A redundant safety control system based on brake-by-wire

Abstract

The present invention relates to a redundant safety control system based on wire control braking, comprising an electric power-assisted braking mechanism and an electronic vehicle body stability system connected via at least two CAN buses, wherein the information transmitted by the two CAN buses is mutually backed up; the electric power-assisted braking mechanism and the electronic vehicle body stability system are also connected to a vehicle controller, a motor controller and an electronic parking system via one of the CAN buses. The fault risk identification and corresponding redundant safety control of the wire control braking system are realized, the strict requirements of intelligent vehicles for redundant braking safety are met, the braking safety of the vehicle is improved, and the loss of life and property caused by automobile traffic safety accidents is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of vehicle control, and in particular to a redundant safety control system based on wire control braking. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] The intelligent driving system control equipped on the vehicle is gradually replacing the driver, forming an "unmanned driving system". The wire control brake system is the core component for realizing advanced assisted driving, automatic driving and deep braking energy recovery, so the redundant safety control of the wire control brake system is also put forward higher requirements. In the current wire control brake system, the traditional vacuum booster + hydraulic brake pressure regulation module (ABS / ESC) can no longer meet the strict requirements of intelligent vehicles for brake redundant safety. Summary of the invention

[0004] In order to solve the technical problems existing in the above-mentioned background technology, the present invention provides a redundant safety control system based on wire control braking, which monitors and judges the fault level and functional degradation of each component in the braking system through a reasonable redundant safety control method, thereby avoiding traffic safety accidents caused by redundant defects in the braking system.

[0005] In order to achieve the above object, the present invention adopts the following technical solution:

[0006] A first aspect of the present invention provides a redundant safety control system based on wire control braking, comprising:

[0007] The electric power-assisted braking mechanism and the electronic body stability system are connected via at least two CAN buses, and the information transmitted by the two CAN buses is backed up for each other; the electric power-assisted braking mechanism and the electronic body stability system are also connected to the vehicle controller, the motor controller and the electronic parking system via one of the CAN buses.

[0008] The electric power-assisted braking mechanism obtains the driver's braking intention through the brake pedal stroke obtained by the displacement sensor connected to the brake pedal; the displacement sensor uses at least two analog signals, which are mutually verified and fault-diagnosed. When an open circuit or short circuit fault occurs in any analog signal, the driver's braking intention is analyzed through the other analog signal.

[0009] The brake switch installed on the brake pedal mechanism is connected to the vehicle controller. When both analog signals of the displacement sensor fail, the vehicle controller determines the braking intention based on the brake switch signal, and then determines whether to perform the brake downgrade action.

[0010] The brake master cylinder pressure sensor of the electric power-assisted brake mechanism and the oil inlet pressure sensor of the electronic body stability system are redundant. When either pressure sensor fails, logical judgment is performed through the signal of the other pressure sensor.

[0011] During power-assisted braking, if the electric power-assisted braking mechanism is able to operate, the driver's braking intention is analyzed through the displacement sensor, the total braking force of the vehicle is calculated according to the braking intention, and it is determined whether the conditions for energy recovery are met at this time. If not, hydraulic braking is performed to meet the total braking demand; if so, braking energy recovery is performed.

[0012] If the electric power-assisted braking mechanism's capacity is reduced or it is unable to provide assistance, but the braking intention can still be interpreted, the vehicle controller will request the drive motor to limit torque and the vehicle to limit speed; the electric power-assisted braking mechanism will send the brake takeover request signal, target braking pressure and the electric power-assisted braking mechanism's maximum assistance pressure building capacity signal to the electronic body stability system.

[0013] If the electronic body stability system is able to operate, active boosting action is performed based on the difference between the target brake pressure and the maximum boost pressure building capacity of the electric power-assisted brake mechanism as the target pressure.

[0014] If the electric power-assisted braking mechanism is less capable or unable to provide assistance, but the braking intention can still be interpreted, the vehicle controller will make an electronic parking request based on the driver's braking intention and vehicle speed, and the electronic parking system will receive the parking command and perform dynamic parking. If the electronic parking system cannot execute the parking command, only the driver's mechanical backup brake will be retained. At this time, the driver pushes the master cylinder to build pressure through the brake pedal transmission mechanism.

