Patent Description:
Vehicles (for example petrol, diesel, electric, hybrid) comprise active suspension systems, such as electronic active roll control (electronic active roll control) systems, for maintaining vehicle stability. Such electronic active roll control systems comprise at least one actuator, the actuator being coupled to an anti-roll bar and configured to actively impart motor control on the suspension system. To provide the motor control to the actuators of the electronic active roll control system, the electronic active roll control system may be supplied by a dedicated power supply system, such as a 48V supply. Faults arising from an electronic active roll control system, such as unintended actuation (and, consequently, imparted motor control), can lead to undesired path deviation by the vehicle. The electronic active roll control system therefore has a high functional safety integrity requirement (for example a high Automotive Safety Integrity Level", ASIL,). Throughout this disclosure, the term "anti-roll bar" is used and is synonymous with the terms "roll bar", "anti-sway bar", "sway bar" or "stabilizer bar".

Such active suspension systems utilise a number of individual subcomponents, or mechatronic subsystems, which may, individually, have a lower functional safety requirement. These subcomponents may comprise a cascade of: high level vehicle control generating a system demand signal (such as torque demand) to influence vehicle motion; a low level controller providing control signals to an actuator (i.e. to provide motor control) of the electronic active roll control system to deliver the demand signal provided; associated mechanical components to deliver the physical manifestation of the demanded signal; and the power supply system. Various interaction between the indicated subcomponent cascade provide overall operation of the electronic active roll control system.

The electronic active roll control system may operate in an inactive state, or passive state, where no active torque is generated, and no actuation (i.e. imparted motor control) takes place. This state may be achieved via logical conditions, or interrupting the power supply to the electronic active roll control system (for example an interruption of the connection to the dedicated 48V power supply system to the electronic active roll control actuators).

In view of the high functional safety requirement of the electronic active roll control system, it is desirable to be able to pre-emptively diagnose a system failure which may arise within the electronic active roll control system, including the individual subcomponents of the system, before any undesired, potentially hazardous situation occurs. Particularly, it is desirable to test the functionality of the electronic active roll control system for achieving the inactive state (i.e. testing the functionality of the interruption of the power supply). However, testing the interruption of the power supply to achieve the inactive state results in loss of function of the active roll control for the electronic active roll control system, and may increase the risk of damaging subcomponents of the system. Thus, during active use of the vehicle, it can be difficult to non-intrusively perform any such functional test on the electronic active roll control system, in order to pre-emptively diagnose any system faults.

<CIT> describes a protective circuit for an actuator for a vehicle, the protective circuit having at least one switch for interrupting and short-circuiting at least two electrical lines for connecting terminals of a power supply device to terminals of the electrical actuator. The protective circuit further comprises a diagnostic device for checking sections of the at least two electrical lines arranged between the terminals of the energy supply device and the at least one switch.

<CIT> discloses a supervision system for a control device for anti-roll actuators of a vehicle comprising an electronic control unit capable of receiving information on the vehicle. The system comprises diagnostic means able to check that the information on the vehicle is not erroneous, and/or that the transmission of this information is carried out correctly and the diagnostic means take into account a given number of successive interruptions before delivering a signal of non-reception of the corresponding signal. No interrupter switch is mentioned however and the system works when the vehicle is running, not when it is in the process of shutting down.

Therefore, it is an aim of the present invention to address one or more of the disadvantages associated with the prior art.

A possible solution disclosed herein to the above-detailed problem is to perform a functional test of an isolation switch for interrupting to a power supply, when specific conditions of the vehicle are detected. Such conditions may apply when the vehicle has initiated a shutdown state (i.e. one or more control modules, or control systems, cease, or start to cease operation). During shutdown of the control modules to the power supply system, the isolation switch may be opened, to interrupt power delivery to the electronic active roll control system. This may allow for the electronic active roll control system to be tested in a non-intrusive manner, without affecting vehicle performance, as detailed below.

Aspects and embodiments of the invention disclosed herein provide a control system, to a system, to a vehicle, to a method, and computer software, as claimed in the appended claims. According to an aspect of the present invention there is provided a control system for a vehicle suspension system of a vehicle. The control system comprises one or more controllers and is configured to perform a test for testing operation of an isolation switch. The vehicle suspension system comprises an actuator power supply configured to supply power to the vehicle suspension system. The actuator power supply is configured to be electrically connected to the vehicle suspension system via the isolation switch. The control system is configured to: receive a shutdown indicator signal indicating that the vehicle is in a shutdown state; output an open isolation switch signal configured to open the isolation switch in dependence on the shutdown indicator signal; receive an open isolation switch confirmation signal indicative of the isolation switch being open; determine whether the open isolation switch confirmation signal is received within a predetermined time period; and output a test pass signal or a test failure signal in dependence on the determination.

