Braking system and device

Abstract

The application discloses a brake system and device, which is suitable for the technical field of braking and is used for reducing the complexity of adding redundancy backup in the brake system. The brake system comprises an oil pot, a master cylinder module, a brake pedal, a push rod, a first pressure control unit, a second pressure control unit, a first ECU, a second ECU and a redundancy ECU. The first ECU is used for controlling brake actuators in the first pressure control unit. The second ECU is used for controlling brake actuators in the second pressure control unit. The redundancy ECU is used for controlling at least one brake actuator in the first pressure control unit and / or at least one brake actuator in the second pressure control unit. In this way, the redundancy braking can be realized by one additional ECU, without the need of additionally setting a new pressure control unit and a corresponding ECU, so as to help reduce the complexity of adding the redundancy backup in the brake system, and further reduce the difficulty of vehicle installation and arrangement.

Description

Technical Field

[0001] This application relates to the field of braking technology, and provides a braking system and device. Background Technology

[0002] The braking system is one of the most critical systems in intelligent transportation equipment, directly impacting the safety of drivers and passengers, as well as their property. For example, if the braking system fails when there is an obstacle in front of the intelligent transportation equipment and braking is required, the equipment may crash into the obstacle due to its inability to brake in time, severely endangering the safety of the driver and passengers. Therefore, having a safe and reliable braking system is of paramount importance for intelligent transportation equipment.

[0003] To improve the safety and reliability of braking systems, redundancy is typically added. Redundancy means that if the original braking function fails, braking can still be achieved through other means. However, current technology usually adds a redundant pressure control unit and a corresponding electronic control unit directly to the braking system. When the original pressure control unit and electronic control unit fail, the braking system switches to the redundant set of pressure control unit and electronic control unit to complete the redundancy backup. However, this redundancy backup method obviously increases the number of components included in the braking system, thereby increasing the difficulty of vehicle installation and layout, and is not conducive to reducing the integration complexity of the braking system.

[0004] In view of this, this application provides a braking system to reduce the complexity of adding redundant braking to the braking system. Summary of the Invention

[0005] This application provides a braking system and apparatus to reduce the complexity of adding redundancy backups to the braking system.

[0006] In a first aspect, this application provides a braking system, comprising: a reservoir, a master cylinder module, a brake pedal, a push rod, a first pressure control unit, a second pressure control unit, a first electronic control unit (ECU), a second ECU, and a redundant ECU. The brake pedal is connected to the master cylinder module via the push rod. The reservoir, master cylinder module, first pressure control unit, and second pressure control unit are sequentially connected via hydraulic lines, and the second pressure control unit is also connected to the braked wheel via a hydraulic line. The first ECU controls the brake actuator in the first pressure control unit, the second ECU controls the brake actuator in the second pressure control unit, and the redundant ECU controls at least one brake actuator in the first pressure control unit and / or at least one brake actuator in the second pressure control unit. The first and second pressure control units, under the control of at least one of the first, second, and redundant ECUs, individually or jointly perform braking operations on the braked wheel.

[0007] In the above design, by setting at least two ECUs for controlling the same brake actuator, redundant control of the brake actuator can be achieved using the remaining ECUs even if one ECU fails. This method achieves redundant braking with the additional ECUs, without requiring a new pressure control unit and corresponding ECU. Therefore, it helps reduce the complexity of adding redundancy backup to the braking system, thereby reducing the difficulty of vehicle installation and layout. Furthermore, the at least two pressure control units in the above design can achieve at least two levels of redundant braking. Controlling the same brake actuator in the same pressure control unit with at least two ECUs is equivalent to further achieving at least three levels of redundant braking on top of at least two levels of redundant braking. At least three levels of redundant braking can be adapted to L2 to L4 and even higher levels of autonomous driving systems. It can be seen that the above design can increase the redundancy of a vehicle with at least two levels of redundant braking by setting as few components as possible, which helps to further improve the redundant braking capability of the braking system while saving costs and reducing the complexity of the overall vehicle layout.

[0008] In one possible design, when a redundant ECU controls at least one brake actuator in a first pressure control unit: when the first ECU is functioning correctly, it controls the brake actuator in the first pressure control unit; when the first ECU fails, the redundant ECU controls the brake actuator in the first pressure control unit. In this design, since the first ECU can control more than or equal to the number of brake actuators controlled by the redundant ECU, setting the first ECU as the default active ECU not only allows the braking system to have more comprehensive braking functions in its default state, but also enables the braking system to flexibly switch to the redundant ECU to continue braking when the default active ECU fails, thus improving the flexibility and reliability of redundant control.

[0009] In one possible design, with a redundant ECU controlling at least one brake actuator in the first pressure control unit: the first pressure control unit, under the control of the first ECU or the redundant ECU, can perform basic braking operations or automatic emergency braking operations on the braked wheel; the second pressure control unit, under the control of the second ECU, can perform anti-lock braking operations, traction control operations, or electronic stability control operations on the braked wheel; and the first and second pressure control units, under the control of the first and second ECUs, or the redundant and second ECUs, can perform basic braking operations, automatic emergency braking operations, anti-lock braking operations, traction control operations, electronic stability control operations, adaptive cruise control operations, and additional braking operations on the braked wheel. In this design, by adding a redundant ECU to the first pressure control unit, even if the first ECU fails, the redundant ECU can independently perform the original braking function of the first pressure control unit, and the redundant ECU can cooperate with the second ECU to complete the full braking function of the braking system, effectively maintaining the availability of the braking system.

[0010] In one possible design, when a redundant ECU controls at least one brake actuator in a second pressure control unit: when the second ECU is functioning correctly, it controls the brake actuator in the second pressure control unit; when the second ECU fails, the redundant ECU controls the brake actuator in the second pressure control unit. In this design, since the second ECU can control more than or equal to the number of brake actuators controlled by the redundant ECU, setting the second ECU as the default active ECU not only allows the braking system to have more comprehensive braking functions in its default state, but also enables the braking system to flexibly switch to the redundant ECU to continue braking when the default active ECU fails, thus improving the flexibility and reliability of redundant control.

[0011] In one possible design, with a redundant ECU controlling at least one brake actuator in the second pressure control unit: the first pressure control unit, under the control of the first ECU, can perform basic braking operations or automatic emergency braking operations on the braked wheel; the second pressure control unit, under the control of the second ECU or the redundant ECU, can perform anti-lock braking operations, traction control operations, or electronic stability control operations on the braked wheel; and the first and second pressure control units, under the control of the first and second ECUs, or the first ECU and the redundant ECU, can perform basic braking operations, automatic emergency braking operations, anti-lock braking operations, traction control operations, electronic stability control operations, adaptive cruise control operations, and additional braking operations on the wheel. In this design, by adding a redundant ECU to the second pressure control unit, even if the second ECU fails, the redundant ECU can independently perform the original braking function of the second pressure control unit, and the redundant ECU can cooperate with the first ECU to complete the full braking function of the braking system, effectively maintaining the availability of the braking system.

[0012] In one possible design, the master cylinder module can be integrated into the first pressure control unit to further improve the integration of the braking system, or it can exist independently of the first pressure control unit to flexibly control the inflow and outflow of oil in the master cylinder module.

[0013] In one possible design, the brake actuator may include a motor and / or a solenoid valve. Thus, by providing redundant ECUs for commonly used components in the braking system, it can be ensured that when other ECUs are unable to control these commonly used components, control can be promptly switched to the redundant ECU, effectively guaranteeing the reliability of the braking system.

[0014] The following description uses the example of a redundant ECU controlling at least one brake actuator in the first pressure control unit. The scheme of a redundant ECU controlling at least one brake actuator in the second pressure control unit can be implemented by reference, and will not be repeated here.

[0015] In this embodiment of the application, the first ECU and the redundant ECU can be integrated in any of the following ways:

[0016] Integration Method 1

[0017] In one possible design, the braking system may further include a first printed circuit board (PCB), a second PCB, and an inter-board connector. First-type devices with power exceeding a power threshold in the first ECU and redundant ECUs are located on the first PCB, while second-type devices with power not exceeding a power threshold in the first ECU and redundant ECUs are located on the second PCB. Furthermore, a first-type device in any ECU on the first PCB is connected to a second-type device in an ECU on the second PCB via an inter-board connector. Thus, by integrating high-power devices on one PCB and low-power devices on the other, not only can high-power and low-power devices be classified and managed, but the distributed deployment of all components in the two ECUs also reduces the number of components carried by each PCB, thereby reducing the area and weight of each PCB.

[0018] In one possible design, the braking system may also include a support frame, with the first PCB and the second PCB fixedly connected by the support frame to ensure that the relative positions of the first PCB and the second PCB remain unchanged and to maintain stability during the braking process.

[0019] In one possible design, the support frame can be located on the top layer, the second PCB on the bottom layer, and the first PCB positioned between the support frame and the second PCB. The first PCB has an opening through which the support frame passes and securely connects the first and second PCBs. In this way, the side of the second PCB opposite to the first PCB, which carries low-power devices, is not obstructed, thus aiding in heat dissipation for the second PCB.

[0020] In one possible design, the braking system may further include a housing, a support frame, a first PCB, and a second PCB placed within the housing, with at least one end of the support frame fixed to the housing. In this way, since the heat generated by the low-power devices is relatively small, placing the second PCB, which integrates the low-power devices, close to the housing helps to increase the heat dissipation area of ​​the second PCB through the housing, further improving the heat dissipation effect of the second PCB.

[0021] In one possible design, the first type of device can be disposed on the surface of the first PCB relative to the support frame, and the second type of device can be disposed on the surface of the second PCB relative to the first PCB. Thus, by deploying high-power and low-power devices on the same plane of the first and second PCBs, it is also easier to configure the routing between the high-power and low-power devices, reducing the complexity of integration.

[0022] In one possible design, the braking system may further include a valve body for housing a controlled component. In this case, a first-type device in any ECU may include a driver for the controlled component, and a second-type device in any ECU may include a microcontroller. The microcontrollers in the first ECU and the redundant ECU are also connected via traces on a second PCB. This not only enables communication between the two ECUs but also allows both ECUs to drive the same controlled component, achieving joint redundant control of the same controlled component by both ECUs.

[0023] In one possible design, where the controlled components include a motor, a solenoid valve, and a sensor, a first type of device in any ECU may include a driver for the motor and a driver for the solenoid valve, while a second type of device in any ECU may include an interface between the microcontroller and the sensor. Thus, by placing the low-power microcontroller and sensor interface on one PCB and the high-power driver on another PCB, not only can the microcontroller obtain sensor information more promptly, but the distributed deployment also reduces the heat generated by the PCB containing the microcontroller.