[0015] If the electric power-assisted braking mechanism cannot obtain the braking intention or cannot operate, the vehicle controller controls the drive motor torque limit request to achieve vehicle speed limit, and at the same time obtains the driver's braking intention according to the brake switch signal, and sends a deceleration request to the electronic body stability system; if the electronic body stability system has no fault or is a level one fault, active boosting action is performed according to the target braking deceleration; if the electronic body stability system is in a level two fault state, the vehicle controller makes a parking request according to the driver's braking intention and vehicle speed, and the electronic parking system receives the parking command and performs dynamic parking.

[0016] If the electronic parking system cannot execute the parking command, only the driver's mechanical backup brake is retained. At this time, the driver pushes the master cylinder to build pressure through the brake pedal transmission mechanism.

[0017] Compared with the prior art, one or more of the above technical solutions have the following beneficial effects:

[0018] 1. The electric power-assisted braking mechanism and the electronic stability control system use a dual-channel CAN communication method. The two CAN buses back up each other. When any CAN communication fails, the electric power-assisted braking mechanism and the electronic stability control system can perform logical judgment and action execution based on the transmission information of the other CAN network. This network communication method can avoid the defects of a single CAN network communication failure.

[0019] 2. The displacement sensor of the electric power-assisted brake mechanism realizes sensor signal redundancy through two analog signals. The two analog signals are mutually verified and fault diagnosed. When an open circuit or short circuit fault occurs in any analog signal, the driver's braking intention is analyzed through the other analog signal.

[0020] 3. The electric power-assisted braking mechanism has different power-assisted braking control redundancy in different fault states to meet safety considerations in different vehicle states.

[0021] 4. Realize fault risk identification and corresponding redundant safety control of the wire control brake system, meet the stringent requirements of smart cars for brake redundant safety, improve the braking safety of vehicles, and thus reduce the losses caused by automobile traffic safety accidents. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0023] Figure 1 is a CAN network architecture of a brake-by-wire system provided by one or more embodiments of the present invention;

[0024] Figure 2 is a schematic diagram of redundant logic of power-assisted braking control in a wire-controlled braking system provided by one or more embodiments of the present invention;

[0025] Figure 3 It is a schematic diagram of the ESC backup braking logic in a wire control brake system provided by one or more embodiments of the present invention. DETAILED DESCRIPTION

[0026] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0027] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0028] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0029] ABS Anti-lock Braking System

[0030] AVH Automatic Parking

[0031] CAN Controller Area Network

[0032] EPB Electronic Parking Brake System

[0033] ESC Electronic Stability Control System

[0034] HBA Emergency Brake Assist

[0035] HDC Hill Descent Control

[0036] HHC Hill Assist Control

[0037] iBooster Electric Brake Booster

[0038] MCU Motor Controller

[0039] VCU Vehicle Controller

[0040] As described in the background technology, in the current wire control brake system, the traditional vacuum booster + hydraulic brake pressure regulation module (ABS / ESC) can no longer meet the strict requirements of smart cars for brake redundancy safety.

[0041] Therefore, the following embodiments provide a redundant safety control system based on wire control braking, including power distribution redundancy, communication network redundancy, sensor signal redundancy, power brake control redundancy, active brake control redundancy, advanced driver assistance additional function control redundancy and anti-lock function low selection control redundancy. This control system can solve the stringent requirements of intelligent vehicles for brake redundancy safety, thereby improving the safety of vehicle operation and driving experience. The wire control braking system includes an electric brake booster iBooster, an electronic stability control system ESC, an electronic parking system EPB, a vehicle controller VCU, a motor controller MCU and a motor.

[0042] Embodiment 1:

[0043] like Figure 1-3 As shown, a redundant safety control system based on wire control braking comprises:

[0044] The electric power-assisted braking mechanism and the electronic body stability system are connected via at least two CAN buses, and the information transmitted by the two CAN buses is backed up for each other; the electric power-assisted braking mechanism and the electronic body stability system are also connected to the vehicle controller, the motor controller and the electronic parking system via one of the CAN buses.

[0045] Specific:

[0046] The brake-by-wire system of this embodiment includes an electric brake booster iBooster, an electronic stability control system ESC, an electronic parking system EPB, a vehicle controller VCU, a motor controller MCU and a motor.

[0047] (1) Power distribution redundancy

[0048] The electric brake booster iBooster, electronic stability control system ESC, and electronic parking system EPB together constitute a discrete wire control brake system, which is powered by an independent power supply. When a single component power supply circuit fails such as open circuit, short circuit, overcurrent, and overvoltage, other components of the wire control brake system can achieve the braking and deceleration requirements through redundant safety degradation control. This power distribution method can completely avoid the defects of centralized power supply.

