Full-link redundancy EMB control system and method without master controller

Abstract

The invention discloses a full-link redundancy EMB control system and method without a main controller, and belongs to the field of braking systems, the full-link redundancy EMB control system comprises a front axle control module, a rear axle control module and four EMB actuators, the front axle control module comprises a first control module and a second control module, and the rear axle control module comprises a third control module and a fourth control module; the four EMB actuators are respectively mounted on four wheels of a vehicle, and the first control module, the second control module, the third control module and the fourth control module are respectively connected with the four EMB actuators; the front axle control module and the rear axle control module are both connected with the whole vehicle CAN of the vehicle, the front axle control module and the rear axle control module are connected through the internal CAN, and therefore the redundant design of vehicle braking can be achieved, and the reliability of vehicle braking is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of brake systems, and in particular relates to a full-link redundant EMB control system and method without a master controller. Background Art

[0002] As a core element of vehicle safety, automotive braking systems have undergone significant technological evolution, from mechanical braking to hydraulic braking and finally to brake-by-wire. Electromechanical braking systems, with their revolutionary technical architecture and superior performance, are becoming the ultimate solution in the brake-by-wire field. Electromechanical braking (EMB) is a braking technology controlled entirely by electronic signals. It eliminates the hydraulic lines and brake fluid components of traditional hydraulic braking systems, applying and releasing braking force directly through a motor-driven brake caliper.

[0003] Currently, the most common EMB control system utilizes a "single central controller + distributed actuator" architecture. Specifically, the EMB control system comprises a central controller and four distributed actuators, one located on each of the vehicle's wheels. Each of the four distributed actuators is connected to the central controller. This architecture allows the central controller to control the four distributed actuators, achieving vehicle braking. However, this EMB control system presents the risk of a single point of failure. If the central controller fails, the four distributed actuators will not function properly, causing the vehicle's braking function to degrade or even fail, compromising its reliability. Summary of the Invention

[0004] In order to solve the above problems existing in the prior art, the present invention provides a full-link redundant EMB control system and method without a master controller. The technical problem to be solved by the present invention is achieved through the following technical solutions: In a first aspect, the present invention provides a full-link redundant EMB control system without a master controller, including a front axle control module, a rear axle control module, and four EMB actuators, wherein the front axle control module includes a first control module and a second control module, and the rear axle control module includes a third control module and a fourth control module; Four EMB actuators are respectively installed on four wheels of the vehicle, and the first control module, the second control module, the third control module and the fourth control module are respectively connected to the four EMB actuators; The front axle control module and the rear axle control module are both connected to the vehicle's entire CAN, and the front axle control module and the rear axle control module are connected via an internal CAN.

[0005] In one embodiment of the present invention, the present invention further comprises a power battery, a first power supply line and a second power supply line, wherein one end of the first power supply line and the second power supply line are both connected to the power battery; The first control module and the third control module are both connected to the first power supply line, and the second control module and the fourth control module are both connected to the second power supply line.

[0006] In one embodiment of the present invention, the present invention further comprises a first storage battery and a second storage battery, wherein the first storage battery is connected to the first power supply line, and the second storage battery is connected to the second power supply line.

[0007] In one embodiment of the present invention, the system further includes a first DC / DC converter and a second DC / DC converter. The first DC / DC converter is provided in the first power supply line, and the second DC / DC converter is provided in the second power supply line.

[0008] In one embodiment of the present invention, a rotation angle sensor, a yaw angle sensor and a wheel speed sensor are further included, and the rotation angle sensor, the yaw angle sensor and the wheel speed sensor are all connected to the power battery; The steering angle sensor, yaw angle sensor and wheel speed sensor are all connected to the front axle control module and the rear axle control module, and the front axle control module and the rear axle control module are both used to receive vehicle status signals; The vehicle status signal includes wheel speed information, steering angle signal and yaw angle status.

[0009] In one embodiment of the present invention, the invention further includes a brake pedal, a first communication line and a second communication line, wherein one end of the first communication line and the second communication line are both connected to the brake pedal, and the other ends are respectively connected to the first control module and the second control module; The first control module, the second control module, the third control module and the fourth control module are all connected to the vehicle CAN. The EMB control system also includes an EPB switch, which is connected to the vehicle CAN.

