EPB motor drive control system and method meeting function safety and automobile

Abstract

The invention discloses an EPB motor drive control system and method meeting functional safety and an automobile, the system comprises a pre-drive chip, a control unit MCU and a first current acquisition module, the output end of the control unit MCU is connected to an H-bridge circuit through the pre-drive chip, and the H-bridge circuit drives an EPB motor; the control system further comprises a second current acquisition module, a motor voltage acquisition circuit and a turn-off circuit, the first current acquisition module and the second current acquisition module respectively acquire high-side current and low-side current of motor operation, and the output ends of the first current acquisition module and the second current acquisition module are connected to the input end of the control unit MCU; the motor voltage acquisition circuit is used for acquiring the working voltage of the motor, and the output end of the motor voltage acquisition circuit is connected to the input end of the control unit MCU; the output end of the control unit MCU is connected to the turn-off circuit, and the turn-off circuit is used for turning off the H-bridge circuit according to a control signal of the control unit MCU. The control system can improve the function safety level of the EPB motor control system.

Description

Technical Field

[0001] The present invention relates to the field of electronic parking system safety, and particularly to an EPB motor drive control system and method that meet functional safety requirements. Background Art

[0002] EPB (Electrical Park Brake) is short for electronic parking brake, which is used for long-term parking. Its core is to achieve parking brake through an EPB motor. According to the requirements of the VDA standard, the EPB system needs to ensure that the EPB motor does not perform unexpected actions during vehicle driving (ASIL-D level). To meet this functional safety requirement, the drive circuit inside the EPB controller needs to meet the functional safety requirements in terms of diagnostic coverage rate and hardware failure rate. However, currently available pre-drive chips for brushed motors on the market do not meet the ASIL-D level, and necessary safety mechanisms and detection and diagnostic circuits need to be added during hardware circuit design. When the MCU detects an unexpected action of the EPB motor, the H-bridge is timely turned off through the safety mechanism to prevent the motor from operating. This design can make the EPB motor drive circuit meet the functional safety requirements.

[0003] As Figure 1 shown, the existing technical solution only uses a pre-drive chip with a functional safety level of QM to control the H-bridge. The pre-drive chip controls the H-bridge to drive the EPB motor to operate through hardware input or SPI input signals, and at the same time, the pre-drive chip integrates current sampling for monitoring.

[0004] Figure 1 The disadvantage of the existing technical solution in is that when there is no perfect fault diagnosis and control redundancy safety mechanism inside the pre-drive chip, there is no perfect diagnostic coverage rate to determine the failure point of the pre-drive chip after the pre-drive chip fails. When the failure of the pre-drive chip causes the EPB motor to perform unexpected operations, the control unit of the EPB cannot turn off the drive function of the pre-drive chip through the conventional control interface. There is a risk that when the pre-drive chip fails, the MCU cannot judge the fault state of the pre-drive chip, resulting in unexpected actions of the H-bridge driving the motor, violating the functional safety goal. Summary of the Invention

[0005] The purpose of the present invention is to overcome the deficiencies of the prior art and provide an EPB motor drive control system and method that meet functional safety requirements. By newly designing the peripheral hardware circuit of the pre-drive chip, a new EPB motor drive system is formed to improve the functional safety requirements of EPB motor drive control.

[0006] To achieve the above object, the technical solution adopted by the present invention is as follows: An EPB motor drive control system that meets functional safety includes a pre-driver chip, a control unit MCU, and a first current acquisition module. The output end of the control unit MCU is connected to an H-bridge circuit through the pre-driver chip, and the H-bridge circuit drives the EPB motor; the control system further includes a first current acquisition module, a second current acquisition module, a motor voltage acquisition circuit, and a shutdown circuit. The first current acquisition module and the second current acquisition module respectively collect the high-side current and the low-side current of the motor operation, and their output ends are connected to the input end of the control unit MCU; the motor voltage acquisition circuit is used to collect the working voltage of the motor, and its output end is connected to the input end of the control unit MCU; the output end of the control unit MCU is connected to the shutdown circuit, and the shutdown circuit is used to shut down the H-bridge circuit according to the control signal of the control unit MCU.