The control system may be further configured to, if the open isolation switch confirmation signal is received from the power supply system within the predetermined reaction period, record the test pass in a test log.

The control system may be further configured to, if no open isolation switch confirmation signal is received from the power supply system within the predetermined reaction period, record the test failure in a test log. The control system may be further configured to, if a closed isolation switch signal indicative of the isolation switch being closed is received, record the test failure in the test log.

A shutdown procedure may continue to cause one or more further vehicle control systems connected to the control system to cease operation.

The control system may be further configured to determine if a number of consecutive test failures recorded in the test log reaches a predetermined failure threshold; and if the number of consecutive test failures meets the predetermined failure threshold, provide an output indicating an isolation switch operation fault.

The control system may be further configured to, in dependence on the number of consecutive test failures meeting the predetermined failure threshold, perform a shutdown procedure to cause one or more further vehicle control systems connected to the control system to cease operation; and provide the output indicating the isolation switch operation fault on initiation of an ignition cycle following the shutdown procedure.

The control system may be further configured to determine if a number of consecutive test passes recorded in the test log reaches a predetermined pass threshold for a current drive cycle; if the number of consecutive test passes is less than the predetermined pass threshold, operate in a first testing phase for the current drive cycle, wherein a subsequent test is performed in response to receipt of a next shutdown indicator; and if the number of consecutive test passes is equal to or above the predetermined pass threshold, operate in a second testing phase for the current drive cycle, wherein a subsequent test is performed less frequently in the second testing phase than in the first testing phase.

The control system may be further configured to, following receipt of the shutdown indicator signal and prior to determining whether an open isolation switch confirmation signal is received, in response to a start-up indicator signal indicating that the vehicle is in a start-up state, abort a current test being performed, and perform a next test in dependence on receipt of a further shutdown indicator.

The predetermined time period may be determined in dependence on an expected time taken for the open isolation switch confirmation signal to be transmitted from the isolation switch and received by the control system. The expected time taken may be further determined in dependence on an expected time for the isolation switch to open. Transmission of the "open isolation switch confirmation signal" from the isolation switch may comprise transmission from a module controlling or managing operation of the open isolation switch confirmation signal. For example, the predetermined time period may cover: a) the time it takes for the component to react to the isolation demand, and update the signal; b) publish the data on the communication bus, and c) the time taken for the control system to receive the feedback.

The control system may be further configured to, after determining receipt of the open isolation switch confirmation signal, continue the shutdown procedure to cause one or more further vehicle control systems connected to the control system to cease operation.

The shutdown indicator may further comprises at least one of: an indication of a current vehicle power mode; an indication of a power down sequence of the actuator power supply having commenced; a voltage level of the actuator power supply being within a predetermined voltage range; a current level of the actuator power supply being below a predetermined current threshold; and an indication that the isolation switch is in a closed position.

In a further aspect there is provided a system, comprising: any control system disclosed herein; a vehicle suspension system, comprising at least one actuator; and an actuator power supply electrically connected to the vehicle suspension system by an isolation switch.

In a further aspect there is provided a vehicle comprising any control system disclosed herein or any system disclosed herein.

In a further aspect there is provided a method for a control system of a vehicle suspension system, The vehicle suspension system comprises an actuator power supply configured to supply power to the vehicle suspension system. The actuator power supply is configured to be electrically connected to the vehicle suspension system via an isolation switch. The method comprises: receiving a shutdown indicator indicating that the vehicle is in a shutdown state: outputting an open isolation switch signal , the open isolation switch signal configured to cause the isolation switch to open; receiving an open isolation switch confirmation signal indicative of the isolation switch being open; determining whether an open isolation switch confirmation signal is received within a predetermined time period; and outputting a test pass or test failure in dependence upon receipt of the open isolation switch confirmation signal.

In a further aspect there is provided computer readable instructions which, when executed by a processor of any control system disclosed herein, are arranged to perform any method disclosed herein.

Active suspension systems, such as electronic active roll control utilizing mechatronic systems, may include a cascade of systems, such as:.