[0010] In a second aspect, the present invention provides a full-link redundant EMB control method without a master controller, including a full-link redundant EMB control system without a master controller as provided in any of the above solutions, the EMB control system including a front axle control module, a rear axle control module, and four EMB actuators, the front axle control module including a first control module and a second control module, the rear axle control module including a third control module and a fourth control module, the method comprising: The front axle control module and the rear axle control module receive upper-layer commands from the vehicle CAN in parallel and independently; The front axle control module and the rear axle control module share the received upper-layer commands through the internal CAN and cross-check them; When it is confirmed that the upper-level instructions are valid and consistent, the front axle control module issues a braking action command to the first control module and the second control module, and the rear axle control module issues a braking action command to the third control module and the fourth control module; The first control module, the second control module, the third control module and the fourth control module respectively drive four EMB actuators to achieve wheel braking; The upper-level instructions include one or more of driver instructions, automatic / assisted driving system instructions, and sensor instructions.

[0011] In one embodiment of the present invention, after the steps of sharing the received upper layer instructions and cross-checking the instructions via the internal CAN by the front axle control module and the rear axle control module, the following steps are further included: When one of the front axle control module and the rear axle control module fails, the other module immediately triggers fault diagnosis and assesses the fault level. At the same time, the other module actively takes over the control authority of the braking system. Among them, another module calculates and re-optimizes the distribution of braking force required for the four wheels based on the original upper-level braking instructions received, real-time vehicle status information and preset safety control algorithms, ensuring that even in the event of a single-point failure, the vehicle can still maintain a stable and controllable braking deceleration, avoid deviation or instability, and achieve safe braking.

[0012] In one embodiment of the present invention, the EMB control system further includes an EPB switch, and the EPB switch is connected to the vehicle CAN; After the front axle control module and the rear axle control module share the received upper layer instructions through the internal CAN and cross-check the steps, the following steps are also included: The four EMB actuators respectively receive and store operating information transmitted by the first control module, the second control module, the third control module, and the fourth control module, wherein the operating information includes one or more of the most recently confirmed valid braking command, the real-time wheel speed signal, the backup vehicle reference speed estimation value, the actuator's own state, and the preset simplified safety braking rule; When both the front axle control module and the rear axle control module fail, the four EMB actuators switch from passive execution mode to active control mode. The four EMB actuators independently calculate and output corresponding braking forces based on their stored working information, and brake the four wheels of the vehicle according to the braking forces; When the front axle control module, rear axle control module and four EMB actuators fail, the EPB switch obtains the trigger instruction through the vehicle CAN, applies the maximum clamping force to tighten the parking brake caliper, and provides a nonlinear effective braking force to ensure that the vehicle speed is reduced to the absolute safety threshold.

[0013] In one embodiment of the present invention, the method further comprises: When the commands received by the front axle control module and the rear axle control module conflict, the safety levels of the conflicting commands are compared; When conflicting instructions have different security levels, the instruction with the higher security level will be executed first; When the security levels of conflicting instructions are the same, the credibility weights of the instruction sources are calculated, and the priority instruction is determined based on the sensor verification mechanism and the response speed of the EMB actuator.

[0014] Compared with the prior art, the present invention has the following beneficial effects: In the above scheme of the present application, the EMB control system includes a front axle control module, a rear axle control module and four EMB actuators. The front axle control module includes a first control module and a second control module, and the rear axle control module includes a third control module and a fourth control module; the four EMB actuators are respectively installed on the four wheels of the vehicle, and the first control module, the second control module, the third control module and the fourth control module are respectively connected to the four EMB actuators; the front axle control module and the rear axle control module are both connected to the vehicle's whole vehicle CAN, and the front axle control module and the rear axle control module are connected through an internal CAN. With this structure, the present application controls the actions of two of the four EMB actuators through the first control module and the second control module of the front axle control module, thereby controlling the braking of two wheels of the vehicle; and controls the actions of the remaining two of the four EMB actuators through the third control module and the fourth control module of the rear axle control module, thereby controlling the braking of the other two wheels of the vehicle. The above-mentioned scheme of the present application eliminates the central main controller, and the four EMB actuators are independently controlled by the first control module, the second control module, the third control module and the fourth control module respectively. When one of the control modules fails, the remaining control modules can still work normally, thereby avoiding the single point failure risk of the EMB control system. Moreover, when one of the control modules fails, the remaining control modules can automatically take over the EMB actuator corresponding to the failed control module, ensuring that the braking function of the EMB actuator is normal, avoiding degradation or failure of the vehicle's braking function, realizing redundant control of the EMB control system, and improving the safety and reliability of vehicle braking.