[0024] In one possible design, the area of ​​the second PCB is smaller than that of the first PCB. This allows the second PCB to accommodate low-power devices while improving its area utilization, thereby further enhancing the integration of the integrated device.

[0025] Integration Method Two

[0026] In one possible design, the braking system may further include a first PCB, a second PCB, and a support frame. The first PCB and the second PCB are fixedly connected by the support frame, and the components in the first ECU are mounted on the first PCB, while the components in the redundant ECU are mounted on the second PCB. Thus, by integrating the components of the two ECUs onto different PCBs, not only can the number of components carried by each PCB be reduced, thereby helping to reduce the area and load of each PCB, but the physical decoupling of the two ECUs can also be achieved, facilitating the development and design of the integrated device.

[0027] In one possible design, the braking system may also include an inter-board connector, and the components in any ECU include a microcontroller. The microcontroller in the first ECU is connected to the microcontroller in the redundant ECU via the inter-board connector, so as to enable communication between the two ECUs on the two PCBs through the inter-board connector.

[0028] In one possible design, the braking system may also include a valve body for housing the controlled component. In this case, any device in the ECU may also include a driver for the controlled component. The microcontroller in the first ECU is connected to the driver of the controlled component in the first ECU via traces on the first PCB, while the microcontroller in the redundant ECU is connected to the driver of the controlled component in the redundant ECU via traces on the second PCB. This enables joint redundant control of the same controlled component by two ECUs.

[0029] In one possible design, where the controlled components include a motor, a solenoid valve, and a sensor, the devices in any ECU may also include a motor driver, a solenoid valve driver, and a sensor interface, so that any ECU can smoothly receive sensor information and then accurately drive the motor or solenoid valve based on the sensor information.

[0030] In one possible design, the braking system may further include a housing, a support frame, a first PCB, and a second PCB placed within the housing, with at least one end of the support frame fixed to the housing. In this way, the housing can serve to fix the support frame, thereby improving the stability of the fixed connection between the two PCBs by relying on the sturdiness of the housing.

[0031] In one possible design, the support frame can be located on the top layer, the second PCB can be located on the bottom layer, and the first PCB is located between the support frame and the second PCB. The first PCB has an opening through which the support frame passes and securely connects the first and second PCBs. This allows the side of the second PCB opposite to the first PCB to be close to the housing, thereby increasing the heat dissipation area of ​​the second PCB through the housing and improving its heat dissipation effect.

[0032] In one possible design, the components in the first ECU are disposed on the surface of the first PCB relative to the support frame, and the components in the redundant ECU are disposed on the surface of the second PCB relative to the first PCB. This arrangement, by placing the components in the first ECU and the redundant ECU on the same plane of the first and second PCBs, facilitates the routing of traces between the components in the first ECU and the redundant ECU in the inter-board connector, reducing integration complexity.

[0033] Integration Method 3

[0034] In one possible design, the braking system may also include a PCB, with components from both the first ECU and the redundant ECU integrated onto the PCB. This effectively reduces the height of the integrated device compared to integrating components onto two separate PCBs, by integrating components from both ECUs onto the same PCB. Furthermore, this design allows all relevant component interfaces to be located on a single PCB board, enabling a single press-fit connection between the components and the interfaces on the PCB, further simplifying the integration process.

[0035] In one possible design, the devices in any ECU may include a microcontroller, and the microcontroller in the first ECU is connected to the microcontroller in the redundant ECU via traces on the PCB to enable communication between the two ECUs.

[0036] In one possible design, the braking system may also include a valve body for housing the controlled component. In this case, any device in the ECU may also include a driver for the controlled component, and the microcontroller in the ECU is connected to the driver of the controlled component in the ECU via traces on the PCB. This enables joint redundant control of the same controlled component by two ECUs.

[0037] In one possible design, where the controlled components include a motor, a solenoid valve, and a sensor, the devices in any ECU may also include a driver for the motor and a driver for the solenoid valve, as well as an interface for the sensor, so that any ECU can smoothly receive sensor information and then accurately drive the motor or solenoid valve based on the sensor information.

[0038] In one possible design, the braking system may further include a housing, a support frame, and a PCB placed inside the housing, with at least one end of the support frame fixed to the housing. In this way, the housing can serve to fix the support frame, thereby improving the stability of the fixed PCB by relying on the sturdiness of the housing.

[0039] In one possible design, the support frame can be located on the top layer, and the PCB can be located on the bottom layer and close to the lower shell of the housing, so as to increase the heat dissipation area of ​​the PCB through the housing and further improve the heat dissipation effect of the PCB.

[0040] In one possible design, the components in the first ECU and the redundant ECU are positioned on the side of the PCB opposite to the support frame. This allows the components in the two ECUs to be connected via traces on the same side of the PCB, simplifying the PCB routing and reducing integration complexity.

[0041] In this embodiment, the first ECU and the redundant ECU can be connected to the motor or solenoid valve in any of the following ways:

[0042] Motor connection method 1

[0043] In one possible design, the brake actuator includes a motor with three-phase windings. A first ECU and a redundant ECU are connected to the three-phase windings via wiring. When the first ECU is the default active ECU, it supplies three-phase AC power to the windings when it is functioning correctly. Conversely, when the first ECU fails, the redundant ECU supplies the three-phase AC power. In this design, the braking system can directly reuse the three-phase windings in the motor to achieve redundant control of the same motor by two ECUs without adding additional windings. Therefore, it is not only directly compatible with existing motors but also helps save costs.

[0044] In one possible design, while the first ECU is supplying three-phase AC power to the three-phase windings, it can also detect the current in the connection lines between itself and each phase winding. When the current in the connection line to any phase winding is less than a threshold, it sends a supplementary instruction to the redundant ECU. Based on this instruction, the redundant ECU provides a supplementary electrical signal to that phase winding through its connection line. In this way, if a fault occurs in the process of one ECU supplying a signal to a certain winding, another ECU can supplement the signal to that winding, while the signals to the other two windings can still be provided by the original ECU. That is, it is not necessary to switch the entire signal supply process to another ECU. Thus, with fewer switching operations, the accurate supply of three-phase current can be guaranteed while improving switching stability.

[0045] In one possible design, the braking system may also include a switching circuit. This switching circuit is located on the connection lines between the first ECU and the three-phase winding, and also on the connection lines between the redundant ECU and the three-phase winding. The switching circuit is used to connect the first ECU to the three-phase winding and disconnect the redundant ECU from the three-phase winding when the first ECU is functioning correctly. Conversely, if the first ECU fails, it connects the redundant ECU to the three-phase winding and disconnects the first ECU from the three-phase winding. Thus, even if an ECU that should not normally provide three-phase AC power outputs three-phase AC power to the motor, the switching circuit can disconnect the drive link between that ECU and the motor, ensuring that the motor operates only under the drive of the other ECU, effectively improving the accuracy of redundant control.

[0046] In one possible design, when the current on the connection line with the first phase winding is less than a threshold, the first ECU can send a supplementary instruction to the redundant ECU and a first switching instruction to the switching circuit. After receiving the first switching instruction, the switching circuit will connect the redundant ECU to the first phase winding so that the supplementary electrical signal provided by the redundant ECU can be smoothly transmitted to the phase winding of the motor.

[0047] In one possible design, while the first ECU is supplying three-phase AC power to the three-phase windings, it can also detect the current on the connection lines between the first ECU and each phase winding. If the current on the connection line to any phase winding is less than a threshold, the first ECU sends an activation instruction to the redundant ECU and stops supplying three-phase AC power to the three-phase windings. Upon receiving the activation instruction, the redundant ECU then supplies three-phase AC power to the three-phase windings through its connection lines. In this way, by promptly switching to another ECU when a problem occurs in the driving process of one ECU, the use of a faulty ECU can be avoided, maintaining the accuracy of the motor drive.

[0048] In one possible design, the braking system may also include a switching circuit. This switching circuit is located on the connection lines between the first ECU and the three-phase windings, and on the connection lines between the redundant ECU and the three-phase windings. When the current in the connection line between the first ECU and any phase winding is less than a threshold, it can send an activation instruction to the redundant ECU and a second switching instruction to the switching circuit. Upon receiving the second switching instruction, the switching circuit disconnects the connection line between the first ECU and the three-phase windings, and connects the connection line between the redundant ECU and the three-phase windings. This ensures that the three-phase AC power supplied by the redundant ECU is smoothly transmitted to the three-phase stator windings of the motor, while also cutting off the three-phase AC power still supplied to the three-phase stator windings due to a fault in the first ECU, effectively ensuring the accuracy of motor drive.

[0049] Motor connection method two

[0050] In one possible design, the brake actuator includes a motor with a first set of three-phase windings and a second set of three-phase windings. A first ECU is connected to the first set of three-phase windings via wiring, and a redundant ECU is connected to the second set of three-phase windings via wiring. When the first ECU is the default active ECU, it provides three-phase AC power to the first set of three-phase windings when it is functioning correctly. When the first ECU fails, the redundant ECU provides three-phase AC power to the second set of three-phase windings. In this design, by adding an extra set of three-phase windings to the motor, accurate motor drive can be achieved through the electrical signals of each ECU to its corresponding three-phase winding, preventing interference between the electrical signals of one ECU and those of another.

[0051] In one possible design, the first set of three-phase windings and the second set of three-phase windings can both be wound around the entire area of ​​the motor core, but in different directions. Alternatively, the first set of three-phase windings and the second set of three-phase windings can be wound around different areas of the motor core. Or, some of the first set of three-phase windings and the second set of three-phase windings can be wound around the same area of ​​the motor core, while other parts of the windings can be wound around different areas of the motor core.

[0052] In one possible design, while the first ECU is supplying three-phase AC power to the first set of three-phase windings, it can also detect the current on the connection lines between the first ECU and each phase winding in the first set of three-phase windings. When the current on the connection line with any phase winding is less than a threshold, it sends an activation instruction to the redundant ECU and stops supplying three-phase AC power to the first set of three-phase windings. Upon receiving the activation instruction, the redundant ECU supplies three-phase AC power to the second set of three-phase windings through the connection line between the redundant ECU and the second set of three-phase windings. In this way, even if a fault occurs in the process of one ECU supplying electrical signals to a certain set of three-phase windings, causing the motor to fail to drive, the motor can continue to be driven by the three-phase AC power supplied by another ECU to another set of three-phase windings, thereby improving the timeliness of switching while achieving redundant motor control.