[0007] Both the first current acquisition module and the second current acquisition module include a sampling resistor and an operational amplifier circuit. The sampling resistor is set at the high-side and low-side current sampling points, and terminals are led out at both ends of the sampling resistor and connected to the operational amplifier circuit. The operational amplifier circuit amplifies the current sampling signal and is used to connect to the input end of the control unit MCU.

[0008] The sampling resistor is connected in series between the H-bridge circuit and the power ground or between the H-bridge circuit and the power supply, and is used to collect the low-side current and the high-side current respectively.

[0009] The pre-driver chip is internally provided with an operational amplifier module. The operational amplifier circuit of the first current acquisition module or the second current acquisition module is implemented by using the internal operational amplifier module, and the output end of the internal operational amplifier module is connected to the input end of the control unit MCU.

[0010] The shutdown circuit is respectively connected to the gates of the two switching tubes on the low side or the gates of the two switching tubes on the high side of the H-bridge circuit.

[0011] The output end of the control unit MCU is connected to the shutdown circuit, and the shutdown circuit is used to shut down the H-bridge circuit according to the control signal of the control unit MCU. And it can output an EPB motor fault alarm signal through communication methods such as driving a hard-wired alarm light and sending a CAN message. The alarm unit can be various in-vehicle alarms, instruments, HMI interfaces, etc., and can be a sound alarm or a light alarm, etc.

[0012] A control method for an EPB motor drive control system that meets functional safety includes:

[0013] When the control unit MCU drives the EPB motor through the pre-driver chip, the control unit MCU checks the high-side current and low-side current of the motor collected. When the error between the high-side current and the low-side current exceeds the set threshold, it is determined that the operating current of the EPB motor does not meet the expected value controlled by the control unit MCU. At this time, the control unit MCU continues to complete the driving work of the EPB motor and issues a fault alarm, and then enters the safety mode. In the safety mode, the control unit MCU no longer responds to the EPB action request and maintains the EPB action state when entering the safety mode.

[0014] When the MCU is in the working state, it regularly detects the working voltage, high-side current, and low-side current of the EPB motor and checks them against the control signals output by the control unit MCU to determine whether the EPB motor operates according to the expected requirements; if not, the control unit MCU turns off the driving signal of the H-bridge circuit through the shutdown circuit, issues a fault alarm, and then enters the safety mode; if so, it continues to control the EPB motor as expected.

[0015] During the check, the expected action state of the EPB motor corresponding to the control signal output by the control unit MCU is compared with the actual action state of the EPB motor corresponding to the working voltage, high-side current, and low-side current of the EPB motor to determine whether the EPB motor operates according to the expected requirements. If the two are consistent, it is determined that the EPB motor operates according to the expected requirements; otherwise, it is determined that the EPB motor does not operate as expected.

[0016] A vehicle, characterized in that: the vehicle includes the above-mentioned EPB motor drive control system meeting functional safety and / or the control method of the above-mentioned EPB motor drive control system meeting functional safety.

[0017] The advantages of the present invention are as follows: the circuit structure is simple, reliable, easy to implement, and low in cost; through this solution, a pre-driver chip with a low safety standard combined with a hardware circuit can meet the functional requirements of the EPB motor with a high safety level, achieving the improvement of the safety and reliability of the EPB motor control system by using a low-level + hardware circuit method, saving costs while ensuring the functional safety of the system, enabling conventional pre-driver chips to be used in the EPB drive circuit meeting functional safety ASIL-D. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The following briefly describes the content expressed in each drawing of the present invention specification and the marks in the drawings:

[0019] Figure 1 It is a schematic diagram of the principle of the prior art;

[0020] Figure 2 It is a circuit schematic diagram of the first embodiment of the control system of the present invention;

[0021] Figure 3 This is the circuit schematic diagram of the second implementation of the control system of the present invention;

[0022] Figure 4 This is the circuit schematic diagram of the third implementation of the control system of the present invention;

[0023] Figure 5 This is the circuit schematic diagram of the fourth implementation of the control system of the present invention;

[0024] Figure 6 This is the flow chart of the verification method of the control method of the present invention when there is an EPB action requirement;

[0025] Figure 7 This is the flow chart of the verification method of the present invention when there is no EPB action requirement. Detailed implementation manners

[0026] The following further describes the detailed implementation manners of the present invention by describing the optimal implementation cases with reference to the accompanying drawings.