[0015] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 This is a schematic diagram of the EMB control system in an embodiment of the present invention. Figure 1 ; Figure 2 This is a schematic diagram of the EMB control system in an embodiment of the present invention. Figure 2 ; Figure 3Schematic diagram of the decision-making process of the EMB control system in an embodiment of the present invention; Figure 4 Schematic diagram of the EMB control method in an embodiment of the present invention.

[0017] Figure markings: 1-front axle control module, 2-rear axle control module, 3-EMB actuator, 4-power battery, 5-first power supply line, 6-second power supply line, 7-first battery, 8-second battery, 9-first DC / DC converter, 10-second DC / DC converter, 11-brake pedal, 12-EPB switch. DETAILED DESCRIPTION

[0018] The present invention will be further described in detail below with reference to specific examples, but the embodiments of the present invention are not limited thereto.

[0019] Example 1: See Figure 1 、 Figure 2 and Figure 3 An embodiment of the present invention provides a full-link redundant EMB control system without a master controller, including a front axle control module 1, a rear axle control module 2 and four EMB actuators 3. The front axle control module 1 includes a first control module and a second control module, and the rear axle control module 2 includes a third control module and a fourth control module; the four EMB actuators 3 are respectively installed on the four wheels of the vehicle, and the first control module, the second control module, the third control module and the fourth control module are respectively connected to the four EMB actuators 3; the front axle control module 1 and the rear axle control module 2 are both connected to the vehicle's whole vehicle CAN, and the front axle control module 1 and the rear axle control module 2 are connected through an internal CAN.

[0020] In some embodiments of the present application, Figure 2 As shown, the four EMB actuators 3 are the first EMB actuator 3, the second EMB actuator 3, the third EMB actuator 3 and the fourth EMB actuator 3. The first EMB actuator 3 is connected to the first control module, the second EMB actuator 3 is connected to the second control module, the third EMB actuator 3 is connected to the third control module, and the fourth EMB actuator 3 is connected to the fourth control module.

[0021] In some embodiments of the present application, the vehicle includes a left front wheel, a right front wheel, a left rear wheel and a right rear wheel, the first EMB actuator 3 is installed on the left front wheel, the second EMB actuator 3 is installed on the right front wheel, the third EMB actuator 3 is installed on the left rear wheel, and the fourth EMB actuator 3 is installed on the right rear wheel.

[0022] In some embodiments of the present application, the first control module, the second control module, the third control module, and the fourth control module may be independent micro control units (MCUs).

[0023] In some embodiments of the present application, CAN (Controller Area Network) is the core network protocol used for communication between control units (ECUs) in automotive electronic systems. The vehicle CAN transmits data information to the front axle control module 1 and the rear axle control module 2 through communication lines, and the internal CAN uses communication lines to realize data exchange between the front axle control module 1 and the rear axle control module 2.

[0024] In some embodiments of the present application, the front axle control module 1 and the rear axle control module 2 are connected via an internal CAN, so that the front axle control module 1 and the rear axle control module 2 can form a dual-controller peer architecture. When one of the front axle control module 1 and the rear axle control module 2 fails, the other can continue to work.

[0025] In the above scheme of the present application, the EMB control system includes a front axle control module 1, a rear axle control module 2 and four EMB actuators 3. The front axle control module 1 includes a first control module and a second control module, and the rear axle control module 2 includes a third control module and a fourth control module; the four EMB actuators 3 are respectively installed on the four wheels of the vehicle, and the first control module, the second control module, the third control module and the fourth control module are respectively connected to the four EMB actuators 3; the front axle control module 1 and the rear axle control module 2 are both connected to the vehicle's whole vehicle CAN, and the front axle control module 1 and the rear axle control module 2 are connected through an internal CAN. With this structure, the present application controls the actions of two of the four EMB actuators 3 through the first control module and the second control module of the front axle control module 1, thereby controlling the braking of two wheels of the vehicle; and controls the actions of the remaining two of the four EMB actuators 3 through the third control module and the fourth control module of the rear axle control module 2, thereby controlling the braking of the other two wheels of the vehicle. The above-mentioned scheme of the present application eliminates the central main controller, and the four EMB actuators 3 are independently controlled by the first control module, the second control module, the third control module and the fourth control module respectively. When one of the control modules fails, the remaining control modules can still operate normally, thereby avoiding the single point failure risk of the EMB control system. Moreover, when one of the control modules fails, the remaining control modules can automatically take over the EMB actuator 3 corresponding to the failed control module, ensuring that the braking function of the EMB actuator 3 is normal, avoiding degradation or failure of the vehicle's braking function, realizing redundant control of the EMB control system, and improving the safety and reliability of vehicle braking.