[0053] In one possible design, the braking system may also include a switching circuit. This switching circuit is located on the connection lines between the first ECU and the first set of three-phase windings, and on the connection lines between the redundant ECU and the second set of three-phase windings. When the current in the connection line between the first ECU and any phase winding is less than a threshold, it can send an activation instruction to the redundant ECU and a switching instruction to the switching circuit. Upon receiving the switching instruction, the switching circuit can disconnect the connection line between the first ECU and the first set of three-phase windings and connect the connection line between the redundant ECU and the second set of three-phase windings. This ensures that the three-phase AC power supplied by the redundant ECU is smoothly transmitted to the second set of three-phase windings of the motor, while simultaneously cutting off the three-phase AC power still supplied to the first set of three-phase windings due to a malfunction of the first ECU, effectively ensuring the accuracy of motor drive.

[0054] Solenoid valve connection method 1

[0055] In one possible design, the brake actuator includes a solenoid valve with dual coils. A first ECU and a redundant ECU are connected to the dual coils via wiring. When the first ECU is the default active ECU, it supplies DC power to the dual coils when it is functioning correctly; when the first ECU fails, the redundant ECU supplies DC power. This design reuses the dual coils in the solenoid valve to achieve redundant actuation of the same solenoid valve by two ECUs without requiring additional coils. Therefore, it is not only directly compatible with existing solenoid valves but also helps save costs.

[0056] In one possible design, while the first ECU is supplying DC power to the dual coils, it can also detect the current in the connection lines between the first ECU and each coil in the dual coils. When the current in the connection line to any coil in the dual coils is less than a threshold, it sends a supplementary instruction to the redundant ECU. Upon receiving the supplementary instruction, the redundant ECU provides a supplementary electrical signal to that coil through its connection line. With this design, if the process of one ECU supplying an electrical signal to a coil fails, another ECU can supplement the signal to that coil, while the electrical signal to the other coil can still be provided by the original ECU. That is to say, it is not necessary to switch the entire process of supplying electrical signals to the other ECU. In this way, with a small number of switching operations, accurate DC power can be supplied to the solenoid valve by the joint operation of two ECUs, while improving switching stability.

[0057] In one possible design, the braking system may also include a switching circuit. This switching circuit is located on the connection lines between the first ECU and the dual coils, as well as the connection lines between the redundant ECU and the dual coils. When the first ECU is functioning correctly, the switching circuit connects the first ECU to the dual coils and disconnects the redundant ECU from the dual coils. Conversely, when the first ECU fails, it connects the redundant ECU to the dual coils and disconnects the first ECU from the dual coils. In this way, even if an ECU that should not normally provide DC power outputs DC power to the solenoid valve, the switching circuit can cut off the drive link between that ECU and the solenoid valve, ensuring that the solenoid valve operates only under the drive of another ECU, effectively improving the accuracy of redundant control.

[0058] In one possible design, when the current in the connection line between the first ECU and the first coil is less than a threshold, the first ECU can send a switching instruction to the redundant ECU and a first switching instruction to the switching circuit. After receiving the first switching instruction, the switching circuit turns on the connection line between the redundant ECU and the aforementioned coil so that the supplementary electrical signal provided by the redundant ECU can be smoothly transmitted to the coil of the solenoid valve.

[0059] In one possible design, while the first ECU is supplying DC power to the dual coils, it can also detect the current in the connection lines between the first ECU and each coil in the dual coils. If the current in the connection line with any coil is less than a threshold, it sends an activation instruction to the redundant ECU and stops supplying DC power to the dual coils. Upon receiving the activation instruction, the redundant ECU then supplies DC power to the dual coils through its connection lines with the dual coils. In this way, by promptly switching to another ECU when a problem occurs in the driving process of one ECU, the use of a faulty ECU can be avoided, maintaining the accuracy of the solenoid valve's actuation.

[0060] In one possible design, the braking system may also include a switching circuit. This switching circuit is located on the connection lines between the first ECU and the dual coils, as well as the connection lines between the redundant ECU and the dual coils. When the current in the connection line between the first ECU and either coil is less than a threshold, it can send an activation instruction to the redundant ECU and a second switching instruction to the switching circuit. Upon receiving the second switching instruction, the switching circuit can connect the redundant ECU to the dual coils and disconnect the first ECU from the dual coils. This design not only ensures that the DC power supplied by the redundant ECU is smoothly transmitted to the dual coils of the solenoid valve, but also cuts off the DC power still supplied to the dual coils due to a fault in the first ECU, ensuring the accuracy of the solenoid valve's actuation.

[0061] Solenoid valve connection method two

[0062] In one possible design, the brake actuator includes a solenoid valve comprising a first positive coil, a second positive coil, and a negative coil. A first ECU is connected to the first positive and negative coils via wiring, and a redundant ECU is connected to the second positive and negative coils via wiring. When the first ECU is the default active ECU, it provides DC power to the first and negative coils when it is functioning correctly; conversely, when the first ECU fails, the redundant ECU provides DC power to the second positive and negative coils. This design, by reusing the negative coil of the solenoid valve and separately configuring the positive coils for the two ECUs, reduces the complexity of the solenoid valve configuration, saves costs, and minimizes interference from one ECU's electrical signal to the other.

[0063] In one possible design, while the first ECU is supplying DC power to the first positive and negative coils, it can also detect the current in the connection line between the first ECU and the negative coil. When the current in the connection line to the negative coil is less than a threshold, it sends a supplementary instruction to the redundant ECU. Upon receiving the supplementary instruction, the redundant ECU can then supply an electrical signal to the negative coil through the connection line between the redundant ECU and the negative coil. In this design, if a fault occurs in the process of one ECU supplying an electrical signal to the negative coil, another ECU can supplement the electrical signal to the negative coil, while the electrical signal on the first positive coil can still be supplied by the original ECU. That is to say, it is not necessary to switch the entire process of supplying electrical signals to the first positive and negative coils to another ECU. In this way, with a small number of switching operations, sufficient electrical signals can be supplied to the negative coil through two ECUs while improving switching stability.

[0064] In one possible design, the braking system may also include a switching circuit. This switching circuit is located on the connection lines between the first ECU and the first positive coil, the first ECU and the negative coil, the redundant ECU and the second positive coil, and the redundant ECU and the negative coil. When the first ECU is functioning correctly, the switching circuit connects the first ECU to the first positive coil and the first ECU to the negative coil, and disconnects the redundant ECU from the second positive coil and the redundant ECU from the negative coil. Conversely, if the first ECU fails, the switching circuit connects the redundant ECU to the second positive coil and the redundant ECU to the negative coil, and disconnects the first ECU from the first positive coil and the first ECU from the negative coil. Thus, even if an ECU that should not normally provide DC power outputs DC power to the solenoid valve, the switching circuit can cut off the drive link of that ECU to the solenoid valve, ensuring that the solenoid valve operates only under the drive of another ECU, effectively improving the accuracy of redundant control.

[0065] In one possible design, when the current in the connection line between the first ECU and the negative coil is less than a threshold, it can send a switching instruction to the redundant ECU and a first switching instruction to the switching circuit. After receiving the first switching instruction, the switching circuit can connect the connection line between the redundant ECU and the negative coil so that the supplementary electrical signal provided by the redundant ECU can be smoothly transmitted to the negative coil of the solenoid valve.

[0066] In one possible design, while the first ECU is supplying DC power to the first positive and negative coils, it can also detect the current in the connection lines between the first ECU and each of the first positive and negative coils. If the current in the connection line to any coil is less than a threshold, it sends an activation instruction to the redundant ECU and stops supplying DC power to the first positive and negative coils. Upon receiving the activation instruction, the redundant ECU supplies DC power to the second positive and negative coils through the connection lines between the redundant ECU and the second positive and negative coils. In this way, by promptly switching to another ECU when a problem occurs in the driving process of one ECU, the use of a faulty ECU can be avoided, maintaining the accuracy of the solenoid valve's actuation.

[0067] In one possible design, the braking system may further include a switching circuit. This switching circuit is located on the connection lines between the first ECU and the first positive coil, the first ECU and the negative coil, the redundant ECU and the second positive coil, and the redundant ECU and the negative coil. When the current in the connection line between the first ECU and any of the coils is less than a threshold, it can send an activation instruction to the redundant ECU and a second switching instruction to the switching circuit. Upon receiving the second switching instruction, the switching circuit can connect the redundant ECU to the second positive coil and the redundant ECU to the negative coil, and disconnect the first ECU from the first positive coil and the first ECU from the negative coil. This ensures that the DC power supplied by the redundant ECU is smoothly transmitted to the second set of dual coils of the solenoid valve, while simultaneously cutting off the DC power still supplied to the first set of dual coils due to a first ECU malfunction, thus ensuring the accuracy of the solenoid valve's actuation.

[0068] Solenoid valve connection method three

[0069] In one possible design, the brake actuator includes a solenoid valve, which comprises a first set of dual coils and a second set of dual coils. A first ECU is connected to the first set of dual coils via wiring, and a redundant ECU is connected to the second set of dual coils via wiring. When the first ECU is the default active ECU, it supplies DC power to the first set of dual coils when it is functioning correctly; when the first ECU fails, the redundant ECU supplies DC power to the second set of dual coils. In this design, by adding an extra set of dual coils to the solenoid valve, each ECU can accurately drive the solenoid valve by transmitting electrical signals to its corresponding dual coil, preventing interference between the electrical signals of one ECU and those of another.

[0070] In one possible design, the first set of double coils and the second set of double coils can both be wound around the entire area of ​​the iron core of the solenoid valve, but in different directions on the iron core. Alternatively, the first set of double coils and the second set of double coils can be wound around different areas of the iron core of the solenoid valve. Or, some coils of the first set of double coils and the second set of double coils can be wound around the same area of ​​the iron core of the solenoid valve, while other coils can be wound around different areas of the iron core of the solenoid valve.

[0071] In one possible design, while the first ECU is supplying DC power to the first set of dual coils, it can also detect the current in the connection lines between the first ECU and each coil in the first set of dual coils. When the current in the connection line with any coil is less than a threshold, it sends an activation instruction to the redundant ECU and stops supplying DC power to the first set of dual coils. After receiving the activation instruction, the redundant ECU can supply DC power to the second set of dual coils through the connection line between the redundant ECU and the second set of dual coils. This design allows the solenoid valve to be driven by DC power supplied by another ECU to another set of dual coils when a failure occurs in the process of one ECU supplying electrical signals to a certain set of dual coils, thus achieving redundant control of the solenoid valve while improving the timeliness of switching.