[0027] When designing the hardware circuit of the prior art, the present application needs to add necessary safety mechanisms and detection and diagnosis circuits. When the MCU detects an unexpected action of the EPB motor, the H-bridge is timely turned off through the safety mechanism to prevent the motor from moving. This design can make the EPB motor drive circuit meet the requirements of functional safety.

[0028] The present invention adds a current acquisition circuit and an H-bridge drive control turn-off circuit to the H-bridge drive circuit. The MCU simultaneously detects the two motor drive currents of the H-bridge and performs verification to improve the reliability of the current. The MCU can detect the voltage at the motor terminal 2, the motor running current, and verify with the control signal for driving the motor by the MCU to determine whether there is an unexpected action. If an unexpected action of the motor is detected, the MCU will turn off the drive signal of the pre-driver chip for driving the H-bridge through the newly added H-bridge drive control circuit, thereby turning off the H-bridge and preventing the unexpected action. By adding the corresponding hardware circuit, the hardware fault diagnosis rate of the EPB drive circuit is increased to more than 99%. The software adds a safety mechanism to make the EPB drive circuit meet the requirements of functional safety.

[0029] An EPB motor drive control system that meets functional safety in this embodiment includes a pre-driver chip, a control unit MCU, a first current acquisition module, a second current acquisition module, a motor voltage acquisition circuit, and a shutdown circuit. The input end of the control unit MCU can receive a control signal corresponding to the expected action of the EPB motor; the output end of the control unit MCU is connected to an H-bridge circuit through the pre-driver chip, and the H-bridge circuit drives the EPB motor to act to achieve the purpose of electronic parking control; the first current acquisition module and the second current acquisition module respectively acquire the high-side current and low-side current of the motor operation, and their output ends are connected to the input end of the control unit MCU;

[0030] The motor voltage acquisition circuit is used to acquire the working voltage of the motor, and its output end is connected to the input end of the control unit MCU;

[0031] The output end of the control unit MCU is connected to the shutdown circuit, and the shutdown circuit is used to shut down the H-bridge circuit according to the control signal of the control unit MCU.

[0032] Its working principle is as follows: Under normal circumstances, the control signal of the EPB action output by the MCU is executed by the pre-driver chip and then drives the EPB motor to act through the H-bridge. At this time, the MCU can judge whether the EPB motor meets the expected action state according to the two acquired current signals and voltage signals. If the judgment is yes, it means that the entire control system is normal and no processing is required. If the judgment is no, an alarm signal is output and the drive of the H-bridge can be shut down through the shutdown circuit. Because if they are inconsistent, generally it is a fault of the pre-driver chip or the like, and the pre-driver chip has been unable to work, so it is impossible to execute the shutdown of the MCU. Therefore, through the newly added shutdown circuit in this application, the purpose of shutting down the H-bridge drive can be achieved.

[0033] Both the first current acquisition module and the second current acquisition module include a sampling resistor and an operational amplifier circuit. The sampling resistor is set at the high-side and low-side current sampling points, and terminals are led out at both ends of the sampling resistor and connected to the operational amplifier circuit. The operational amplifier circuit amplifies the current sampling signal and is used to connect to the input end of the control unit MCU. The sampling resistor is connected in series between the H-bridge circuit and the power ground or between the H-bridge circuit and the power supply, and is used to respectively acquire the low-side current and the high-side current. In this embodiment, the current sampling is obtained by connecting the sampling resistor in series in the drive loop of the motor and converting it through the operational amplifier circuit. As Figure 2-5 shown, the resistor is divided into a high-side resistor for high-side current sampling and a low-side resistor for low-side current sampling; the low-side resistor is connected in series between the H-bridge circuit and the power ground, and the high-side resistor is connected in series between the power supply of the H-bridge and the H-bridge circuit. Then, terminals are led out at both ends of the high-side resistor or the low-side resistor, and the corresponding current acquisition signals are output after passing through the operational amplifier circuit. As Figure 2-5As shown, the power supply is connected to one end of the high-side resistor through an H-bridge reverse connection prevention circuit, and the other end of the high-side resistor is connected to the H-bridge; among them, the H-bridge reverse connection prevention circuit is implemented by using a switching transistor with a parasitic diode. The gate of the switching transistor is connected to the output terminal of the pre-driver chip, and the connection between the power supply and the H-bridge is controlled through the pre-driver chip; the parasitic diode is used for reverse connection prevention, its anode is connected to the power supply, and the cathode is connected to one side of the resistor.