[0026] It is understood that the EMB control system described in this application achieves fault tolerance with zero switching delay through multi-controller peer-to-peer collaborative decision-making and multi-controller collaboration. The system meets the ASIL-D safety level and optimizes communication load balancing, which can meet the extreme braking safety requirements of high-level autonomous driving. This application can reduce communication delays by more than 40%. The EMB control system described in this application eliminates the traditional central master control node through a distributed controller peer-to-peer network (4 or more nodes interconnected) and a dynamic arbitration mechanism. This ensures that if any single controller fails, the remaining controllers automatically take over control of the failed wheel, and the braking command output is uninterrupted (switching delay <5ms). The braking force distribution of the entire system maintains 100% of the designed capacity, achieving the ASIL-D standard's rigid requirement that "single point failure does not result in functional degradation."

[0027] In some embodiments of the present application, the EMB control system further includes a power battery 4, a first power supply line 5, and a second power supply line 6, one end of each of which is connected to the power battery 4; the first control module and the third control module are both connected to the first power supply line 5, and the second control module and the fourth control module are both connected to the second power supply line 6. With this structure, the power battery 4 supplies power to the first, second, third, and fourth control modules, ensuring the normal operation of the front axle control module 1 and the rear axle control module 2.

[0028] In some embodiments of the present application, the EMB control system further includes a first battery 7 and a second battery 8. The first battery 7 is connected to the first power supply line 5, and the second battery 8 is connected to the second power supply line 6. With this structure, when the power battery 4 fails or fails, the first battery 7 and the second battery 8 can operate independently to power the connected control modules, thereby ensuring the safe operation of the front axle control module 1, the rear axle control module 2, and the EMB actuator 3.

[0029] In some embodiments of the present application, both the first battery 7 and the second battery 8 are 24V.

[0030] In some embodiments of the present application, the two EMB actuators 3 connected to the first battery 7 are arranged diagonally, and the two EMB actuators 3 connected to the second battery 8 are also arranged diagonally. That is, the first battery 7 is connected to the right front wheel and the left rear wheel, and the second battery 8 is connected to the left front wheel and the right rear wheel.

[0031] In some embodiments of the present application, the first battery 7 supplies power to the first control module and the third control module via the first power supply line 5 , and the second battery 8 supplies power to the second control module and the fourth control module via the second power supply line 6 .

[0032] In some embodiments of the present application, the EMB control system further includes a first DC / DC converter 9 and a second DC / DC converter 10. The first DC / DC converter 9 is disposed in the first power supply line 5, and the second DC / DC converter 10 is disposed in the second power supply line 6. With this structure, a DC / DC converter (DC-DC converter) is a power electronic device used to convert one DC voltage into another to meet the power supply requirements of different on-board electronic devices.

[0033] In some embodiments of the present application, the first DC / DC converter 9 is located between the power battery 4 and the first storage battery 7 , and the second DC / DC converter 10 is located between the power battery 4 and the second storage battery 8 .

[0034] In some embodiments of the present application, the power battery 4, the first power supply line 5, the second power supply line 6, the first storage battery 7, the second storage battery 8, the first DC / DC converter 9 and the second DC / DC converter 10 can construct a dual power supply channel to form a ring power supply structure, so that a single battery can support the power supply of four wheels and meet the 18% slope parking requirement. The present application utilizes a dual DC / DC circuit and a 24V main / backup battery design to achieve seamless connection of the backup power supply when the main power supply fails to ensure the normal operation of the core functions. The response time of the MOSFET protection circuit in the present application is less than 1ms.