There may be a part of the active suspension system which it is desirable to test for correct functioning during normal operation of the vehicle, but to do so is not easily possible because the test may interfere with the expected operation of the vehicle. For example, it is desirable to be able to test for the expected functioning of isolation switches which are intended to cause electrical isolation of a component of the system, for example in the event of a detected fault. However, testing such isolation switches cannot readily be performed during normal operation of the vehicle because testing that the switch opens, when instructed to do so, would interfere with the operation of the vehicle. On the other hand, the vehicle must be in some operative state for the test to be performed, because if the vehicle systems were all switched off (i.e. unpowered) then it would not be possible to detect if the isolation switch had operated snice there is no powered system to monitor for electrical isolation. In the example of an isolation switch configured to isolate the power supply system from the active suspension system, causing electrical isolation for the purposes of a test may cause unintended actuation of the active suspension systems and potentially unintended vehicular deviation from an expected path. Examples disclosed herein allow for such isolation switches to be tested in a test procedure which operates when the vehicle systems are being powered down, and thus there is no normal operation taking place (i.e. no power is being drawn).

The control system <NUM> as illustrated in <FIG> comprises one controller <NUM>, although it will be appreciated that this is merely illustrative. The controller <NUM> comprises processing means <NUM> and memory means <NUM>. The processing means <NUM> may be one or more electronic processing device <NUM> which operably executes computer-readable instructions. The memory means <NUM> may be one or more memory device <NUM>. The memory means <NUM> is electrically coupled to the processing means <NUM>. The memory means <NUM> is configured to store instructions, and the processing means <NUM> is configured to access the memory means <NUM> and execute the instructions stored thereon.

The controller <NUM> comprises an input means <NUM> and an output means <NUM>. The input means <NUM> may comprise an electrical input <NUM> of the controller <NUM>. The output means <NUM> may comprise an electrical output <NUM> of the control system <NUM>. The input <NUM> is configured to receive one or more input signals <NUM>, for example from a sensor <NUM>. The inputs may be either physical (for example from a hard wired sensor) and/or may be from a vehicle communication bus. There may be one or more sensors which provide information to the controller input <NUM>. The output <NUM> is configured to provide one or more output signals <NUM>.

In an example, the control system <NUM> may be for a vehicle suspension system of a vehicle. The control system is configured to perform a test for testing operation of an isolation switch. The vehicle suspension system comprises an actuator power supply configured to supply power to the vehicle suspension system, and the actuator power supply is configured to be electrically connected to the vehicle suspension system via the isolation switch. In such an example, the input <NUM> is arranged to receive a shutdown indicator signal as an input signal <NUM> indicating that the vehicle is in a shutdown state. The control system <NUM> is configured to output an open isolation switch signal as an output signal <NUM>, which is configured to open the isolation switch in dependence on receipt of the shutdown indicator signal as an input signal <NUM>. Thus the switch is forced to open to test its operation. This may be considered to simulate a fault with the system, and the test checks that the isolation switch operates as intended in the event of a real life fault, i.e. by opening to isolate the active suspension actuators from the power supply.

The input <NUM> is also arranged to receive an open isolation switch confirmation signal as an input signal <NUM> indicative of the isolation switch being open. The control system <NUM> is configured to determine whether the open isolation switch confirmation signal as an input signal <NUM> is received within a predetermined time period. Then, the controller is configured to, in dependence on the determination, provide via the output <NUM>, a test pass signal or a test failure signal as an output signal <NUM>. For example, if the open isolation switch confirmation signal received within the predetermined time period, the control system <NUM> may output a test failure signal as an output signal <NUM>. Thus, the open isolation switch signal as an output signal <NUM> is an intentional planned demand for the switch to open, and the expected result of the transmission of the open isolation switch signal as an output signal <NUM> is monitored by the control system <NUM> to await a confirmation signal within the predetermined time, which when received, may be interpreted as an expected response to the intentional open isolation switch signal as an output signal <NUM>, and successful operation of the isolation switch as intended. The term "test pass signal" may be understood to be a sensor output which is processed elsewhere for categorisation as a test pass i.e. as a sensor signal consistent with the switch being determined to operate as expected and thus the test being passed. Similarly, the term "test fail signal" may be understood to be a sensor output which is processed elsewhere for categorisation as a test fail i.e. as a sensor signal consistent with the switch being determined not to operate as expected (i.e. faulty operation is positively detected), or consistent with the switch not being determined to operate as expected (i.e. no information is received indicating correct operation) and thus the test being passed. Further examples are discussed below.