[0034] The motor voltage acquisition circuit is used to acquire the voltage signals at both ends of the motor. It can be implemented by means of voltage-dividing resistors, voltage sensors, etc. to acquire the voltage at both ends of the motor.

[0035] The turn-off circuit is used to short the gate of the H-bridge to the ground. It can use electronic switches such as relays and MOS transistors to control the grounding of some or all of the gates of the four MOS transistors in the H-bridge. One end of the electronic switch is connected to some or all of the gates of the four MOS transistors in the H-bridge, and the other end is grounded; the gates of some or all of the MOS transistors in the H-bridge are connected to the ground through the electronic switch. The electronic switch is controlled by the MCU. When the MCU controls the electronic switch to close, the gate is pulled low to the ground at this time, achieving the purpose of turning off, and realizing shorting the MOS transistor drive to the ground with a circuit, cutting off the function of the pre-driver chip to drive the MOS transistor.

[0036] In the prior art, the pre-driver chip will integrate an internal operational amplifier module for current acquisition. Therefore, one of the two current acquisition modules in this application can reuse this module to save costs, that is, the operational amplifier circuit of the first current acquisition module or the second current acquisition module is implemented by using the internal operational amplifier module. The output terminal of the internal operational amplifier module is connected to the input terminal of the control unit MCU, so as to share and reuse a detection module and save costs.

[0037] The turn-off circuit is respectively connected to the gates of the two switching transistors on the low side or the two switching transistors on the high side of the H-bridge circuit. The turn-off circuit turns off two high-side MOSs or two low-side MOSs simultaneously, so that the entire H-bridge circuit can be cut off. By switching two high-side MOSs or two low-side MOSs, the turn-off cost can be saved, and it is not necessary to turn off all four MOSs, because closing two high sides or two low sides can cut off the H-bridge loop, and the motor can no longer work. Costs and resources can be saved.

[0038] In the embodiment of this application, the output terminal of the control unit MCU is connected to the turn-off circuit, and the turn-off circuit is used to turn off the H-bridge circuit according to the control signal of the control unit MCU. And it can output the EPB motor fault alarm signal through communication methods such as driving a hard-wired alarm light and sending a CAN message. The alarm unit can be various vehicle-mounted alarms, meters, HMI interfaces, etc., and can be a sound alarm or a light alarm, etc.

[0039] Such as Figure 2-5As shown below are four implementation methods of the circuit of the present application, where Figure 2 is the circuit diagram of the pre-driver chip with a built-in operational amplifier module for collecting low-side current and a shutdown circuit for shutting down the two MOS transistors at the lower part of the H-bridge; Figure 3 is the circuit diagram of the pre-driver chip with a built-in operational amplifier module for collecting high-side current and a shutdown circuit for shutting down the two MOS transistors at the lower part of the H-bridge; Figure 4 is the circuit diagram of the pre-driver chip with a built-in operational amplifier module for collecting low-side current and a shutdown circuit for shutting down the two MOS transistors at the upper part of the H-bridge; Figure 5 is the circuit diagram of the pre-driver chip with a built-in operational amplifier module for collecting high-side current and a shutdown circuit for shutting down the two MOS transistors at the upper part of the H-bridge.