[0072] In one possible design, the braking system may also include a switching circuit. This switching circuit is located on the connection lines between the first ECU and the first set of dual coils, and on the connection lines between the redundant ECU and the second set of dual coils. When the current in the connection line between the first ECU and any coil is less than a threshold, it can send an activation instruction to the redundant ECU and a switching instruction to the switching circuit. Upon receiving the switching instruction, the switching circuit can connect the redundant ECU to the second set of dual coils and disconnect the first ECU from the first set of dual coils. This ensures that the DC power supplied by the redundant ECU is smoothly transmitted to the second set of dual coils of the solenoid valve, while simultaneously cutting off the DC power still supplied to the first set of dual coils due to a malfunction of the first ECU, thus ensuring the accuracy of the solenoid valve's actuation.

[0073] Secondly, this application provides an integrated device, including: a first ECU, a second ECU, a first PCB, a second PCB, and an inter-board connector. A first type of device with power exceeding a power threshold in both the first and second ECUs is disposed on the first PCB, and a second type of device with power not exceeding the power threshold in both the first and second ECUs is disposed on the second PCB. Furthermore, a first type of device in any ECU on the first PCB is connected to a second type of device in an ECU on the second PCB via the inter-board connector. Thus, by integrating high-power devices on one PCB and low-power devices on another PCB, not only can high-power and low-power devices be classified and managed, but the distributed deployment of all components in the two ECUs also reduces the number of components carried by each PCB, thereby reducing the area and load of each PCB.

[0074] In one possible design, the integrated device may also include a support frame, through which the first PCB and the second PCB are fixedly connected, thus ensuring that the relative positions of the first PCB and the second PCB remain unchanged and maintaining the stability of the connection.

[0075] In one possible design, the support frame can be located on the top layer, the second PCB can be located on the bottom layer, and the first PCB is located between the support frame and the second PCB. The first PCB has an opening through which the support frame passes and securely connects the first and second PCBs. This ensures that the side of the second PCB carrying low-power devices that is opposite to the first PCB is not obstructed, thereby improving the heat dissipation of the second PCB.

[0076] In one possible design, the first type of device can be disposed on the surface of the first PCB relative to the support frame, and the second type of device can be disposed on the surface of the second PCB relative to the first PCB. Thus, by deploying high-power and low-power devices on the same plane of the first and second PCBs, it is also easier to configure the routing between the high-power and low-power devices, reducing the complexity of integration.

[0077] In one possible design, the integrated device may further include a valve body for housing the controlled component. In this case, a first-type device in either ECU may include a driver for the controlled component, and a second-type device in either ECU may include a microcontroller. The microcontrollers in the first and second ECUs can also be connected via traces on a second PCB. This not only enables communication between the two ECUs but also allows both ECUs to drive the same controlled component, achieving joint redundant control of the same controlled component by both ECUs.

[0078] In one possible design, where the controlled components include a motor, a solenoid valve, and a sensor, a first type of device in any ECU may include a driver for the motor and a driver for the solenoid valve, while a second type of device in any ECU may include an interface between the microcontroller and the sensor. Thus, by placing the low-power microcontroller and sensor interface on one PCB and the high-power driver on another PCB, not only can the microcontroller obtain sensor information more promptly, but the distributed deployment also reduces the heat generated by the PCB containing the microcontroller.

[0079] In one possible design, the integrated device may further include a housing, a support frame, a first PCB, and a second PCB placed inside the housing, with at least one end of the support frame fixed to the housing. In this way, since the heat generated by the low-power device is relatively small, placing the second PCB, which integrates the low-power device, close to the housing helps to increase the heat dissipation area of ​​the second PCB through the housing, further improving the heat dissipation effect of the second PCB.

[0080] In one possible design, the area of ​​the second PCB can be smaller than that of the first PCB, so as to improve the utilization rate of the second PCB while ensuring that the second PCB can sufficiently support low-power devices, and further improve the integration of the integrated device.

[0081] Thirdly, this application provides an integrated device, including: a first ECU, a second ECU, a first PCB, a second PCB, and a support frame. The first PCB and the second PCB are fixedly connected by the support frame. Components in the first ECU are disposed on the first PCB, and components in the second ECU are disposed on the second PCB. Thus, by integrating the components of the two ECUs onto different PCBs, not only can the number of components carried by each PCB be reduced, thereby helping to reduce the area and load of each PCB, but the physical decoupling of the two ECUs can also be achieved, facilitating the development and design of the integrated device.

[0082] In one possible design, the integrated device may also include an inter-board connector, and the device in any ECU may include a microcontroller. The microcontroller in the first ECU is connected to the microcontroller in the second ECU via the inter-board connector, so as to realize communication between the two ECUs on the two PCBs through the inter-board connector.

[0083] In one possible design, the integrated device may also include a valve body for housing the controlled component. In this case, the device in any ECU may also include a driver for the controlled component. The microcontroller in the first ECU is connected to the driver of the controlled component in the first ECU through traces on the first PCB, and the microcontroller in the second ECU is connected to the driver of the controlled component in the second ECU through traces on the second PCB. This enables joint redundant control of the same controlled component by two ECUs.

[0084] In one possible design, where the controlled components include a motor, a solenoid valve, and a sensor, the devices in any ECU may also include a motor driver, a solenoid valve driver, and a sensor interface, so that any ECU can smoothly receive sensor information and then accurately drive the motor or solenoid valve based on the sensor information.

[0085] In one possible design, the integrated device may further include a housing, a support frame, a first PCB, and a second PCB, all housed within the housing, with at least one end of the support frame fixed to the housing. In this way, the housing serves to secure the support frame, thereby improving the stability of the fixed connection between the two PCBs by leveraging the housing's robust characteristics.

[0086] In one possible design, the support frame can be located on the top layer, the second PCB can be located on the bottom layer, and the first PCB is located between the support frame and the second PCB. The first PCB has an opening through which the support frame passes and securely connects the first and second PCBs. This allows the side of the second PCB opposite to the first PCB to be close to the housing, thereby increasing the heat dissipation area of ​​the second PCB through the housing and improving its heat dissipation effect.

[0087] In one possible design, the components in the first ECU can be positioned on the surface of the first PCB relative to the support frame, and the components in the second ECU can be positioned on the surface of the second PCB relative to the first PCB. This arrangement of components in the first and second ECUs on the same plane in the same direction facilitates routing between them in the board-to-board connector, reducing integration complexity.

[0088] Fourthly, this application provides an integrated device, including a first ECU, a second ECU, and a PCB, wherein the components in the first ECU and the components in the second ECU are integrated on the PCB. Thus, by integrating the components of both ECUs onto the same PCB, the height of the integrated device can be effectively reduced compared to integrating them onto two separate PCBs. Furthermore, this design allows all related device interfaces to be placed on a single PCB board, enabling the components and the interfaces of the devices on the PCB to be connected together in a single press-fit process, thereby simplifying the integration process.

[0089] In one possible design, the devices in either ECU may include a microcontroller, and the microcontroller in the first ECU may also be connected to the microcontroller in the second ECU via traces on the PCB to enable communication between the two ECUs.

[0090] In one possible design, the integrated device may also include a valve body for housing the controlled component. In this case, the device in any ECU may also include a driver for the controlled component, and the microcontroller in the ECU may also be connected to the driver of the controlled component in the ECU via traces on the PCB. This enables joint redundant control of the same controlled component by two ECUs.

[0091] In one possible design, where the controlled components include a motor, a solenoid valve, and a sensor, the devices in any ECU may also include a driver for the motor and a driver for the solenoid valve, as well as an interface for the sensor, so that any ECU can smoothly receive sensor information and then accurately drive the motor or solenoid valve based on the sensor information.

[0092] In one possible design, the integrated device may further include a housing, a support frame, and a PCB placed inside the housing, with at least one end of the support frame fixed to the housing. In this way, the housing can serve to fix the support frame, thereby improving the stability of the fixed PCB by relying on the sturdiness of the housing.

[0093] In one possible design, the support frame can be located on the top layer, and the PCB can be located on the bottom layer and close to the lower shell of the housing, so as to increase the heat dissipation area of ​​the PCB through the housing and further improve the heat dissipation effect of the PCB.

[0094] In one possible design, the components in the first ECU and the components in the second ECU can be positioned on the side of the PCB opposite to the support frame. This allows the components in the two ECUs to be connected via traces on the same side of the PCB, simplifying the trace deployment on the PCB and reducing integration complexity.

[0095] Fifthly, this application also provides a braking device, including: a first ECU, a second ECU, and a brake actuator, wherein the first ECU and the second ECU are respectively connected to the brake actuator for driving the brake actuator individually or jointly, so as to realize redundant control of the same brake actuator by the two ECUs.

[0096] In one possible design, the brake actuator may include a motor with three-phase windings. A first ECU and a second ECU are connected to the three-phase windings via wiring. When the first ECU is the default active ECU, it supplies three-phase AC power to the windings when it is functioning correctly. When the first ECU fails, the second ECU supplies three-phase AC power to the windings. In this design, the control unit can directly reuse the three-phase windings in the motor to achieve redundant control of the same motor by two ECUs without adding additional windings. Therefore, it is not only directly compatible with existing motors but also helps save costs.

[0097] In one possible design, while the first ECU is supplying three-phase AC power to the three-phase windings, it can also detect the current on the connection lines between the first ECU and each phase winding. When the current on the connection line to the first phase winding is less than a threshold, it sends a supplementary instruction to the second ECU. Upon receiving the supplementary instruction, the second ECU provides a supplementary electrical signal to the first phase winding through its connection line. Here, the first phase winding can be any one of the three phase windings. Thus, if a fault occurs in the process of one ECU supplying an electrical signal to a certain winding, another ECU can supplement the signal to that winding, while the signals to the other two windings can still be provided by the original ECU. That is, it is not necessary to switch the entire signal supply process to another ECU. In this way, with a small number of switching operations, sufficient three-phase current can be supplied to the motor jointly by the two ECUs, while improving switching stability.

[0098] In one possible design, the access control device may further include a switching circuit. This switching circuit is located on the connection lines between the first ECU and the three-phase winding, and also on the connection lines between the second ECU and the three-phase winding. The switching circuit is used to connect the first ECU to the three-phase winding and disconnect the second ECU from the three-phase winding when the first ECU is functioning correctly. Conversely, if the first ECU fails, it connects the second ECU to the three-phase winding and disconnects the first ECU from the three-phase winding. Thus, even if an ECU that should not normally provide three-phase AC power outputs three-phase AC power to the motor, the switching circuit can disconnect the drive link between that ECU and the motor, ensuring that the motor operates only under the drive of the other ECU, effectively improving the accuracy of redundant control.