<FIG> and <FIG> illustrate an example control system <NUM> for a suspension system of a vehicle. A suspension system of a vehicle may comprise anti-roll bars <NUM>, <NUM> which are controlled using an anti-roll control system. The anti-roll control system acts to control the anti-roll bars, to control a roll of a body of the vehicle and reduce the impact of disturbances from a road surface. The anti-roll control system may be electromechanical and/or hydraulic. Anti-roll bars <NUM>, <NUM> may typically comprise stabiliser bars, typically metal, which join the vehicle suspension on either side of the vehicle axle, usually through drop links, and connect to a rotational actuator situated between the mounting points to the vehicle chassis. Each side of the anti-roll bar is able to rotate freely when a motor of the anti-roll control system is not energised. When the motor control is enabled (i.e. delivering torque), the anti-roll bar may act as a torsional spring. The anti-roll bars may be controlled to compensate for some vehicle movements such as body roll, for example from driving around a corner. Body roll can cause the wheels at the side of the vehicle outside the turn to reduce their contact with the road surface. Anti-roll bars may be controlled to counteract this effect and reduce the body roll effect, by transferring at least part of the additional load on the wheels at the side of the vehicle inside the turn to those wheels at the outside, for example by providing a torsional effect to pull the wheels towards the chassis and even out the imbalance in load on the wheels caused by cornering.

A typical suspension system may comprise passive front and rear anti-roll bars provided respectively between the front and rear pairs of wheels of a standard four-wheel vehicle. In a vehicle with an active roll control system, an anti-roll bar <NUM>, <NUM> may respectively each comprise two anti-roll bar ends <NUM>, <NUM>; <NUM>, <NUM> connected together by a central housing having an actuator <NUM>, <NUM>. The central housing may additionally have one or more of a gearbox, sensors, and dedicated actuator controllers. The actuator <NUM>, <NUM> acts to provide an actively controlled torque rather than a fixed torsional stiffness provided by passive anti-roll bars. One or more sensors may monitor the movement of the vehicle, and provide the sensed parameters as input to the active roll control system to control the actuator and provide a suitable torque to the anti-roll bar. The two ends of the anti-roll bar <NUM>, <NUM>; <NUM>, <NUM> may be identical, or may be non-identical.

<FIG> shows an example control system <NUM> for a suspension system a vehicle, communicatively connected to front and rear anti-roll bars <NUM>, <NUM>. The control system <NUM> comprises a controller <NUM> which is connected by a communication channel <NUM> to anti-roll bar controllers <NUM>, <NUM> configured to respectively control front and rear anti-roll actuators <NUM>, <NUM>. The controller <NUM> may be the controller <NUM> of <FIG>. The controller <NUM> may comprise one or more of the controllers <NUM> of <FIG>. In an example, the controller <NUM> may be a master controller for an electronic active roll control system in the vehicle. The controller <NUM> may host a vehicle level control strategy and actuation control for the electronic active roll control system in the vehicle.

The controller <NUM> may be configured to receive one or more sensor signal <NUM> from one or more sensors attached to the vehicle. The one or more sensor signals <NUM> may comprise, for example, a signal from a respective suspension height sensor of the vehicle suspension; a signal from a respective motor position sensor for the anti-roll bar actuators <NUM>, <NUM>; a signal from a respective hub acceleration sensor of the vehicle; and a signal from a respective torque sensor for the anti-roll bar actuators <NUM>, <NUM>. A suspension height sensor may be configured to determine a sensor signal indicative of one or more of a height of a left side and a height of a right side of the vehicle suspension. A motor position sensor may be configured to determine a sensor signal indicative of a position of a respective motor of the anti-roll bar actuators <NUM>, <NUM>. A hub acceleration sensor may be configured to determine a sensor signal indicative of an acceleration of one or more hub of a wheel of the vehicle. A torque sensor may be configured to provide a measure of an existing torque generated in the system, as a result of a target torque demand being requested by the controller.

The controller <NUM> may be configured to receive one or more communication signals via a communications bus <NUM>. The communications bus <NUM> may be configured to deliver data to the controller <NUM> from other subsystems within the vehicle. For example, the communications bus <NUM> may be configured to communicate a signal indicating a status of one or more modules <NUM>, <NUM>, <NUM> that are in communicative connection with the controller <NUM> to the controller <NUM>. In another example, the communications bus <NUM> may be configured to communicate a command from the controller <NUM> to the one or more modules <NUM>, <NUM>, <NUM> that are in communicative connection with the controller <NUM>. The one or more modules <NUM>, <NUM>, <NUM>, are discussed further in relation to <FIG> below. Signals transmitted over connections <NUM> or <NUM> may alternatively or additionally be transmitted over communications bus <NUM>.

