the same way as the acceleration while cruise control, the torque lost with a malfunctioning motor is distributed to the other normal motors by a feed-forward control.

EVALUATION
By using a prototype "Eliica" car, in which these technologies were installed, a running test was executed to evaluate the redundancy of the drive system by combining the method for controlling motor malfunctions and the composition of the car's driving system [4].The Eliica is an EV powered by lithium-ion batteries.Its acceleration time from 0 to 100 km/h is only 4.11 s, much better than the poor acceleration performance that had been long assumed to be characteristic of EVs [3].
Figure 6 shows the exterior and Table 1 the specifications of the Eliica.

Experimental Procedure
The system was evaluated on a straight track and on a track with a turn of radius 200 m under the following conditions: 1) Upon reaching 100 km/h while accelerating (maximum acceleration 0.68g).
2) While running at 100 km/h constant speed.
Under each of these conditions, the yaw rate, steering angle, longitudinal acceleration, lateral acceleration, instruction torque, and actual torque after generating a motor malfunction (loss of traction or motor lock) in either the first or fourth axle on the right were measured.The velocity is measured by a GPS speed meter (RACELOGIC Ltd, VBOX2), which is also a data logger, the yaw rate and the acceleration rate are measured by X-Y axes acceleration transducers with gyro (RACELOGIC Ltd, YAW02), and the steering angle is measured by encoder steering angle sensor (SOHGOH KEISO Co. Ltd, TA-382BS).The gyro and the steering angle sensor were connected to the VBOX2.The torque signal value and the actual torque were measured by a protocol monitor (LINEEYE Co. Ltd, LE7200), which looks at the messages between the main control unit and the inverter.Also, the phase current was measured to estimate the actual motor torque Tm by using the equation 3, which is theoretical formula of the motor.
A prior test result showed that a malfunction of the left motor had a similar effect one in the right motor.In addition, a motor malfunction in the second or third axle was taken to have the same effect as one in the first or fourth axle.
A motor malfunction was generated at a chosen time by a switch installed on the instrument panel.After a failure, the car was steered as smoothly as possible to hold the lane, and the accelerator or the brakes were maintained in the same state for a while.
The defect phenomenon of limited output of a motor on one side is not included in this paper, because the effect is smaller than the loss of traction of a motor on one side.Moreover, the result of testing a battery malfunction is omitted for the same reason.

Evaluation Method
The maximum values of yaw rate and lateral acceleration were compared with results of the "Sensitivity to lateral wind" recorded with Z108-76 of the Japanese Automobile Standards Organization (JASO) [5].For example, a crosswind stability  49.90 -examination showed the maximum yaw rate and lateral acceleration at 100 km/h to be 5°/s and 0.17g, respectively.Since these values were typical of what a car on the market might generally encounter, if the behavior changes that took place due to a fault of the motor were below these values, safe operation would be maintained.