[0099] In one possible design, when the current on the connection line between the first ECU and the first phase winding is less than a threshold, the first ECU can send a supplementary instruction to the second ECU and a first switching instruction to the switching circuit. After receiving the first switching instruction, the switching circuit can connect the connection line between the second ECU and the first phase winding so that the supplementary electrical signal provided by the second ECU can be smoothly transmitted to the phase winding of the motor.

[0100] In one possible design, while the first ECU is supplying three-phase AC power to the three-phase windings, it detects the current on the connection lines between itself and each phase winding. If the current on any of these connection lines falls below a threshold, the first ECU sends an activation instruction to the second ECU and stops supplying three-phase AC power to the three-phase windings. Upon receiving the activation instruction, the second ECU resumes supplying three-phase AC power to the three-phase windings through its connection lines. This allows for timely switching to another ECU when a problem occurs during the driving process of one ECU, avoiding the use of a faulty ECU and maintaining the accuracy of the motor drive.

[0101] In one possible design, the access control device may further include a switching circuit. This switching circuit is located on the connection lines between the first ECU and the three-phase windings, and on the connection lines between the second ECU and the three-phase windings. When the current in the connection line between the first ECU and any phase winding is less than a threshold, the first ECU sends a second switching instruction to the switching circuit. Upon receiving the second switching instruction, the switching circuit can disconnect the connection line between the first ECU and the three-phase windings, and connect the connection line between the second ECU and the three-phase windings. This ensures that the three-phase AC power supplied by the second ECU is smoothly transmitted to the three-phase stator windings of the motor, while also cutting off the three-phase AC power still supplied to the three-phase stator windings due to a fault in the first ECU, effectively ensuring the accuracy of motor drive.

[0102] In one possible design, the brake actuator may include a motor, which includes a first set of three-phase windings and a second set of three-phase windings. A first ECU is connected to the first set of three-phase windings via wiring, and a second ECU is connected to the second set of three-phase windings via wiring. When the first ECU is the default active ECU, it provides three-phase AC power to the first set of three-phase windings when it is functioning correctly; when the first ECU malfunctions, it provides three-phase AC power to the second set of three-phase windings. Thus, by adding an extra set of three-phase windings to the motor, accurate motor drive can be achieved through the electrical signals of each ECU to its corresponding three-phase winding, preventing interference between the electrical signals of one ECU and those of another.

[0103] In one possible design, the first set of three-phase windings and the second set of three-phase windings can both be wound around the entire area of ​​the motor core, but in different directions. Alternatively, the first set of three-phase windings and the second set of three-phase windings can be wound around different areas of the motor core. Or, some of the first set of three-phase windings and the second set of three-phase windings can be wound around the same area of ​​the motor core, while other parts of the windings can be wound around different areas of the motor core.

[0104] In one possible design, while the first ECU is supplying three-phase AC power to the first set of three-phase windings, it detects the current on the connection line between the first ECU and each phase winding in the first set of three-phase windings. When the current on the connection line with any phase winding is less than a threshold, the first ECU sends an activation instruction to the second ECU and stops supplying three-phase AC power to the first set of three-phase windings. Upon receiving the activation instruction, the second ECU supplies three-phase AC power to the second set of three-phase windings through the connection line between the second ECU and the second set of three-phase windings. In this way, even if a fault occurs in the process of one ECU supplying electrical signals to a certain set of three-phase windings, preventing the motor from driving, the motor can continue to be driven by the three-phase AC power supplied by another ECU to another set of three-phase windings, thereby achieving motor redundancy control while improving the timeliness of switching.

[0105] In one possible design, the access control device may further include a switching circuit. This switching circuit is located on the connection lines between the first ECU and the first set of three-phase windings, and on the connection lines between the second ECU and the second set of three-phase windings. When the current in the connection line between the first ECU and any phase winding is less than a threshold, the first ECU can send an activation instruction to the second ECU and a switching instruction to the switching circuit. Upon receiving the switching instruction, the switching circuit can disconnect the connection line between the first ECU and the first set of three-phase windings, and connect the connection line between the second ECU and the second set of three-phase windings. This ensures that the three-phase AC power supplied by the second ECU can be smoothly transmitted to the second set of three-phase windings of the motor, while simultaneously cutting off the three-phase AC power still supplied to the first set of three-phase windings due to a fault in the first ECU, effectively ensuring the accuracy of motor drive.

[0106] In one possible design, the brake actuator may include a solenoid valve with dual coils. A first ECU and a second ECU are respectively connected to the dual coils via wiring. When the first ECU is the default active ECU, it supplies DC power to the dual coils when it is functioning correctly; when the first ECU fails, the second ECU supplies DC power to the dual coils. This design achieves redundant actuation of the same solenoid valve by reusing the dual coils in the solenoid valve, eliminating the need for additional coils. Therefore, it is not only directly compatible with existing solenoid valves but also helps save costs.

[0107] In one possible design, while the first ECU is supplying DC power to the dual coils, it can also detect the current in the connection lines between the first ECU and each coil in the dual coils. When the current in the connection line to the first coil is less than a threshold, it sends a supplementary instruction to the second ECU. Upon receiving the supplementary instruction, the second ECU provides a supplementary electrical signal to the first coil through its connection line to the first coil. Here, the first coil can be any one of the two coils. With this design, if a fault occurs in the process of one ECU supplying an electrical signal to a certain coil, another ECU can supplement the signal to that coil, while the electrical signal to the other coil can still be provided by the original ECU. That is, it is not necessary to switch the entire process of supplying electrical signals to the other ECU. Thus, with a small number of switching operations, accurate DC power can be supplied to the solenoid valve jointly by the two ECUs, improving switching stability.

[0108] In one possible design, the access control device may further include a switching circuit. This switching circuit is located on the connection lines between the first ECU and the dual coils, and also on the connection lines between the second ECU and the dual coils. When the first ECU is functioning correctly, the switching circuit connects the first ECU to the dual coils and disconnects the second ECU from the dual coils. Conversely, when the first ECU fails, the switching circuit connects the second ECU to the dual coils and disconnects the first ECU from the dual coils. In this way, even if an ECU that should not normally provide DC power outputs DC power to the solenoid valve, the switching circuit can cut off the drive link between that ECU and the solenoid valve, ensuring that the solenoid valve operates only under the drive of the other ECU, effectively improving the accuracy of redundant control.

[0109] In one possible design, when the current in the connection line between the first ECU and the first coil is less than a threshold, the first ECU can send a supplementary instruction to the second ECU and a first switching instruction to the switching circuit. After receiving the first switching instruction, the switching circuit can connect the connection line between the second ECU and the first coil so that the supplementary electrical signal provided by the second ECU can be smoothly supplied to the first coil of the solenoid valve.

[0110] In one possible design, while the first ECU is supplying DC power to the dual coils, it can also detect the current in the connection lines between the first ECU and each coil in the dual coils. If the current in the connection line with any coil is less than a threshold, it sends an activation instruction to the second ECU and stops supplying DC power to the dual coils. Upon receiving the activation instruction, the second ECU can then supply DC power to the dual coils through its connection lines. In this way, by promptly switching to another ECU when a problem occurs in the driving process of one ECU, the use of a faulty ECU can be avoided, maintaining the accuracy of the solenoid valve's actuation.

[0111] In one possible design, the access control device may further include a switching circuit. This switching circuit is located on the connection lines between the first ECU and the dual coils, and on the connection lines between the second ECU and the dual coils. When the current in the connection line between the first ECU and either coil is less than a threshold, it can send an activation instruction to the second ECU and a second switching instruction to the switching circuit. Upon receiving the second switching instruction, the switching circuit can connect the second ECU to the dual coils and disconnect the first ECU from the dual coils. This design not only ensures that the DC power supplied by the second ECU is smoothly transmitted to the dual coils of the solenoid valve, but also cuts off the DC power still supplied to the dual coils due to a malfunction of the first ECU, ensuring the accuracy of the solenoid valve's actuation.

[0112] In one possible design, the brake actuator may include a solenoid valve, which includes a first positive coil, a second positive coil, and a negative coil. A first ECU is connected to the first positive coil and the negative coil via a circuit, and a second ECU is connected to the second positive coil and the negative coil via a circuit. If the first ECU is the default active ECU, when the first ECU is not faulty, it provides DC power to the first positive coil and the negative coil. When the first ECU is faulty, the second ECU provides DC power to the second positive coil and the negative coil.

[0113] In one possible design, while the first ECU is supplying DC power to the first positive and negative coils, it can also detect the current in the connection line between the first ECU and the negative coil. When the current in the connection line to the negative coil is less than a threshold, it sends a supplementary instruction to the second ECU. Upon receiving the supplementary instruction, the second ECU can then supply an electrical signal to the second positive coil through the connection line between the second ECU and the second positive coil. In this design, if a fault occurs in the process of one ECU supplying an electrical signal to the negative coil, the other ECU can supplement the negative coil with an electrical signal, while the electrical signal on the first positive coil can still be supplied by the original ECU. That is to say, it is not necessary to switch the electrical signal supply process of both the first positive and negative coils to the other ECU. In this way, with a small number of switching operations, sufficient electrical signals can be supplied to the negative coil through two ECUs while improving switching stability.

[0114] In one possible design, the access control device may further include a switching circuit. This switching circuit is located on the connection lines between the first ECU and the first positive coil, the first ECU and the negative coil, the second ECU and the second positive coil, and the second ECU and the negative coil. The switching circuit is used to connect the first ECU to the first positive coil and the first ECU to the negative coil, and disconnect the second ECU from the second positive coil and the second ECU from the second negative coil, when the first ECU is functioning correctly. Conversely, if the first ECU fails, it connects the second ECU to the second positive coil and the second ECU to the negative coil, and disconnects the first ECU from the first positive coil and the first ECU from the first negative coil. Thus, even if an ECU that should not normally provide DC power outputs DC power to the solenoid valve, the switching circuit can cut off the drive link of that ECU to the solenoid valve, ensuring that the solenoid valve operates only under the drive of another ECU, effectively improving the accuracy of redundant control.

[0115] In one possible design, when the current in the connection line between the first ECU and the first positive coil is less than a threshold, the first ECU can send a supplementary instruction to the second ECU and a first switching instruction to the switching circuit. After receiving the first switching instruction, the switching circuit can connect the connection line between the second ECU and the negative coil so that the supplementary electrical signal provided by the second ECU can be smoothly transmitted to the negative coil of the solenoid valve.