The controller <NUM> may be configured to generate system demand signals to influence a vehicle's motion via the anti-roll actuators <NUM>, <NUM>. An actuator provided between a front pair of wheels of a vehicle may be called a front actuator. A front active roll control (FARC) module may be electrically connected to the front actuator, and may comprise the controller <NUM> to control the front actuator <NUM>. Similarly, an actuator provided between a rear pair of wheels of a vehicle may be called a rear actuator. A rear active roll control (RARC) module may be electrically connected to the rear actuator and may comprise a controller <NUM> to control the rear actuator <NUM>.

The front and rear anti-roll actuators <NUM>, <NUM> each comprise an electric motor which is controllable by the respective anti-roll controller <NUM>, <NUM>. Each of the front and rear anti-roll actuators <NUM>, <NUM> may be controlled by its own respective anti-roll controller in some examples, or multiple anti-roll actuators may be controlled by a common anti-roll controller in some examples. Each of the anti-roll actuators <NUM>, <NUM> may be individually controlled in some cases to improve the management of the roll of the body of the vehicle. The front and rear anti-roll actuators <NUM>, <NUM> may be controlled by a control signal which is generated by the controller <NUM> may generate and output, through the output channel <NUM>, to the anti-roll bar controllers <NUM>, <NUM>. The control signal may carry instructions to be implemented by the actuator, for example by providing a torque to apply to the anti-roll bar. For example, as discussed above, when the vehicle is cornering, a control signal may be transmitted to the anti-roll bar controllers <NUM>, <NUM>, which may in turn transmit a control signal via interface <NUM>, <NUM> so that the front and read anti-roll actuators <NUM>, <NUM> may mitigate a body roll effect. Similarly, anti-roll bar controllers <NUM>, <NUM> may transmit measured values from the anti-roll actuators to the controller <NUM> through output channel <NUM>.

<FIG> shows an example control system <NUM> for a vehicle comprising one or more modules <NUM>, <NUM>, <NUM>, a controller <NUM> and front and rear anti-roll bars <NUM>, <NUM>. As in <FIG>, the control system <NUM> comprises a controller <NUM> which is connected by a communication channel <NUM> to controllers <NUM>, <NUM> configured to respectively control front and rear anti-roll bar actuators <NUM>, <NUM>. Further, the controller <NUM> of the control system <NUM> is in a communicative connection to the one or more modules <NUM>, <NUM>, <NUM> via a communications bus <NUM>. The one or more modules <NUM>, <NUM>, <NUM> may be configured to perform functions relating to power supply of the suspension system. Module <NUM> may be a power control module configured to control a power supply system for the suspension system. Module <NUM> may be a conversion module configured to convert electrical energy output from the vehicle power supply system. In an example, the conversion module <NUM> may comprise a DC-DC converter. Module <NUM> may be a capacitor or supercapacitor module configured to store electrical energy for the suspension system. Together, conversion module <NUM> and capacitor module <NUM> may be configured to supply electrical energy to the controllers <NUM>, <NUM>, such that the anti-roll bar actuators <NUM>, 282can be actuated. <FIG> illustrates these modules <NUM>, <NUM>, <NUM> as individual modules. However, there may be examples whereby components within the modules <NUM>, <NUM>, and <NUM> are included in a single module. Similarly, communications links <NUM> and <NUM> may be the same in some examples.

<FIG> shows an example control system <NUM> for a vehicle suspension system. Controller <NUM> is present as in <FIG> and <FIG>, which is connected by a communication channel <NUM> to anti-roll bar controllers <NUM>, <NUM> configured to respectively control front and rear anti-roll actuators <NUM>, <NUM>. Also shown in <FIG> is a power converter module <NUM> and an electrical energy storage module <NUM>. The power converter module <NUM> may comprise, for example, a bidirectional DCDC power converter. The electrical energy storage module <NUM> (in the same way as module <NUM> in Figures 2a-b) may be considered to be a subcomponent of the power supply in some examples as it is used to provide electrical power to the actuators <NUM>, <NUM> via the anti-roll bar controllers <NUM>, <NUM> via electrical connections <NUM>; <NUM>. The actuator controllers <NUM>, <NUM> are communicatively linked with the via respective communication bus connections <NUM>, <NUM>. The electrical energy storage module <NUM> may comprise a supercapacitor energy storage module in some examples. The power converter module <NUM> may receive energy from a vehicle battery via power connection <NUM>. The power converter module <NUM> may receive control inputs via communications bus <NUM>. The electrical energy storage module <NUM> may receive energy from the power converter module <NUM> via power connection <NUM>. The electrical energy storage module <NUM> may receive control inputs via communications bus <NUM>. In this example, communication buses <NUM>, <NUM> and <NUM> are the same communication bus. The electrical energy storage module <NUM> is also in electrical connection with the anti-roll bar controllers <NUM>, <NUM> via respective connections <NUM>, <NUM>.