[0035] In some embodiments of the present application, the EMB control system further includes a steering angle sensor, a yaw angle sensor, and a wheel speed sensor, all of which are connected to the power battery 4. The steering angle sensor, yaw angle sensor, and wheel speed sensor are all connected to the front axle control module 1 and the rear axle control module 2, each of which is configured to receive vehicle status signals. The vehicle status signals include wheel speed information, steering angle signals, and yaw angle status. With this structure, the front axle control module 1 and the rear axle control module 2 obtain vehicle status information through the steering angle sensor, yaw angle sensor, and wheel speed sensor, thereby precisely controlling the timing of the EMB actuator 3's operation and improving the accuracy of braking control.

[0036] In some embodiments of the present application, a wheel speed sensor (WSS) is a sensor used to monitor the rotation speed of each wheel and transmit the detection information to the central controller.

[0037] In some embodiments of the present application, the rotation angle sensor is a sensor used to accurately measure the rotation angle, rotation position or rotation speed of an object.

[0038] In some embodiments of the present application, a yaw rate sensor is a sensor used to measure the angular velocity of an object rotating around an axis perpendicular to the ground, and is often referred to as a yaw rate sensor.

[0039] In some embodiments of the present application, the EMB control system further includes a brake pedal 11, a first communication line, and a second communication line. One end of each of the first and second communication lines is connected to the brake pedal 11, and the other end is connected to the first and second control modules, respectively. The first, second, third, and fourth control modules are all connected to the vehicle CAN. The EMB control system further includes an EPB switch 12, which is connected to the vehicle CAN. With this structure, the brake pedal 11 is connected to both sides of the front axle control module 1 via two independent channels, providing a pedal input signal. If one communication line fails, the signal can be transmitted via the other communication line, ensuring that the brake signal from the brake pedal 11 is properly transmitted to the front axle control module 1 and the rear axle control module 2, thereby improving the safety and reliability of vehicle braking. Furthermore, if both the front axle control module 1 and the rear axle control module 2 fail, the EPB switch 12 can receive signals from the vehicle CAN to implement emergency braking, further improving the safety and reliability of vehicle braking.

[0040] Example 2: See Figure 4 The second embodiment of the present invention further provides a full-link redundant EMB control method without a master controller, including the full-link redundant EMB control system without a master controller as provided in the first embodiment above, the EMB control system including a front axle control module, a rear axle control module, and four EMB actuators, the front axle control module including a first control module and a second control module, and the rear axle control module including a third control module and a fourth control module, the method comprising: The front axle control module and the rear axle control module receive upper-layer commands from the vehicle CAN in parallel and independently; The front axle control module and the rear axle control module share the received upper-layer commands through the internal CAN and cross-check them; When it is confirmed that the upper-level instructions are valid and consistent, the front axle control module issues a braking action command to the first control module and the second control module, and the rear axle control module issues a braking action command to the third control module and the fourth control module; The first control module, the second control module, the third control module and the fourth control module respectively drive four EMB actuators to achieve wheel braking; The upper-level instructions include one or more of driver instructions, automatic / assisted driving system instructions, and sensor instructions.

[0041] The beneficial effects of the second embodiment of the present invention and its various implementations can be analyzed with reference to the beneficial effects of the first embodiment and its various implementations, and will not be repeated here.

[0042] It can be understood that the front axle control module and the rear axle control module receive upper-level instructions from the vehicle CAN in parallel and independently. To ensure the consistency of the instructions, the two axle control modules share the received upper-level instructions through the internal CAN and cross-check them. After confirming that the instructions are valid and consistent, they synchronously issue braking action commands to the two sub-modules in their respective areas. The sub-modules then drive the connected EMB actuator to convert the electronic control instructions into mechanical clamping force acting on the brake disc.

[0043] In some embodiments of the present application, after the front axle control module and the rear axle control module share the received upper-level instructions through the internal CAN and cross-check the steps, the following further includes: when one of the front axle control module and the rear axle control module fails, the other module immediately triggers fault diagnosis and assesses the fault level, and at the same time, the other module actively takes over the control authority of the braking system; wherein, based on the received original upper-level braking instructions, real-time vehicle status information, and a preset safety control algorithm, the other module calculates and re-optimizes the distribution of the braking force required for the four wheels to ensure that even in the event of a single point failure, the vehicle can still maintain a stable and controllable braking deceleration, avoid deviation or instability, and achieve safe braking. Using this method, the front axle control module and the rear axle control module receive upper-level instructions from the vehicle CAN in parallel and independently. When one of the modules fails, the other module actively takes over the control authority of the braking system, avoiding the impact of the control module failure on the vehicle's braking, thereby improving the safety and reliability of the vehicle's braking. In addition, another module triggers fault diagnosis and evaluates the fault level. Based on the original upper-level braking instructions, real-time vehicle status information and preset safety control algorithms, it calculates and re-optimizes the distribution of the braking force required for the four wheels, ensuring that even in the event of a single-point failure, the vehicle can still maintain a stable and controllable braking deceleration, avoid deviation or instability, and achieve safe braking.