[0116] In one possible design, while the first ECU is supplying DC power to the first positive and negative coils, it can also detect the current in the connection lines between the first ECU and each of the first positive and negative coils. If the current in the connection line to any coil is less than a threshold, it sends an activation instruction to the second ECU and stops supplying DC power to the first positive and negative coils. Upon receiving the activation instruction, the second ECU can then supply DC power to the second positive and negative coils through the connection lines between the second ECU and the second positive and negative coils. In this way, by promptly switching to another ECU when a problem occurs in the driving process of one ECU, the use of a faulty ECU can be avoided, maintaining the accuracy of the solenoid valve's actuation.

[0117] In one possible design, the access control device may further include a switching circuit. This switching circuit is located on the connection lines between the first ECU and the first positive coil, the first ECU and the negative coil, the second ECU and the second positive coil, and the second ECU and the negative coil. When the current in the connection line between the first ECU and any of the coils is less than a threshold, the first ECU can send an activation instruction to the second ECU and a second switching instruction to the switching circuit. Upon receiving the second switching instruction, the switching circuit can connect the second ECU to the second positive coil and the second ECU to the negative coil, and disconnect the first ECU from the first positive coil and the first ECU from the negative coil. This ensures that the DC power supplied by the second ECU is smoothly transmitted to the second set of dual coils of the solenoid valve, while simultaneously cutting off the DC power still supplied to the first set of dual coils due to a malfunction of the first ECU, thus ensuring the accuracy of the solenoid valve's actuation.

[0118] In one possible design, the brake actuator may include a solenoid valve, which comprises a first set of dual coils and a second set of dual coils. A first ECU is connected to the first set of dual coils via wiring, and a second ECU is connected to the second set of dual coils via wiring. When the first ECU is the default active ECU, it supplies DC power to the first set of dual coils when it is functioning correctly; when the first ECU malfunctions, it supplies DC power to the second set of dual coils. Thus, by adding an additional set of dual coils to the solenoid valve, accurate actuation of the solenoid valve can be achieved through the electrical signals from each ECU to its corresponding dual coil, preventing interference between the electrical signals of one ECU and those of another.

[0119] In one possible design, the first set of double coils and the second set of double coils can both be wound around the entire area of ​​the iron core of the solenoid valve, but in different directions on the iron core. Alternatively, the first set of double coils and the second set of double coils can be wound around different areas of the iron core of the solenoid valve. Or, some coils of the first set of double coils and the second set of double coils can be wound around the same area of ​​the iron core of the solenoid valve, while other coils can be wound around different areas of the iron core of the solenoid valve.

[0120] In one possible design, while the first ECU is supplying DC power to the first set of dual coils, it can also detect the current in the connection lines between the first ECU and each coil in the first set of dual coils. When the current in the connection line with any coil is less than a threshold, the first ECU sends an activation instruction to the second ECU and stops supplying DC power to the first set of dual coils. Upon receiving the activation instruction, the second ECU can then supply DC power to the second set of dual coils through the connection lines between the second ECU and the second set of dual coils. This design allows the solenoid valve to be driven by DC power supplied by another ECU to another set of dual coils if a failure occurs during the process of one ECU supplying electrical signals to a certain set of dual coils, thus achieving redundant control of the solenoid valve while improving the timeliness of switching.

[0121] In one possible design, the access control device may further include a switching circuit. This switching circuit is located on the connection lines between the first ECU and the first set of dual coils, and on the connection lines between the second ECU and the second set of dual coils. When the current in the connection line between the first ECU and any coil is less than a threshold, it can send an activation instruction to the second ECU and a switching instruction to the switching circuit. Upon receiving the switching instruction, the switching circuit can connect the second ECU to the second set of dual coils and disconnect the connection line between the first ECU and the first set of dual coils. This ensures that the DC power supplied by the second ECU is smoothly transmitted to the second set of dual coils of the solenoid valve, while simultaneously cutting off the DC power still supplied to the first set of dual coils due to a malfunction of the first ECU, thus ensuring the accuracy of the solenoid valve's actuation.

[0122] Sixthly, this application provides a terminal device including a braking system as described in any of the designs of the first aspect above, or an integrated device as described in any of the designs of the second to fourth aspects above, or an access control device as described in any of the designs of the fifth aspect above.

[0123] For details of the beneficial effects of aspects two through six above, please refer to the technical effects that can be achieved by the corresponding designs in aspect one above, which will not be repeated here. Attached Figure Description

[0124] Figure 1An exemplary schematic diagram of a braking system provided in an embodiment of this application is shown;

[0125] Figure 2 An exemplary diagram of a possible product form provided in an embodiment of this application is shown;

[0126] Figure 3 An exemplary schematic diagram of a braking system provided in an embodiment of this application is shown;

[0127] Figure 4 An exemplary schematic diagram of another braking system provided in an embodiment of this application is shown;

[0128] Figure 5 An exemplary schematic diagram of another braking system provided in an embodiment of this application is shown;

[0129] Figure 6 An exemplary schematic diagram of another braking system provided in an embodiment of this application is shown;

[0130] Figure 7 An exemplary schematic diagram of another braking system provided in an embodiment of this application is shown;

[0131] Figure 8 An exemplary schematic diagram of an integrated device provided in an embodiment of this application is shown;

[0132] Figure 9 An exemplary schematic diagram of another integrated device provided in an embodiment of this application is shown;

[0133] Figure 10 An exemplary schematic diagram of another integrated device provided in an embodiment of this application is shown;

[0134] Figure 11 This illustration shows a schematic diagram of the structure of an access control device provided in an embodiment of this application;

[0135] Figure 12 This illustration shows a schematic diagram of a structure in which two ECUs are connected to the same motor, according to an embodiment of this application.

[0136] Figure 13 This illustration shows a schematic diagram of a structure in which two ECUs are connected to the same solenoid valve, according to an embodiment of this application. Detailed Implementation

[0137] It should be noted that the terms "system" and "network" in the embodiments of this application can be used interchangeably. "Multiple" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can mean: A exists alone, A and B exist simultaneously, or B exists alone, where A and B can be singular or plural. "One or more of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, one or more of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0138] Furthermore, unless otherwise specified, the ordinal numbers such as "first" and "second" mentioned in the embodiments of this application are used to distinguish multiple objects and are not used to limit the priority or importance of multiple objects. For example, "first electronic control unit" and "second electronic control unit" are only used to distinguish different electronic control units, and do not indicate that these electronic control units have different priorities or importance.

[0139] The specific implementation of the braking system and device in this application will be described below with reference to specific embodiments. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments.

[0140] This application provides a braking system that can be applied to terminal devices with braking capabilities. These terminal devices can be intelligent transportation equipment, including but not limited to automobiles, ships, airplanes, drones, trains, freight cars, or trucks. In a specific application scenario, the braking system can be applied to vehicle-to-everything (V2X) networks, such as long-term evolution-vehicle (LTE-V) communication, and vehicle-to-vehicle (V2V) communication, and is particularly suitable for autonomous or driver-assisted vehicles.

[0141] The specific implementation of the braking system provided in this application is described below through Example 1.

[0142] Example 1

[0143] Figure 1 An exemplary schematic diagram of a braking system provided in an embodiment of this application is shown, such as... Figure 1As shown, in this example, the braking system includes a reservoir 130, a master cylinder module 140, a brake pedal 150, a push rod 160, a first pressure control unit 111, a second pressure control unit 112, a first electronic control unit (ECU) 121, a second ECU 122, and a redundant ECU 123. The brake pedal 150 is connected to the master cylinder module 140 via the push rod 160. The reservoir 130, the master cylinder module 140, the first pressure control unit 111, and the second pressure control unit 112 are sequentially connected via oil lines, and the second pressure control unit 112 is also connected to the braked wheel via an oil line. The first ECU 121, the second ECU 122, and the redundant ECU 123 are components capable of supporting simple sensor data processing and complex logic calculations. In implementation, the first ECU 121 is used to control the brake actuator in the first pressure control unit 111, the second ECU 122 is used to control the brake actuator in the second pressure control unit 112, and the redundant ECU 123 is used to control at least one brake actuator in the first pressure control unit 111, and / or control at least one brake actuator in the second pressure control unit 112. Under the control of at least one of the first ECU 121, the second ECU 122, and the redundant ECU 123, the first pressure control unit 111 and the second pressure control unit 112 can individually or jointly complete the braking operation on the braked wheel.

[0144] For example, redundant ECU123 can be as follows Figure 1 (A) or Figure 1 As shown in (B), at least one brake actuator in the first pressure control unit 111 is connected, but the brake actuator in the second pressure control unit 112 is not connected, so as to achieve independent braking control of the first pressure control unit 111. Alternatively, as shown in [the diagram], [the brake actuator can be connected to the first pressure control unit 111]. Figure 1 (C) or Figure 1 As shown in (D), at least one brake actuator in the second pressure control unit 112 is connected but not the brake actuator in the first pressure control unit 111, so as to realize the individual braking control of the second pressure control unit 112. Alternatively, at least one brake actuator in the first pressure control unit 111 and at least one brake actuator in the second pressure control unit 112 can be connected to realize the joint braking control of the first pressure control unit 111 and the second pressure control unit 112. The specific details are not limited.

[0145] For example, the brake actuator can be any device that can perform the function in the braking system, such as including but not limited to a motor or solenoid valve.

[0146] For example, the first ECU 121 can control all or some of the brake actuators in the first pressure control unit 111, and the second ECU 122 can control all or some of the brake actuators in the second pressure control unit 112. However, regardless of whether the first ECU 121 and the second ECU 122 control all or some of the brake actuators, at least one brake actuator controlled by the redundant ECU 123 must be less than or equal to the number of brake actuators controlled by the first ECU 121, and / or less than or equal to the number of brake actuators controlled by the first ECU 122. For example, taking the redundant ECU 123 controlling at least one brake actuator in the first pressure control unit 111 as an example, when the first ECU 121 can control all the motors and all the solenoid valves in the first pressure control unit 111, the motors and solenoid valves that the redundant ECU 123 can control can be any of the following: all the motors and all the solenoid valves in the first pressure control unit 111, all the solenoid valves in the first pressure control unit 111 but excluding the motors in the first pressure control unit 111, all the motors in the first pressure control unit 111 but excluding the solenoid valves in the first pressure control unit 111, some of the solenoid valves in the first pressure control unit 111 but excluding all the solenoid valves in the first pressure control unit 111, and some of the motors in the first pressure control unit 111 but excluding all the motors in the first pressure control unit 111. When the first ECU 121 can control some of the motors and / or some of the solenoid valves in the first pressure control unit 111, the motors and solenoid valves that the redundant ECU 123 can control can be any of the following: the same part of the motors and / or the same part of the solenoid valves in the first pressure control unit 111; the same part of the solenoid valves in the first pressure control unit 111 but excluding the motors in the first pressure control unit 111; the same part of the motors in the first pressure control unit 111 but excluding the solenoid valves in the first pressure control unit 111; some of the motors in the same part of the first pressure control unit 111 and / or some of the solenoid valves in the same part of the first pressure control unit 111, etc. There are many other possible designs for the ECU and the brake actuators it can control, which will not be listed here.