[0040] The working principle of the circuit in the above embodiments includes: the operating state of the motor can be judged based on the dual-current data. When the error of the dual-current data is greater than the set threshold, it is judged that a fault exists, and an alarm can be issued in a timely manner; at the same time, the real-time action state of the EPB motor can be judged according to the dual-current and voltage signals and compared with the required action state to judge whether the action state meets the expectation and an alarm reminder is given. By comparing and judging the collected data, the detection of faults can be accurately and quickly realized, ensuring the reliable operation of the function, and an alarm is issued in a timely manner when the function is abnormal, so as to meet the requirements of the function level.

[0041] This embodiment also provides a control method for an EPB motor drive control system that meets functional safety, including: when the control unit MCU drives the EPB motor through the pre-driver chip, the control unit MCU checks the high-side current and low-side current of the motor collected. When the error between the high-side current and the low-side current exceeds the set threshold, it is judged that the operating current of the EPB motor does not meet the expected value controlled by the control unit MCU. At this time, the control unit MCU continues to complete the driving work of the EPB motor and issues a fault alarm, and then enters the safe mode. In the safe mode, the control unit MCU no longer responds to the EPB action request and maintains the EPB action state when entering the safe mode.

[0042] When the MCU is in the working state, it regularly detects the working voltage, high-side current, and low-side current of the EPB motor and checks them against the control signal output by the control unit MCU to judge whether the EPB motor operates according to the expected requirements; if not, the control unit MCU closes the drive signal of the H-bridge circuit through the shutdown circuit, issues a fault alarm, and then enters the safe mode; if so, it continues to control the EPB motor as expected.

[0043] During verification, the expected operation state of the EPB motor corresponding to the control signal output by the control unit MCU is compared with the actual operation state of the EPB motor corresponding to the working voltage, high-side current, and low-side current of the EPB motor to determine whether the EPB motor operates as expected. If the two are consistent, it is determined that the EPB motor operates as expected; otherwise, it is determined that the EPB motor does not operate as expected.

[0044] This embodiment also provides a vehicle, which includes the EPB motor drive control system meeting functional safety in this embodiment and / or the control method of the EPB motor drive control system meeting functional safety in this embodiment.

[0045] As Figure 6 、 7 shown, it is a logic method flowchart for H-bridge turn-off control respectively; when the ECU is in the working state (the ECU refers to the EPB controller), when receiving an instruction to drive the EPB motor, the MCU will issue a corresponding control instruction for the EPB motor, control the H-bridge circuit through the pre-driver chip, and at the same time detect the motor voltage, high-side current, and low-side current respectively, and then perform verification with the control signal. The control signal used to control the motor operation state is verified with the motor voltage, high-side current, and low-side current to determine whether the operation state is consistent with the expectation. If so, the motor continues to operate. If not, the MCU turns off the H-bridge drive signal, lights up the fault lamp, and enters the safe state mode.

[0046] When it is not necessary to drive the EPB motor, the MCU periodically starts to detect the motor voltage, high-side current, and low-side current respectively, and determines whether the motor is operating based on the motor voltage, high-side current, and low-side current. If not, no processing is performed. If so, it means that it is inconsistent with the expectation. At this time, the MCU turns off the H-bridge drive signal, lights up the fault lamp, and enters the safe state mode.

[0047] At the hardware level of this embodiment, 1 current acquisition circuit and an H-bridge drive control turn-off circuit are added to the H-bridge circuit. The MCU improves the reliability of the current by detecting and verifying the 2 motor drive currents of the H-bridge. When the MCU needs to drive the motor to run, it detects the voltage and running current at the 2 terminals of the motor and verifies them with the control signal for the MCU to drive the motor to determine whether the EPB motor operates according to the set requirements; if it is detected that the EPB motor has an unexpected operation, the MCU will turn off the drive signal of the pre-driver chip to drive the H-bridge through the H-bridge drive control circuit, thereby turning off the H-bridge and preventing the unexpected operation. Enabling conventional pre-driver chips to be used in the EPB drive circuit meeting functional safety ASIL-D.