[0044] In some embodiments of the present application, the vehicle status information includes wheel speed information, steering angle signal, and yaw angle status.

[0045] It can be understood that the front axle control module and the rear axle control module realize real-time, two-way status mutual inspection through the internal CAN. If one of the axle control modules fails, the other will immediately trigger fault diagnosis and evaluate the fault level, and actively take over the control authority of the braking system. The takeover module calculates and re-optimizes the braking force required for the four wheels based on the original upper-level braking instructions received, real-time vehicle status information and preset safety control algorithms, ensuring that even in the event of a single point failure, the vehicle can still maintain a stable and controllable braking deceleration, avoid deviation or instability, and achieve safe braking.

[0046] In some embodiments of the present application, the EMB control system further includes an EPB switch, which is connected to the vehicle CAN; after the front axle control module and the rear axle control module share the received upper-layer instructions through the internal CAN and cross-check the steps, the following steps are further included: The four EMB actuators respectively receive and store operating information transmitted by the first control module, the second control module, the third control module, and the fourth control module, wherein the operating information includes one or more of the most recently confirmed valid braking command, the real-time wheel speed signal, the backup vehicle reference speed estimation value, the actuator's own state, and the preset simplified safety braking rule; When both the front axle control module and the rear axle control module fail, the four EMB actuators switch from passive execution mode to active control mode. The four EMB actuators independently calculate and output corresponding braking forces based on their stored working information, and brake the four wheels of the vehicle according to the braking forces; If the front and rear axle control modules (FACMs), as well as the four EMB actuators, all fail, the EPB switch receives a trigger command via the vehicle CAN and applies maximum clamping force to tighten the parking brake caliper, providing a nonlinear, effective braking force to reduce the vehicle speed to an absolute safety threshold. With this approach, if both the FCM and RCMs fail, the four EMB actuators can independently take over braking for their respective wheels and proactively control wheel braking based on historically stored data, preventing the vehicle's braking from being affected by control module failures and further improving braking safety and reliability. Furthermore, if both the FCM and RCMs, as well as the four EMB actuators, fail, the EPB switch receives a trigger command via the vehicle CAN and applies maximum clamping force to tighten the parking brake caliper, thus achieving a triple-redundant braking design that fully ensures braking safety and reliability.

[0047] Understandably, to address dual-controller failure scenarios, the system provides local intelligence and information backup capabilities to the EMB actuators. Under normal operating conditions, the four EMB actuators continuously receive and back up critical operating information from their directly subordinate submodules, including but not limited to: the most recently confirmed valid braking command, real-time wheel speed signals, backed-up vehicle reference speed estimates, the actuator's own status, and preset simplified safety braking rules. During this time, the EMB actuators primarily operate in passive execution mode. In the event of a simultaneous failure of both axle control modules, resulting in a complete loss of control commands, each EMB actuator immediately switches from passive execution mode to active control mode, taking over the braking task for its own wheel. Each EMB actuator independently controls the braking of each wheel based on the last valid backup information stored locally.

[0048] In some embodiments of the present application, the method further comprises: When the commands received by the front axle control module and the rear axle control module conflict, the safety levels of the conflicting commands are compared; When conflicting instructions have different security levels, the instruction with the higher security level will be executed first; When conflicting commands have the same safety level, the system calculates the credibility weights of the command sources and prioritizes the command based on the sensor verification mechanism and the response speed of the EMB actuator. This approach, through a priority comparison strategy, avoids command conflicts and ensures the proper functioning of the front and rear axle control modules.