The electrical energy storage module <NUM> also comprises an isolation switch <NUM>. The isolation switch is configured to connect the electrical energy storage module <NUM> to the anti-roll bar controllers <NUM>, <NUM> when closed, and isolate the electrical energy storage module <NUM> from the anti-roll bar controllers <NUM>, <NUM> when open.

It will be appreciated that the control systems <NUM>, <NUM> of <FIG> may comprise one or more further connected controllers in some examples, and/or one or more further electrical or communication connections.

<FIG> illustrates a process flow <NUM> for a control system <NUM>. As discussed above, the control system <NUM> is configured to perform a test of the operation of an isolation switch <NUM> for interruption of a connection of the actuator power supply <NUM> to the vehicle suspension system (i.e. to the anti-roll bar controllers <NUM>, <NUM> of the electronic active roll control system). <FIG> illustrate processes taking place along a timeline from left to right as illustrated, in the electrical energy storage module <NUM> and in the control system <NUM>.

Referring to <FIG>, initially, the actuator power supply <NUM> and the controller <NUM> are operating in a normal mode, represented by block <NUM> and block <NUM>, respectively, during a drive cycle <NUM> of the vehicle (i.e. the vehicle is being, or can be driven, and the ignition is ON). A drive cycle may be defined as a time period between two consecutive power on or power off events. During a drive cycle <NUM> the isolation switch <NUM> is in a closed position, and connecting the actuator power supply <NUM> and the anti-roll bar controllers <NUM>, <NUM>. At an ignition OFF point <NUM>, a shutdown indicator signal is received that a shutdown state has been initiated (i.e. an instruction, or signal, is received that the ignition is switched OFF). The vehicle begins to enter a shutdown process <NUM>. During a shutdown process, power modules (i.e. such as the actuator power supply <NUM>) begin to cease operation. Thus, following initiation of the shutdown state <NUM>, the actuator power supply <NUM> initiates a shutdown procedure, where at least one module of the actuator power supply ceases, or begins to, cease operation.

During the vehicle shutdown procedure <NUM>, the actuator power supply <NUM> initiates a shutdown state <NUM>, and a shutdown signal is received by the controller <NUM> from the actuator power supply <NUM> indicating that a shutdown state has been entered. The shutdown signal indicator of the shutdown state may be an indication of a current vehicle power mode (i.e. the vehicle power mode being at <NUM>). Additionally, the shutdown signal indicator may be an indication of a power down sequence of the actuator power supply <NUM> having commenced. Additionally, or alternatively, the controller <NUM> may determine that the actuator power supply <NUM> has entered a shutdown state upon the a voltage level of the actuator power supply <NUM> being within a predetermined voltage range and/or a current level of the actuator power supply being below a predetermined current threshold. For example, the voltage level on the actuator power supply <NUM> may fall with +/-2V of a predetermined voltage threshold - i.e. a storage voltage threshold - and/or the current level may be approximately 0A (for example +/- 2A). The shutdown signal indicator may further indicate that the isolation switch is in a closed position. In a further example, the shutdown signal indicator from the actuator power supply <NUM>, to indicate that it has entered a shutdown state, may include all of the above indications.

In response to receipt of the indication that the actuator power supply <NUM> has entered a shutdown state <NUM>, the controller <NUM> issues an open isolation switch signal <NUM> to open the isolation switch <NUM>, and monitors <NUM> (i.e. waits) for confirmation of the isolation switch <NUM> being open in response to the issued signal <NUM>.