[0048] To meet the functional safety goal, a safety mechanism for pre-driver chip failure is added as follows:

[0049] Safety mechanism 1:

[0050] A conventional pre-driver chip has 1 built-in current sampling operational amplifier. Based on the conventional pre-driver chip, the present invention adds 1 current acquisition circuit. When the MCU drives the EPB motor, it will verify the 2 current sampling signals. When it is found that the error between the 2 current sampling signals exceeds a certain value, it is determined that the operating current of the EPB motor does not meet the expected value controlled by the MCU, that is, the difference obtained by subtracting the two current signals is compared with a preset threshold. When the difference exceeds the set threshold, it is determined that the operating current of the EPB motor does not meet the expected value controlled by the MCU. At this time, the MCU will perform a fault alarm and enter the safety mode according to the driving function currently being executed by this EPB motor. After the fault, it will continue to complete the EPB driving work, such as clamping or releasing, and at the same time, it will report to the driver through the instrument that there is a fault in the EPB system. Entering the safety state means that after a fault occurs, it will no longer respond to the EPB action request and remain in the state after the fault occurs, which may be the clamping or releasing state.

[0051] Safety mechanism 2:

[0052] A conventional pre-driver chip controls the H-bridge to drive the EPB motor to run through hardware input or SPI input signals. When the failure of the pre-driver chip causes the EPB motor to operate unexpectedly, the MCU cannot turn off the driving function of the pre-driver chip through the conventional control interface. By adding an H-bridge drive control shutdown circuit, the MCU can directly control the H-bridge drive signal without passing through the pre-driver chip, thereby turning off the H-bridge and preventing the unexpected operation of the EPB motor, ensuring that the hardware drive circuit of the EPB motor meets the functional safety requirements.

[0053] Safety mechanism 3:

[0054] At the software level, the MCU will regularly detect the working state of the EPB motor to ensure that the EPB motor is in a stopped state when it does not need to work. When it is necessary to drive the EPB motor to act, the MCU obtains the real-time operating state of the EPB motor by collecting the drive terminal voltage signal and 2 drive current sampling signals of the EPB motor, and then verifies it with the output control signal of the MCU to determine whether the EPB motor is operating as required. When the operating state of the motor is incorrect due to a hardware circuit failure (such as incorrect rotation direction or inability to stop), the MCU can directly turn off the H-bridge circuit by bypassing the pre-driver chip to stop the EPB motor from running. When the 2 drive current verifications are incorrect due to a hardware circuit failure, the MCU will perform a fault alarm and enter the safety mode according to the driving function currently being executed by this EPB motor, in accordance with the functional safety objectives defined by the VDA standard.

[0055] In the present invention, at the hardware level, a current acquisition circuit and an H-bridge drive control shutdown circuit are added to the H-bridge circuit. The MCU detects the two-way motor drive current of the H-bridge and performs verification to improve the reliability of the current. When the MCU needs to drive the motor to run, it detects the voltage and running current at the two ends of the motor terminal and verifies them with the control signal for driving the motor by the MCU to determine whether the EPB motor operates according to the set requirements; if it is detected that the EPB motor has an unexpected operation, the MCU will turn off the drive signal for driving the H-bridge by the pre-driver chip through the H-bridge drive control circuit, thereby shutting down the H-bridge to prevent the unexpected operation. Enabling conventional pre-driver chips to be used in the EPB drive circuit that meets the functional safety ASIL-D.

[0056] The advantage of this embodiment is that at the hardware level, a current acquisition circuit and an H-bridge drive control shutdown circuit are added to the H-bridge circuit. At the software level, a set of safety mechanism designs that meet functional safety are provided to ensure the safety of the motor drive circuit. By using software algorithms to detect the motor voltage and motor current and compare them with the drive control signal of the MCU, it can be diagnosed within the fault tolerance time whether the EPB motor operates as expected according to the functional target. When an unexpected operation of the motor is detected, the MCU can prevent the motor from operating through the H-bridge drive control shutdown circuit. And send a fault message to the HMI, and finally display the fault message through the instrument to alert the driver, and the system enters a safe state.

[0057] Obviously, the specific implementation of the present invention is not limited by the above methods. As long as various non-substantive improvements are made by adopting the method concept and technical solution of the present invention, they are all within the protection scope of the present invention.