[0049] In some embodiments of the present application, the system pre-classifies commands into four safety levels. Level 1 commands directly affect vehicle braking safety and have absolute priority. Level 2 commands maintain basic braking functions, with a lower priority than level 1 but higher than level 3 and level 4. Level 3 commands are used to improve driving comfort and must be executed without affecting higher-level commands. Level 4 commands are non-safety-related and have the lowest priority.

[0050] In some embodiments of the present application, the above-mentioned systems and methods of the present application adopt a dual-bridge control module distributed architecture to replace the traditional single controller through distributed control and multi-dimensional redundant design, thereby eliminating the risk of single-point failure of the main control; at the same time, the dual DC / DC lines and 24V main / backup battery design can achieve seamless connection of the backup power supply when the main power supply fails to ensure the normal operation of the core functions.

[0051] In some embodiments of the present application, the EMB actuator can implement microsecond-level conflict decision-making based on a local FPGA (Field-Programmable Gate Array).

[0052] In some embodiments of this application, in the event of a simultaneous failure of two controllers, each EMB actuator can make autonomous decisions based on historical data. In the event of a complete CAN bus outage, an Ethernet backup channel can be activated, and signal transmission can be carried out using hardwires to ensure normal communication. In the event of a dual battery failure, a supercapacitor can be used to support emergency braking.

[0053] In some embodiments of the present application, a single battery supports four-wheel power supply through a ring power supply, meeting the requirement of parking on an 18% slope; through a dynamic path optimization algorithm, the requirement that any single point power outage does not affect the power supply of the entire system is achieved; through hardware triggering and software double verification, the problem of cascading failure caused by controller burning is avoided.

[0054] In some embodiments of the present application, the solution to the conflict scenario is: Level 1: Most controllers agree on the command and execute it first; Level 2: When there is a conflict in commands, select the command with a higher safety level (such as maximum braking force); Level 3: When all controllers fail, the preset safety mode is triggered based on local sensors.

[0055] In some embodiments of the present application, the clamping force and current coupling analysis can be used to identify controller instruction anomalies (such as exceeding physical limits) 10 ms in advance and automatically isolate the source of the erroneous instruction.

[0056] In the description of the present invention, it should be understood that the terms "center", "longitudinal", "lateral", "length", "width", "thickness", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", "clockwise", "counterclockwise" and the like to indicate orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as limiting the present invention.

[0057] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of the technical features being referred to. Thus, a feature identified as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, "plurality" means two or more, unless otherwise specifically defined.

[0058] In the present invention, unless otherwise expressly specified or limited, the terms "mounted," "connected," "connect," "fixed," etc. should be understood broadly. For example, they may refer to fixed connection, detachable connection, or integration; mechanical connection or electrical connection; direct connection or indirect connection through an intermediate medium; internal communication between two components or interaction between two components. Those skilled in the art will understand the specific meanings of the above terms in the present invention based on specific circumstances.

[0059] The above is a further detailed description of the present invention in conjunction with specific preferred embodiments, and the specific implementation of the present invention should not be considered to be limited to these descriptions. For those skilled in the art to which the present invention belongs, several simple deductions or substitutions can be made without departing from the concept of the present invention, and all of these should be considered to fall within the scope of protection of the present invention.

Claims

1. A full-link redundant EMB control system without a master controller, characterized in that: It includes a front axle control module, a rear axle control module and four EMB actuators, wherein the front axle control module includes a first control module and a second control module, and the rear axle control module includes a third control module and a fourth control module; The four EMB actuators are respectively installed on the four wheels of the vehicle, and the first control module, the second control module, the third control module and the fourth control module are respectively connected to the four EMB actuators; The front axle control module and the rear axle control module are both connected to the vehicle CAN of the vehicle, and the front axle control module and the rear axle control module are connected to each other through an internal CAN.

2. The full-link redundant EMB control system without a master controller according to claim 1 is characterized in that: It also includes a power battery, a first power supply line and a second power supply line, wherein one end of the first power supply line and the second power supply line are both connected to the power battery; The first control module and the third control module are both connected to the first power supply line, and the second control module and the fourth control module are both connected to the second power supply line.

3. The full-link redundant EMB control system without a master controller according to claim 2 is characterized in that: The invention also includes a first storage battery and a second storage battery, wherein the first storage battery is connected to the first power supply line, and the second storage battery is connected to the second power supply line.