[0147] For example, taking the case where a redundant ECU 123 is connected to at least one brake actuator in a pressure control unit 111, considering that the number of brake actuators controlled by the first ECU 121 is greater than or equal to the number of brake actuators controlled by the redundant ECU 123, in order to enable the braking system to have more comprehensive braking functions in the default state, the braking system can select the first ECU 121 as the default active ECU corresponding to the first pressure control unit 111. That is, when the first ECU 121 is not faulty, the braking system can use the first ECU 121 to control the first pressure control unit 111, and when the first ECU 121 fails, the braking system can switch to using the redundant ECU 123 to control the first pressure control unit 111. In this way, even if the default active first ECU fails for some reason, the braking system can flexibly switch to the redundant ECU to continue controlling the first pressure control unit, which helps to improve the flexibility and reliability of redundant control.

[0148] In this application embodiment, there are many solutions that can achieve the switching from the first ECU121 to the redundant ECU123. For example:

[0149] In one possible solution, the first ECU 121 and the redundant ECU 123 can communicate via local internet (LIN) technology, FlexRay network technology, or controller area network (CAN) technology. The first ECU 121 can send heartbeat messages to the redundant ECU 123 at preset intervals, and the redundant ECU 123 can be equipped with a timer with a duration equal to one preset period. In implementation, after receiving a heartbeat message from the first ECU 121, the redundant ECU 123 can start or restart the timer until the timer expires. If the redundant ECU 123 does not receive another heartbeat message from the redundant ECU 121, it means that the first ECU 121 is malfunctioning. At this point, the redundant ECU 123 can determine that the braking of the first ECU 121 has failed, and then the redundant ECU 123 can switch to the active state, that is, it can control the first pressure control unit 111 to brake according to the driver's pedal input or the instructions of the automatic driving system or the driver assistance system. Conversely, if the redundant ECU123 receives another heartbeat message from the redundant ECU121 before the timer expires, it means that the first ECU121 is normal and can still perform the braking function. Therefore, the redundant ECU123 does not need to switch states, that is, it remains in a failed state.

[0150] In another possible solution, the first ECU 121 and the redundant ECU 123 can communicate via LIN technology, Flexray network technology, or CAN technology. The first ECU 121 can include a detection circuit, which includes a detection resistor connected to the line linking the first ECU 121 to the brake actuator. When the first ECU 121 drives the brake actuator, it can also obtain the current value flowing through the detection resistor (e.g., through a current detector). If this current value does not match the current value under operating conditions, it indicates an abnormality in the braking of the first ECU 121. In this case, the first ECU 121 can send an activation command to the redundant ECU 123, causing the redundant ECU 123 to switch to the active state. Conversely, if the current value matches the current value under operating conditions, it means the braking of the first ECU 121 is normal, and the first ECU 121 can continue braking, while the redundant ECU 123 can remain inactive.

[0151] For example, in this scheme, the matching of the current value of the sensing resistor and the current value under the component's operating state can mean that the difference between the current value of the sensing resistor and the current value under the component's operating state is not greater than a preset difference threshold. The mismatch between the current value of the sensing resistor and the current value under the component's operating state can mean that the difference between the current value of the sensing resistor and the current value under the component's operating state is greater than the preset difference threshold. The current value under the component's operating state and the preset difference threshold can be obtained through experimental verification or by those skilled in the art based on experience; no specific limitation is imposed. One possible method of obtaining this information empirically is that if the component is a normally open solenoid valve, it will be disconnected when energized and conduct when not energized; that is, the current value under the component's operating state should be the current value corresponding to a high-level voltage. Based on this, if the first ECU 121 powers on the component, the current value on the line between the first ECU 121 and the component should be the current value corresponding to a high level. However, if the current flowing through the detection resistor on that line is the current value corresponding to a low level, it indicates that the control process of the component is malfunctioning. Therefore, the first ECU 121 can send an activation command to the redundant ECU 123. Similarly, if the component is a normally closed solenoid valve, the current value on the line between the first ECU 121 and the component should be the current value corresponding to a low level when the component is powered on. However, if the current flowing through the detection resistor on that line is the current value corresponding to a high level, it indicates that the control process of the component is malfunctioning. Therefore, the first ECU 121 can also send an activation command to the redundant ECU 123.

[0152] In another possible solution, a central controller can be installed outside the braking system. This central controller can communicate with the various ECUs and sensors in the braking system via LIN, FlexRay, or CAN technologies. In implementation, when the central controller determines to brake the vehicle based on the driver's pedal input or instructions from the autonomous driving or driver assistance systems, it can send a braking instruction to the first ECU 121 to utilize the first ECU for braking. Furthermore, during the braking process of the first ECU 121, the central controller can also collect sensor data reported by various sensors in the vehicle and detect the vehicle's driving status based on this data. If the vehicle's driving status does not match the braking instruction sent to the first ECU 121 by the central controller, it indicates that the first ECU 121 has failed. In this case, the central controller can re-send a braking instruction to the redundant ECU 123 to utilize the redundant ECU for braking. Subsequently, the central controller can continue to use the redundant ECU 123 for braking until it receives a self-check and repair notification message from the first ECU 121, or detects a restart of the braking system, at which point it switches back to the default first ECU 121 for braking.

[0153] The central controller can be an integrated circuit chip with signal processing capabilities. For example, the central controller can be a general-purpose processor, a field-programmable gate array (FPGA), an application-specific integrated circuit (ASIC), a system-on-chip (SoC), a network processor (NP), a digital signal processor (DSP), a microcontroller unit (MCU), a programmable logic device (PLD), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or other integrated chips. The central controller may include components or circuits with processing capabilities, such as a central processing unit (CPU), a neural network processing unit (NPU), or a graphics processing unit (GPU). It may also include an application processor (AP), a modem processor, an image signal processor (ISP), a video codec, a digital signal processor (DSP), and / or a baseband processor, etc., without being specifically limited.

[0154] Of the three possible solutions mentioned above, the first two can directly complete the braking switchover through the interaction between the first ECU and the redundant ECU, eliminating the need for the central controller as an intermediary, thus improving the efficiency of redundant braking. The third solution, however, enables the central controller to uniformly manage the active and inactive states of each ECU, helping to improve the standardization of ECU state management.

[0155] It should be understood that the above content only provides a few possible switching schemes as examples. In other examples, the first ECU121 and the redundant ECU123 can also have other switching methods. For example, in another switching method, when the first ECU121 is braking, it can also send a notification message to the redundant ECU123. After receiving the notification message, the redundant ECU123 can monitor the status information of the braking-related sensors. If it is determined that the status information does not match the braking function indicated in the notification message, the redundant ECU123 can determine that the braking of the first ECU121 has failed, and then the redundant ECU123 can directly switch to the active state.

[0156] In addition, the first ECU 121, the redundant ECU 123, and other control units outside the braking system can all be connected via the CAN bus. When braking is required, other control units will send control commands to the CAN bus. At this time, both the first ECU 121 and the redundant ECU 123 can obtain the control commands from the CAN bus, and only the active ECU will execute the control commands. This ensures that only one of the first ECU 121 and the redundant ECU 123 brakes at the same time, avoiding the problem of repeated braking.

[0157] In this embodiment, the oil reservoir 130 is a device for storing oil. During braking, the oil in the reservoir 130 is drawn out and applied to the braked wheel through the oil passage between the reservoir 130 and the first pressure control unit 111, the oil passage between the first pressure control unit 111 and the second pressure control unit 112, and the oil passage between the second pressure control unit 112 and the braked wheel, so as to achieve braking operation by applying pressure to the braked wheel. When the braking is released, the oil previously applied to the braked wheel returns to the reservoir 130 through the oil passage between the braked wheel and the second pressure control unit 112, the oil passage between the second pressure control unit 112 and the first pressure control unit 111, and the oil passage between the first pressure control unit 111 and the reservoir 130, thereby realizing the recycling of the oil.

[0158] In this embodiment, the master cylinder module 140 is also called the hydraulic brake master valve, and the master cylinder module 140 can be as follows: Figure 1 (A) or Figure 1 As shown in (C), it is integrated within the first pressure control unit 111 to further improve system integration, or as... Figure 1 (B) or Figure 1The master cylinder module 140, as shown in (D), exists independently of the first pressure control unit 111 to achieve flexible control of the master cylinder fluid. Furthermore, the master cylinder module 140 can also be connected via an oil circuit to other brake actuators in the first pressure control unit 111. In implementation, the master cylinder module 140, brake pedal 150, and push rod 160 can be used to provide the driver's pedal feel. For example, with... Figure 1 Taking the structure shown in (B) as an example, under normal circumstances, the master cylinder module 140 is a piston cylinder that stores oil flowing from the oil reservoir 130. When the driver depresses the brake pedal 150, the depressing force drives the push rod 160 to move the piston rod in the master cylinder module 140, causing the oil in the piston cylinder to be forced into the oil passage between the master cylinder module 140 and the first pressure control unit 111, and then flow into the first pressure control unit 111. In this way, by converting the driver's depressing force on the brake pedal 150 into the power of the oil, the driver's feeling of braking by pressing the pedal can be maintained. Conversely, when the driver releases the depressing force on the brake pedal 150, the brake pedal 150 will drive the push rod 160 to move, causing the piston rod in the master cylinder module 140 to return to its original position, thereby causing the oil previously forced into the oil passage between the master cylinder module 140 and the first pressure control unit 111, as well as the oil flowing into the first pressure control unit 111, to return to the piston cylinder. In this way, the driver's feeling of releasing the brake by releasing the pedal can be maintained.