[0049] (2) Communication network redundancy

[0050] The electric brake booster iBooster and the electronic stability control system ESC use a dual CAN communication method, one public CAN: both components are connected to the vehicle CAN in a star connection; one private CAN: the two components are directly connected through the private CAN. The two CAN network transmission information is backed up for each other. When any CAN communication fails, the iBooster and ESC can perform logical judgment and action execution based on the transmission information of the other CAN network. This network communication method can avoid the defects of a single CAN network communication failure.

[0051] (3) Sensor signal redundancy

[0052] The electric brake booster iBooster obtains the driver's braking intention by obtaining the brake pedal stroke through the displacement sensor connected to the brake pedal. The displacement sensor uses two analog signals, which are mutually verified and fault diagnosed. When an open circuit or short circuit occurs in any analog signal, the driver's braking intention can be analyzed through the other analog signal. The brake switch installed at the brake pedal mechanism is connected to the vehicle controller VCU through a hard line. When both analog signals of the iBooster displacement sensor fail, the VCU can judge the braking intention based on the brake switch signal, and then determine whether to perform the brake downgrade action. The iBooster brake master cylinder pressure sensor and the ESC oil inlet pressure sensor are redundant. When any pressure sensor fails, a logical judgment can be made through the signal of the other pressure sensor.

[0053] (4) Power-assisted brake control redundancy

[0054] like Figure 2-3 As shown, during assisted braking, if the electric power brake iBooster has no fault or a level one fault (a minor fault that does not affect the function), the iBooster uses a displacement sensor to analyze the driver's braking intention, calculates the total braking force of the vehicle according to the driver's braking intention, and determines whether the conditions for energy recovery are met at this time. If not, normal hydraulic braking is performed to meet the total braking demand; if the conditions are met, the braking energy recovery function is executed. According to the dynamic requirements, motor braking is prioritized to meet the total braking demand, and the minimum hydraulic braking force is calculated to ensure the smoothness and stability of the vehicle's braking, while maximizing the recovery of braking energy.

[0055] If the electric power brake iBooster has a secondary fault (the power-assisting ability is reduced or cannot provide power-assisting, but the braking intention can still be analyzed), the vehicle controller requests the drive motor to limit torque and limits the speed of the vehicle; the iBooster sends the brake takeover request signal, target braking pressure, iBooster maximum power-assisting pressure-building capability and other signals to the ESC. If the ESC has no fault or has a primary fault (a minor fault that does not affect the function), the ESC uses the difference between the target braking pressure and the iBooster maximum power-assisting pressure-building capability as the target pressure for active boosting. If the ESC is in a serious fault state (unable to perform functions or function degradation), the vehicle controller makes an EPB parking request based on the driver's braking intention and vehicle speed, and the EPB receives the parking command and performs the dynamic parking function. If the EPB cannot execute the parking command due to its own fault, the brake-by-wire system only retains the driver's mechanical backup brake (the driver pushes the master cylinder to build pressure through the brake pedal transmission mechanism).

[0056] If the electric power brake iBooster is in a level 3 fault (unable to obtain braking intention, motor power mechanism dead), the vehicle controller VCU requests the drive motor to limit torque to achieve vehicle speed limit; at the same time, the VCU obtains the driver's braking intention based on the brake switch signal, and sends a deceleration request to the ESC (the deceleration target value is greater than the maximum deceleration generated by the driver's mechanical backup braking, and needs to be tested and calibrated according to the actual situation of the vehicle). If the ESC has no fault or is a level 1 fault (minor fault, does not affect the function), the ESC performs active boosting according to the target braking deceleration. If the ESC is in a serious fault state (unable to execute the function or the function is downgraded), the vehicle controller makes an EPB parking request based on the driver's braking intention and vehicle speed, and the EPB receives the parking command and executes the dynamic parking function. If the EPB cannot execute the parking command due to its own fault, the brake-by-wire system only retains the driver's mechanical backup brake (the driver pushes the master cylinder to build pressure through the brake pedal transmission mechanism).

[0057] The settings of the fault levels are shown in Table 1.