4. The full-link redundant EMB control system without a master controller according to claim 2, characterized in that: The system further includes a first DC / DC converter and a second DC / DC converter, wherein the first DC / DC converter is arranged in the first power supply line, and the second DC / DC converter is arranged in the second power supply line.

5. The full-link redundant EMB control system without a master controller according to claim 2, characterized in that: It also includes a rotation angle sensor, a yaw angle sensor and a wheel speed sensor, wherein the rotation angle sensor, the yaw angle sensor and the wheel speed sensor are all connected to the power battery; The steering angle sensor, yaw angle sensor and wheel speed sensor are all connected to the front axle control module and the rear axle control module, and the front axle control module and the rear axle control module are both used to receive vehicle status signals; The vehicle status signal includes wheel speed information, a steering angle signal and a yaw angle status.

6. The full-link redundant EMB control system without a master controller according to claim 1, characterized in that: Also included is a brake pedal, a first communication line and a second communication line, wherein one end of the first communication line and the second communication line are both connected to the brake pedal, and the other end is connected to the first control module and the second control module respectively; The first control module, the second control module, the third control module and the fourth control module are all connected to the vehicle CAN. The EMB control system also includes an EPB switch, and the EPB switch is connected to the vehicle CAN.

7. A full-link redundant EMB control method without a master controller, characterized in that: A fully redundant EMB control system without a master controller according to any one of claims 1 to 6, wherein the EMB control system includes a front axle control module, a rear axle control module, and four EMB actuators, wherein the front axle control module includes a first control module and a second control module, and the rear axle control module includes a third control module and a fourth control module, and wherein the method includes: The front axle control module and the rear axle control module receive upper layer instructions from the vehicle CAN in parallel and independently; The front axle control module and the rear axle control module share the received upper layer instructions through the internal CAN and cross-check; When it is confirmed that the upper-layer instruction is valid and consistent, the front axle control module issues a braking action command to the first control module and the second control module, and the rear axle control module issues a braking action command to the third control module and the fourth control module; The first control module, the second control module, the third control module and the fourth control module respectively drive the four EMB actuators to achieve wheel braking; The upper-level instructions include one or more of driver instructions, automatic / assisted driving system instructions, and sensor instructions.

8. The full-link redundant EMB control method without a master controller according to claim 7, characterized in that: After the steps of the front axle control module and the rear axle control module sharing the received upper layer instructions through the internal CAN and cross-checking, the method further includes: When one of the front axle control module and the rear axle control module fails, the other module immediately triggers fault diagnosis and assesses the fault level, and at the same time, the other module actively takes over the control authority of the braking system; Among them, another module calculates and re-optimizes the distribution of braking force required for the four wheels based on the original upper-level braking instructions received, real-time vehicle status information and preset safety control algorithms to ensure safe braking.

9. The method for controlling full-link redundant EMB without a master controller according to claim 8, characterized in that: The EMB control system further includes an EPB switch, and the EPB switch is connected to the vehicle CAN; After the steps of the front axle control module and the rear axle control module sharing the received upper layer instructions through the internal CAN and cross-checking, the method further includes: The four EMB actuators respectively receive and store operating information transmitted by the first control module, the second control module, the third control module, and the fourth control module, wherein the operating information includes one or more of the most recently confirmed valid braking command, the real-time wheel speed signal, the backup vehicle reference speed estimation value, the actuator's own state, and the preset simplified safety braking rule; When both the front axle control module and the rear axle control module fail, the four EMB actuators switch from the passive execution mode to the active control mode. The four EMB actuators independently calculate and output corresponding braking forces based on their respective stored working information, and brake the four wheels of the vehicle according to the braking forces. When the front axle control module, the rear axle control module and the four EMB actuators all fail, the EPB switch obtains the trigger instruction through the vehicle CAN, applies the maximum clamping force to tighten the parking brake caliper, and provides a nonlinear effective braking force to ensure that the vehicle speed is reduced to the absolute safety threshold.

10. The full-link redundant EMB control method without a master controller according to claim 9, characterized in that: The method further comprises: When the instructions received by the front axle control module and the rear axle control module conflict, comparing the safety levels of the conflicting instructions; When conflicting instructions have different security levels, the instruction with the higher security level will be executed first; When the security levels of conflicting instructions are the same, the credibility weights of the instruction sources are calculated, and the priority instruction is determined based on the sensor verification mechanism and the response speed of the EMB actuator.

Images