The controller <NUM> then receives a confirmation signal <NUM> indicative that the isolation switch <NUM> is open, and proceeds to determine whether the open isolation switch confirmation signal <NUM> is received within a predetermined time period. In other words, the controller <NUM> determines whether the isolation switch <NUM> is opened in response to the open isolation switch signal <NUM> sent by the controller <NUM> when the confirmation signal <NUM> is received within the predetermined time period. Or, when received outside of the predetermined time period, it may be determined by the controller <NUM> that the open isolation switch conformation has been received as part of normal shutdown procedure of the actuator power supply <NUM> rather than in direct response to the open test signal <NUM>. If after the pre-determined time period elapsed, the isolation switch <NUM> is not confirmed as being open by the controller <NUM>, through receipt of the isolation switch open signal, then the controller <NUM> may treat this lack of receipt of isolation switch open signal as a fail state (error condition). Once the isolation switch is open, the actuator power supply <NUM> continues shutdown procedure <NUM>.

The predetermined time period may be determined based at least in part on an expected (i.e. calibrated) time taken for the open isolation switch confirmation signal <NUM> to be transmitted from the module controlling the isolation switch (for example electrical energy storage module <NUM>; actuator power supply module <NUM>) and received by the controller <NUM>. The predetermined time period (or expected time) may be further determined in dependence based on an expected time for the isolation switch to open, and the expected time for the open isolation switch signal to be transmitted over a communication bus connecting the isolation switch and the control system.

May be determined in dependence on an expected time taken for the open isolation switch confirmation signal to be transmitted from the isolation switch and received by the control system. The expected time taken may be further determined in dependence on an expected time for the isolation switch to open. For example, the predetermined time period may cover: a) the time it takes for the component to react to the isolation demand, and update the signal; b) publish the data on the communication bus, and c)the time taken for the control system to receive the feedback.

The controller <NUM> outputs, and may record <NUM>, whether a test pass or test failure has been received in response to the determination whether or not the isolation switch <NUM> has opened in response to the open isolation switch signal <NUM>. The controller <NUM> may store <NUM> the test pass or test failure result in a test log of the controller <NUM>. In other words, if the open isolation switch confirmation signal <NUM> is received from the power supply system <NUM> within the predetermined reaction period, a test pass may be determined, and recorded, in the test log. If no open isolation switch confirmation signal <NUM> is received within the time period, or if a closed isolation switch signal indicative of the isolation switch being closed is received (i.e. an indication that the switch has failed to open), the controller <NUM> may record a test failure in the test log. If no data is received for example there is a communication failure or a missing expected message), the test may abort, and the normal shutdown procedure may be executed. The controller <NUM> then continues a shutdown procedure <NUM>, and enters a shutdown state <NUM>. At <NUM> the vehicle completes a shutdown (i.e. all control units of the vehicle cease operation).

In some examples, recordal of a test pass or a test fail may take place as follows: If a test is marked as fail, this may cause a fail counter to be stored in the (for example non-volatile) memory of the controller <NUM> to be incremented by one. This fail counter value may then be used to determine if the number of failures is above a predefined threshold. If a test is marked as a pass, the fail counter may be reset to <NUM> so that counting for a number of consecutive fails can re-start. The fail counter may constitutes a variable, which is stored in (for example non-volatile) memory, and which may be updated periodically at shutdown, once a test is completed (i.e. to indicate a pass or fail). Examples of non-volatile memory include EPROM or EEPROM memory of the controller, for example. Thus a "test log" may include a counter recording a number of test fails, and/test passes.

<FIG> illustrates a process flow <NUM> for a controller <NUM>. The controller <NUM> and actuator power supply <NUM> are initially in a shutdown state <NUM> (for example, shutdown subsequent to the processes of <FIG> being performed). At a point <NUM>, a start-up signal is received from the user (i.e. the ignition is ON), i.e. a driving mode <NUM>, or state, of the vehicle is initiated. The actuator power supply <NUM> enters a normal function <NUM> state (i.e. a normal, powered operation).

Once a drive cycle <NUM> has been initiated, the controller <NUM> monitors <NUM> for (i.e. determines) the number of consecutive test failures that have been received (recorded) in the test log. The error detection may done in the next drive cycle, when the vehicle is in use, in order to provide an output indicating whether a real issue exists prior to a potential hazardous situation. Particularly, the controller <NUM> determines from the test log (for example a test fail counter) if a number of consecutive test failures recorded in the test log reaches a predetermined failure threshold for a current drive cycle. If the number of consecutive test failures (for example two) meets the predetermined failure threshold, the control system may perform a shutdown procedure to cause one or more further vehicle control systems connected to the control system to cease operation. Performing a shutdown procedure may include, for example, placing the system in a safe state (for example disabling control, requesting the power supply to isolate, and stopping power transfer). The control system may provide an output to the user indicating a fault. For example, at <NUM>, the controller <NUM> may output a fault indication to the user. For example, the control system may send a to display a fault indication on a dashboard display of the vehicle informing the user that a fault is detected and to seek assistance.