Claims

1. An EPB motor drive control system meeting functional safety requirements, comprising a pre-driver chip, a control unit MCU, and a first current acquisition module. The output end of the control unit MCU is connected to an H-bridge circuit through the pre-driver chip, and the H-bridge circuit drives the EPB motor. It is characterized in that: The control system further includes a second current acquisition module, a motor voltage acquisition circuit, and a shutdown circuit. The first current acquisition module and the second current acquisition module respectively acquire the high-side current and the low-side current of the motor operation, and their output terminals are connected to the input terminal of the control unit MCU; the motor voltage acquisition circuit is used to acquire the working voltage of the motor, and its output terminal is connected to the input terminal of the control unit MCU; the output terminal of the control unit MCU is connected to the shutdown circuit, and the shutdown circuit is used to shut down the H-bridge circuit according to the control signal of the control unit MCU.

2. The EPB motor drive control system meeting functional safety as claimed in claim 1, wherein: Both the first current acquisition module and the second current acquisition module include a sampling resistor and an operational amplifier circuit. The sampling resistor is set at the high-side and low-side current sampling points, and terminals are led out at both ends of the sampling resistor and connected to the operational amplifier circuit. The output terminal of the operational amplifier circuit leads out a sampling current output terminal for connecting to the input terminal of the control unit MCU.

3. The EPB motor drive control system meeting functional safety as claimed in claim 2, characterized in that: The sampling resistor is connected in series between the H-bridge circuit and the power ground or between the H-bridge circuit and the power supply, and is used to acquire the low-side current and the high-side current respectively.

4. A functional safety compliant EPB motor drive control system as claimed in claim 1 or 2, characterized in that: The pre-driver chip is internally provided with an internal operational amplifier module. The operational amplifier circuit of the first current acquisition module or the second current acquisition module is implemented by the internal operational amplifier module, and the output terminal of the internal operational amplifier module is connected to the input terminal of the control unit MCU.

5. A functional safety-compliant EPB motor drive control system according to any one of claims 1-3, characterized in that: The shutdown circuit is respectively connected to the gates of the two switching tubes on the low side or the gates of the two switching tubes on the high side of the H-bridge circuit.

6. A kind of EPB motor drive control system meeting functional safety according to any one of claims 1-3, characterized in that: The output terminal of the control unit MCU is connected to the fault alarm unit for outputting an EPB motor fault alarm signal.

7. A control method for an EPB motor drive control system that meets functional safety as described in any one of claims 1-6, characterized in that: Including: When the control unit MCU drives the EPB motor through the pre-driver chip, the control unit MCU performs verification through the acquired high-side current and low-side current of the motor. When the error between the high-side current and the low-side current exceeds the set threshold, it is determined that the operating current of the EPB motor does not meet the expected value controlled by the control unit MCU. At this time, the control unit MCU continues to complete the driving work of the EPB motor and gives a fault alarm, and then enters the safe mode. In the safe mode, the control unit MCU no longer responds to the EPB action request and maintains the EPB action state when entering the safe mode.

8. The control method of an EPB motor drive control system meeting functional safety as claimed in claim 7, characterized in that: When the MCU is in the working state, it regularly detects the working voltage, high-side current, and low-side current of the EPB motor and verifies them with the control signal output by the control unit MCU to determine whether the EPB motor operates according to the expected requirements; if not, the control unit MCU closes the driving signal of the H-bridge circuit through the shutdown circuit, gives a fault alarm, and then enters the safe mode; if so, it continues to control the EPB motor as expected.

9. The control method of an EPB motor drive control system meeting functional safety as claimed in claim 8, wherein: During verification, the expected operating state of the EPB motor corresponding to the control signal output by the control unit MCU is compared with the actual operating state of the EPB motor corresponding to the operating voltage, high-side current, and low-side current of the EPB motor to determine whether the EPB motor operates as expected. If the two are consistent, it is determined that the EPB motor operates as required; otherwise, it is determined that the EPB motor does not operate as expected.

10. A vehicle, characterized in that: The vehicle includes the EPB motor drive control system meeting functional safety as described in any one of claims 1-6 and / or the control method of the EPB motor drive control system meeting functional safety as described in any one of claims 7-9.

Images