[0058] Table 1: Failure levels of brake-by-wire system components

[0059]

[0060] (5) Active Braking Control Redundancy

[0061] During active braking, the electric brake booster iBooster is the main control brake module, and the electronic stability control system ESC is the secondary control brake module. The iBooster drives the servo motor to perform active boosting according to external braking request instructions (including brake pressure, brake deceleration, pedal opening and other instructions). At the same time, the ESC monitors the iBooster brake takeover request signal, target brake pressure, and iBooster's maximum boost pressure building capacity. If the iBooster fails to build brake pressure or is unable to build pressure due to a fault, the ESC will use the difference between the target brake pressure and the iBooster's maximum boost pressure building capacity as the target for active boosting to ensure that the total braking force of the vehicle meets the external braking requirements. If the ESC is in a serious fault state (unable to execute functions or function degradation), the vehicle controller will request the drive motor to limit torque and limit the speed of the vehicle; at the same time, the EPB parking request is made according to the external braking request, and the EPB receives the parking command and performs the dynamic parking function.

[0062] (6) Advanced driver assistance additional function control redundancy

[0063] For advanced additional functions such as hill assist HHC, automatic parking AVH, emergency brake assist HBA and steep slope descent HDC, the electronic stability control system ESC is defined as the main control brake module, and the electric brake booster iBooster is the auxiliary control brake module. ESC executes the corresponding function by judging whether the trigger conditions of each advanced additional function are met. At the same time, iBooster monitors the actual execution status and trigger conditions of each additional function in real time. If ESC cannot complete the corresponding function due to a fault, iBooster, as a secondary control brake module, will execute the corresponding function according to the trigger logic.

[0064] (7) Anti-lock braking function low selection control redundancy

[0065] When the electronic stability control system (ESC) is unable to complete the brake wheel cylinder's pressurization, decompression, and pressure maintenance due to ECU failure, solenoid valve failure, eccentric motor and plunger pump failure, the anti-lock function cannot be realized. iBooster can monitor the ABS fault status, set the threshold values ​​of wheel deceleration and slip rate according to the wheel status, and make corrective adjustments to the wheel brake pressure to achieve low-selection control redundancy of the anti-lock function. When both rear wheels are locked, the iBooster anti-lock backup function is triggered, which reduces, maintains and increases the pressure on the brake master cylinder to prevent the rear axle from slipping and causing the car to lose directional stability; when both wheels on one side are locked, the iBooster anti-lock backup function is triggered, which reduces, maintains and increases the pressure on the brake master cylinder to avoid instability caused by excessive yaw moment of the vehicle on the oncoming road; when both front wheels are locked, although the steering ability is lost, it is a stable condition, so the iBooster does not take any action; when all four wheels are locked at the same time, the steering ability is also lost, but it is also a stable condition, so the iBooster does not take any action either.

[0066] The above redundant safety control method can be used to perform redundant backup of power distribution, communication network, and sensor signals in the brake-by-wire system. At the same time, the fault level of each component of the system can be monitored and judged, and functional degradation can be performed to improve the safety and reliability of the brake-by-wire system.

[0067] The above system realizes fault risk identification and corresponding redundant safety control of the wire control brake system, meets the stringent requirements of smart cars for brake redundant safety, improves the vehicle's braking safety, and thus reduces the loss of life and property caused by automobile traffic safety accidents.

[0068] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A redundant safety control system based on wire control braking, characterized in that: include: The electric power-assisted brake mechanism and the electronic body stability system are connected through at least two CAN buses, and the information transmitted by the two CAN buses is backed up for each other; the electric power-assisted brake mechanism and the electronic body stability system are also connected to the vehicle controller, the motor controller and the electronic parking system through one of the CAN buses; The master cylinder pressure sensor of the electric power-assisted brake mechanism and the oil inlet pressure sensor of the electronic vehicle stability system are mutually redundant. When any one of the pressure sensors fails, a logical judgment is performed through the signal of the other pressure sensor; During active braking, the electric power-assisted braking mechanism is the main control braking module, and the electronic body stability system is the auxiliary control braking module; the electric power-assisted braking mechanism drives the servo motor to perform active boosting action according to the external braking request instruction, including braking pressure, braking deceleration and pedal opening instruction, and the electronic body stability system monitors the braking takeover request signal of the electric power-assisted braking mechanism, the target braking pressure, and the maximum boosting pressure building capacity of the electric power-assisted braking mechanism; if the electric power-assisted braking mechanism fails to build brake pressure or cannot build pressure, the electronic body stability system takes the difference between the target braking pressure and the maximum boosting pressure building capacity of the electric power-assisted braking mechanism as the target to perform active boosting action to ensure that the total braking force of the vehicle meets the external braking demand; if the electronic body stability system cannot perform the function or the function is degraded, the vehicle controller makes a torque limit request for the drive motor and limits the speed of the vehicle; at the same time, the electronic parking system makes a parking request according to the external braking request, and the electronic parking system receives the parking instruction and performs the dynamic parking function; When the electronic body stability system cannot complete the pressurization, decompression and pressure-maintaining actions of the brake wheel cylinder due to ECU failure, solenoid valve failure, eccentric motor and plunger pump failure, and thus cannot realize the anti-lock function, the electric power-assisted braking mechanism monitors the ABS fault state, sets the wheel deceleration and slip rate threshold values ​​according to the wheel state, and makes a corrective adjustment to the wheel brake pressure to realize the low-selection control redundancy of the anti-lock function; when both rear wheels are locked, the anti-lock backup function of the electric power-assisted braking mechanism is triggered, and the brake master cylinder is decompressed, maintained and pressurized to avoid the rear axle side slip and the loss of directional stability of the vehicle; when both wheels on one side are locked, the anti-lock backup function of the electric power-assisted braking mechanism is triggered, and the brake master cylinder is decompressed, maintained and pressurized to avoid the instability caused by excessive yaw moment of the whole vehicle on the open road; when both front wheels are locked, it is a stable working condition, and the electric power-assisted braking mechanism does not process it; when all four wheels are locked at the same time, it is a stable working condition, and the electric power-assisted braking mechanism does not process it.