Test Results without Redundancy Control
Figures 7a and b show the results without redundancy control.The results enclosed in the square region are within tolerance limits.For a motor malfunction of the first axle on the right, the tolerance limits were exceeded under all conditions of acceleration (Fig. 7a).For a motor malfunction of the fourth axle on the right (Fig. 7b), the tolerance limits were exceeded by three conditions: motor lock during a right turn under acceleration and both loss of traction and motor lock during a left turn under acceleration.
Moreover, while turning, the ride stability became significantly worse when the motor on the fourth axle on the right was locked during high acceleration.A lock during a left turn had a particularly bad influence on the ride stability under these examination conditions.In addition, a motor lock was worse than the loss of motor traction under both conditions.
The reason why the test results exceeded the tolerance limit under every condition upon the motor malfunction of the first axle on the right during high acceleration is due to the steering angle created by the yaw moment directly affecting the handle.Also, for the reason why the test results for four right motors malfunctions had lesser condition in which the tolerance limit was exceeded compared to the right motor malfunction on the first axle is because there is a difference in the way the maneuverability is affected upon the location of the malfunction.This is due to the yaw moment created beforehand because of the cornering force created upon turning.However, from figure 7(a) and 7(b), four right motors malfunctions had worse result than the right first axle motor malfunction upon left turn during acceleration test.This is due to the driver's slow response because the yaw moment created when rear motor malfunctions does not directly affect the steering wheel.Also, when the right four motors malfunctions during a left turn, the yaw moment created by the fourth axle is opposite from the vehicle's rotating direction and therefore causes a decrease in stability in the rear of the vehicle, and the drivability worsens.
As a representative example of the test, the result, which exceeded the tolerant limit the most, is indicated by figure 7(c).This occurred when the right motor on the 4th axle locks during high acceleration while turning left.In the figure, velocity, acceleration rate both forward and backwards, lateral acceleration, and yaw rate is indicated and the "Test Flag" indicates the point of when the malfunction occurred.In 0.7 seconds after the malfunction, the yaw rate is about 7.8°/s, the lateral acceleration increased about 0.33g, causing insecurity in drivability.Therefore, after the malfunction, it is difficult to hold the acceleration pedal.So in the case upon actual driving, the acceleration pedal was put back and the vehicle position was corrected by steering, as it is apparent from the acceleration rate.From these results, the need for control upon motor malfunction during high acceleration has been confirmed for improved drivability.

Test Results with Redundancy Control
Figures 8a and b show the examination results with the addition of redundancy control.The ability to suppress both yaw rate and lateral acceleration below the tolerance limits by the introduction of redundancy control under each running condition has been confirmed.In particular, driving could be continued easily immediately after a loss of traction.Moreover, when a motor locked, the vehicle could be stopped safely.

CONCLUSIONS
In an EV that uses in-wheel motors, as predicted by theory, when traction forces of the right and left became unbalanced by the malfunction of a motor, it has been experimentally confirmed that the vehicle stability deteriorates.Although vehicle dynamics vary among individual vehicles, in the case of the prototype "Eliica" car, when one motor experienced loss of traction or locked while accelerating on a straight track or on a curve with a 200-m radius, the yaw rate and lateral acceleration that were generated exceeded the results of the "Sensitivity to lateral wind" recorded with Z108-76 of JASO, and ride stability deteriorated.
To test a solution, when a motor lost traction force or locked, the opposite motor on the same axle has been stopped.As a result, when a motor lost traction force, yaw moment and lateral acceleration were restrained, and redundancy control allowed driving to continue with other working motors.Moreover, the vehicle could be stopped safely under the fault condition of motor lock.
To limit the load, the vehicle controller reads the instruction torque of an inverter and applies the same instruction torque to the other motor on the same axle as a limiter.Furthermore, for a more effective redundancy drive system, a pair of batteries supplies two inverters on the same axle, and a vehicle controller is connected to each pair of front and rear axles.
Few EVs use in-wheel motors.However, all-wheel-drive vehicles, which can control the driving force of each wheel freely, are put to practical use in internal combustion engine vehicles (ICEVs) from safety concerns, recently.Therefore, if EVs were to replace ICEVs, demand for in-wheel motors will increase, because performance superior to ICEV is expected for in-wheel motors, which respond quickly and can control driving forces easily.
The proposed method for controlling a motor malfunction can be used not only in all-wheel-drive vehicles that use in-wheel motors, but also in the safety planning of 2WD and hybrid vehicles that have independent right and left motors.

Fig. 2
Fig. 2 Fault tree analysis of the phenomena that lead to unbalanced traction forces

Fig. 3
Fig. 3 Block diagram of drive system of conventionalEVs (Front-wheel drive)

Fig. 4
Fig. 4 Block diagram of Eliica's drive system with redundancy (All-wheel drive)

Fig. 6
Fig. 6 Photo of Eliica Fig. 7(a) Motor malfunction of the first axle on the right without redundancy control

Fig
Fig. 7(b) Motor malfunction of the fourth axle on the right without redundancy control

Fig. 8
Fig. 8(a) Motor malfunction of the first axle on the right with redundancy control

Table 1
Specifications of the Eliica