From the test log (for example from a test fail counter), if the controller <NUM> determines (i.e. at point <NUM>) that a number of consecutive test passes is less than the predetermined pass threshold, the control system continues to operate (i.e. to continue to perform testing) in a first testing phase for the current drive cycle. In this first testing phase, a subsequent (further) test may be performed each time the vehicle initiates a shutdown state (i.e. in response to receipt of a next shutdown indicator received from the actuator power supply <NUM>). However, if the controller <NUM> determines that the number of recorded consecutive test passes is equal to or above the predetermined pass threshold, then the controller <NUM> may operate in a second testing phase for the current drive cycle. In the second testing phase, a subsequent (i.e. the next test) may be performed less frequently than in the first testing phase. In other words, a test may be performed less frequently than on every shutdown state initiated by the vehicle.

After the controller <NUM> has received the shutdown indicator signal (i.e. at <NUM> indicating that the actuator power supply <NUM> is in a shutdown state), if the an indication of a start-up indicator signal is received (i.e. that the vehicle has entered an ignition ON in response to user activation), the controller <NUM> may abort the current test being performed. For example, if the shutdown indictor signal has been received, but controller <NUM> has not yet sent the isolation switch demand, or the controller <NUM> has not yet performed the determination of whether an open switch confirmation signal has been received; the control system aborts the current test. A subsequent (next) test may be performed when the vehicle next enters a shutdown state (i.e. when a next shutdown indicator is received).

<FIG> illustrates a method <NUM> of a control system for a vehicle suspension system of a vehicle, such as the vehicle <NUM> illustrated in <FIG>. The control system as discussed above comprises one or more controllers and the vehicle suspension system comprising an actuator.

The method <NUM> may be performed by the control system <NUM> illustrated in <FIG>. In particular, the memory <NUM> may comprise computer-readable instructions which, when executed by the processor <NUM>, perform the method <NUM> according to an embodiment of the invention. The blocks illustrated in <FIG> may represent steps in a method <NUM> and/or sections of code in a computer program configured to control the control system as described above to perform the method steps. The illustration of a particular order to the blocks does not necessarily imply that there is a required or preferred order for the blocks and the order and arrangement of the block may be varied. Furthermore, it may be possible for some steps to be omitted or added in other examples. Therefore, this disclosure also includes computer software that, when executed, is configured to perform any method disclosed herein, such as that illustrated in <FIG>. Optionally the computer software is stored on a computer readable medium, and may be tangibly stored.

The method <NUM> comprises: receiving <NUM> a shutdown indicator indicating that the vehicle is in a shutdown state: outputting <NUM> an open isolation switch signal, the open isolation switch signal configured to cause the isolation switch to open; receiving <NUM> an open isolation switch confirmation signal indicative of the isolation switch being open; determining <NUM> whether an open isolation switch confirmation signal is received within a predetermined time period; and outputting <NUM> a test pass or test failure in dependence upon receipt of the open isolation switch confirmation signal.

<FIG> illustrates a vehicle according to an embodiment of the invention. The vehicle <NUM> in the present embodiment is an automobile, such as a wheeled vehicle, but it will be understood that the control system and active suspension system may be used in other types of vehicle.

Claim 1:
A control system (<NUM>, <NUM>) for a vehicle suspension system of a vehicle (<NUM>), the control system comprising one or more controllers, and configured to perform a test for testing operation of an isolation switch (<NUM>), the vehicle suspension system comprising an actuator power supply (<NUM>) configured to supply power to the vehicle suspension system, and the actuator power supply configured to be electrically connected to the vehicle suspension system via the isolation switch, the control system configured to:
receive a shutdown indicator signal indicating that the vehicle is in a shutdown state (<NUM>);
output an open isolation switch signal (<NUM>) configured to open the isolation switch in dependence on the shutdown indicator signal;
receive an open isolation switch confirmation signal (<NUM>) indicative of the isolation switch being open;
determine whether the open isolation switch confirmation signal is received within a predetermined time period; and
output a test pass signal or a test failure signal in dependence on the determination.