2. A redundant safety control system based on wire control braking as claimed in claim 1, characterized in that: The electric power-assisted braking mechanism obtains the driver's braking intention through the brake pedal stroke obtained by the displacement sensor connected to the brake pedal; the displacement sensor uses at least two analog signals, and the two analog signals are mutually verified and fault diagnosed. When an open circuit or short circuit fault occurs in any analog signal, the driver's braking intention is analyzed through the other analog signal.

3. A redundant safety control system based on wire control braking as claimed in claim 2, characterized in that: The brake switch installed on the brake pedal mechanism is connected to the vehicle controller. When both analog signals of the displacement sensor fail, the vehicle controller determines the braking intention based on the brake switch signal, and then determines whether to perform the brake downgrade action.

4. A redundant safety control system based on wire control braking as claimed in claim 1, characterized in that: During power-assisted braking, if the electric power-assisted braking mechanism is able to operate, the driver's braking intention is analyzed through the displacement sensor, the total braking force of the vehicle is calculated according to the braking intention, and it is determined whether the conditions for energy recovery are met at this time. If not, hydraulic braking is performed to meet the total braking demand; if so, braking energy recovery is performed.

5. A redundant safety control system based on wire control brake according to claim 1, characterized in that: If the electric power-assisted braking mechanism's capacity is reduced or it is unable to provide assistance, but the braking intention can still be interpreted, the vehicle controller will request the drive motor to limit torque and the vehicle to limit speed; the electric power-assisted braking mechanism will send the brake takeover request signal, target braking pressure and the electric power-assisted braking mechanism's maximum assistance pressure building capacity signal to the electronic body stability system.

6. A redundant safety control system based on wire control brake according to claim 1, characterized in that: If the electronic body stability system is able to operate, active boosting action is performed based on the difference between the target brake pressure and the maximum boost pressure building capacity of the electric power-assisted brake mechanism as the target pressure.

7. A redundant safety control system based on wire control brake according to claim 1, characterized in that: If the electric power-assisted braking mechanism is less capable or unable to provide assistance, but the braking intention can still be interpreted, the vehicle controller will make an electronic parking request based on the driver's braking intention and vehicle speed, and the electronic parking system will receive the parking command and perform dynamic parking. If the electronic parking system cannot execute the parking command, only the driver's mechanical backup brake will be retained. At this time, the driver pushes the master cylinder to build pressure through the brake pedal transmission mechanism.

8. A redundant safety control system based on wire control brake according to claim 1, characterized in that: If the electric power-assisted braking mechanism cannot obtain the braking intention or cannot operate, the vehicle controller controls the drive motor torque limit request to achieve vehicle speed limit, and at the same time obtains the driver's braking intention according to the brake switch signal, and sends a deceleration request to the electronic body stability system; if the electronic body stability system has no fault or is a level one fault, active boosting action is performed according to the target braking deceleration; if the electronic body stability system is in a level two fault state, the vehicle controller makes a parking request according to the driver's braking intention and vehicle speed, and the electronic parking system receives the parking command and performs dynamic parking.

9. A redundant safety control system based on wire control braking as claimed in claim 8, characterized in that: If the electronic parking system cannot execute the parking command, only the driver's mechanical backup brake is retained. At this time, the driver pushes the master cylinder to build pressure through the brake pedal transmission mechanism.

Images