[0159] For example, one or more solenoid valves may be provided in the oil circuit inside the first pressure control unit 111 that realizes the driver's pedal feel. The state of the one or more solenoid valves can be controlled by any one of the first ECU 121 and the redundant ECU 123. In this way, when the first ECU 121 fails, the redundant ECU 123 can be switched to continue controlling the one or more solenoid valves in the oil circuit in a timely manner, so as to maintain the driver's pedal feel as unchanged as possible even in abnormal conditions, avoid causing the driver to experience brake failure and panic, and improve the driver's driving comfort.

[0160] Further exemplarily, the first pressure control unit 111 and the second pressure control unit 112 may also be equipped with motors. The rotation of the motor in the first pressure control unit 111 can be controlled by any one of the first ECU 121 and the redundant ECU 123, or the rotation of the motor in the second pressure control unit 112 can be controlled by any one of the redundant ECU 123. Thus, continuing with... Figure 1Taking the structure shown in (B) as an example, when braking (including but not limited to driver braking, automatic driving braking, or assisted driving braking), if the first ECU 121 fails, it can be switched to the redundant ECU 123 in time to continue controlling the motor in the first pressure control unit 111 to rotate in a certain direction, so that the oil entering the first pressure control unit 111 (which may be the oil pressed into the first pressure control unit 111 by the brake pedal being pressed, or the oil obtained by the first pressure control unit 111 from the oil reservoir 130 through other oil passages, the specific is not limited) flows into the second pressure control unit 112 through the oil passage between the first pressure control unit 111 and the second pressure control unit 112 under the action of the motor. Then, under the action of the second ECU 122 controlling the motor in the second pressure control unit 112 to rotate in a certain direction, the oil flowing into the second pressure control unit 112 is then applied to one or more braked wheels connected to the second pressure control unit 112 to achieve braking of the braked wheels. Conversely, when the brake is released, under the action of the motor in the second pressure control unit 112 controlled by the second ECU 122 to rotate in the other direction, the oil previously applied to the braked wheel can flow back to the second pressure control unit 112. Then, during the process of the motor in the first pressure control unit 111 controlled by the redundant ECU 123 to rotate in the other direction, the oil flowing into the second pressure control unit 112 returns to the first pressure control unit 111 via the oil passage between the first pressure control unit 111 and the second pressure control unit 112, and then returns to the master cylinder module 140 or the oil reservoir 130.

[0161] As a further example, one or more solenoid valves may be provided in the oil circuit inside the first pressure control unit 111 that implements the braking of the brake wheel, and the state of the one or more solenoid valves may be controlled by any one of the first ECU 121 and the redundant ECU 123. In this way, when the first ECU 121 fails, the redundant ECU 123 can be switched to continue controlling the one or more solenoid valves in the oil circuit in a timely manner, so as to continue to maintain the oil flow in the circuit during the braking process even in abnormal conditions, or to continue to maintain the reverse flow of oil in the circuit during the cancellation of braking, thereby achieving redundant braking.

[0162] Further exemplarily, the second pressure control unit 112 can be connected to all or part of the braked wheels. For example, taking a vehicle as an example, in one possible instance, continuing to refer to... Figure 1 As shown, assume the vehicle has four braked wheels, namely the left front wheel (LFW) (i.e. Figure 1 The FL indicates the wheel, and the left rear wheel (LRW) is the wheel shown. Figure 1The indicated RL corresponds to the wheel, and the right front wheel (RFW) is the wheel that is shown. Figure 1 The FR wheel shown corresponds to the right rear wheel (RRW). Figure 1 If the indicated RR corresponds to the wheel, then the second pressure control unit 112 can be connected to each of the four braked wheels of the vehicle through four oil circuits. Thus, during braking, the braking system can select one or more of the connected braked wheels to brake according to the current braking function. For example, when implementing the basic braking function, all connected braked wheels can be braked to decelerate the vehicle as quickly as possible, while when implementing the traction braking system function, only the braked wheel currently experiencing slippage can be braked to reduce slippage while continuing to drive.

[0163] It should be noted that the aforementioned pressure control unit may include not only motors and / or solenoid valves, but also hydraulic valves and various sensors, such as pressure sensors, flow sensors, and motor position sensors. Correspondingly, the aforementioned ECU may include solenoid valve drivers, motor drivers, and various signal processors and control output interfaces. Thus, during braking, the ECU can receive measurement or detection signals from various sensors, determine the current environmental conditions, driver input, and braking system status based on these signals, and then calculate and judge the subsequent braking method to change or continue controlling the braking characteristics of the pressure control unit.

[0164] For example, Figure 2 This application provides a possible product form diagram, wherein:

[0165] Figure 2 Figure (A) shows a structural diagram of the master cylinder module 140 integrated into the first pressure control unit 121. When this structure is... Figure 1 In the structure shown in (A), module 1 can be an assembly module integrating a first pressure control unit 111, a first ECU 121, and a redundant ECU 123, with the first pressure control unit 111 integrating a master cylinder module 140. Module 2 is an assembly module integrating a second pressure control unit 112 and a second ECU 122. Modules 1 and 2, together with the oil reservoir 130, push rod 160, and brake pedal 150, constitute a braking system. When this structure is... Figure 1In the structure shown in (C), module 1 is an assembly module integrating a first pressure control unit 112 and a first ECU 121, and the first pressure control unit 112 integrates a master cylinder module 140. Module 2 is an assembly module integrating a second pressure control unit 111, a second ECU 122 and a redundant ECU 123. Module 1 and Module 2 together with the oil reservoir 130, push rod 160 and brake pedal 150 constitute a braking system.

[0166] Figure 2 Diagram (B) shows a structural diagram of the master cylinder module 140 existing independently of the first pressure control unit 121. When this structure is... Figure 1 In the structure shown in (B), module 1 is an assembly module integrating a first pressure control unit 111, a first ECU 121, and a redundant ECU 123; module 2 is an assembly module integrating a second pressure control unit 112 and a second ECU 122. Modules 1 and 2, together with the oil reservoir 130, master cylinder module 140, push rod, and brake pedal 150, constitute the braking system. When this structure is... Figure 1 In the structure shown in (D), module 1 is an assembly module integrating the second pressure control unit 112 and the first ECU 121, and module 2 is an assembly module integrating the first pressure control unit 111, the second ECU 122 and the redundant ECU 123. Module 1 and module 2 together with the oil reservoir 130, the master cylinder module 140, the push rod and the brake pedal 150 constitute the braking system.

[0167] It should be noted that the above description only uses the example of two ECUs for control of the same brake actuator. In actual operation, the same brake actuator can also correspond to three or more ECUs. Thus, even if both ECUs corresponding to the brake actuator fail, the braking system can switch to a third ECU in time to continue driving the brake actuator, thereby further improving the redundant braking capability. Furthermore, the above description only uses the example of the first pressure control unit 111 corresponding to two ECUs. In actual operation, the second pressure control unit 112 can also correspond to at least two ECUs. Thus, if the second ECU 122 fails, the braking capability of the second pressure control unit 112 can be maintained by switching to other ECUs within the second pressure control unit 112. The relevant implementation methods can be directly referred to the above description, and this application does not impose specific limitations on them.

[0168] In the first embodiment described above, by setting at least two ECUs for controlling the same brake actuator, redundant control of the brake actuator can be achieved using the remaining ECUs even if some of them fail. This method achieves redundant braking with the additional ECUs, eliminating the need for a new pressure control unit and corresponding ECU. This helps reduce the complexity of adding redundancy to the braking system, thereby reducing the difficulty and cost of vehicle installation and layout. Furthermore, the at least two pressure control units in the first embodiment can achieve at least two levels of redundant braking. Controlling the same brake actuator in the same pressure control unit with at least two ECUs is equivalent to further achieving at least three levels of redundant braking on top of at least two levels. At least three levels of redundant braking can be adapted to L2 to L4 and even higher levels of autonomous driving systems. Therefore, the first embodiment can increase the redundancy of a vehicle with at least two levels of redundant braking by setting as few components as possible, which helps to improve the redundant braking capability of the braking system while saving costs and reducing the complexity of the overall vehicle layout.

[0169] In this embodiment, the first pressure control unit 111 and the second pressure control unit 112 can perform the braking function of the braking system independently or collaboratively. The braking functions performed by the first pressure control unit 111 and the second pressure control unit 112 can be the same or different, and are not specifically limited. The braking function of the braking system may include, but is not limited to, one or more of the following functions:

[0170] Basic braking function (BBF): BBF applies to OneBox braking systems, which integrate all braking functions into a single mechanical assembly. This system eliminates the vacuum booster and instead uses a moving piston cylinder for pressurization in response to the driver's braking intention.

[0171] Anti-lock Braking System (ABS): Under normal circumstances, when a vehicle brakes suddenly or on icy or snowy roads, the wheels tend to lock up, increasing the braking distance and potentially causing the vehicle to lose steering control. ABS can reduce the braking force at the wheels that are about to lock up, thus preventing wheel lock-up.

[0172] Traction control system (TCS): Under normal circumstances, when a vehicle is driving on icy or snowy roads or when one of its wheels is stuck in mud, the wheel will slip, making it impossible for the vehicle to move normally. TCS can reduce the driving force or apply braking force to the slipping wheel according to the slipping situation, so as to reduce the slipping and ensure that the vehicle can move normally.

[0173] Electronic stability control system (ESC): Also known as electronic stability program (ESP), ESC receives vehicle information collected by sensors, determines the vehicle's instability based on the information, and applies braking force to individual wheels or a number of wheels when it is determined that the vehicle is about to become unstable, in order to obtain a yaw moment to stabilize the vehicle and achieve the purpose of stabilizing the vehicle.

[0174] Automatic emergency braking (AEB): AEB can detect the distance between the vehicle and the vehicle or obstacle in front while the vehicle is in motion, and compare the detected distance with the warning distance and the safe distance (the warning distance is greater than the safe distance). When the detected distance is less than the warning distance, an alarm is issued. When the detected distance is less than the safe distance, the vehicle is automatically braked. In this way, even if the driver has not had time to press the brake pedal, driving safety can be ensured by AEB automatic braking.

[0175] Adaptive cruise control (ACC): ACC refers to a system that adds a function to maintain a reasonable distance from the vehicle in front in a vehicle that cruises at a set speed. It usually has functions such as constant speed cruise, follow cruise, cornering cruise, driving mode selection, intelligent cornering, and intelligent speed limit. It can control the speed of the vehicle through the braking system and drive system to achieve the above functions.

[0176] Value Added Function (VAF): VAF refers to all braking functions other than those mentioned above. Its main functions include: responding to ADS / ADAS control requests and providing control interfaces such as ABP, AEB, APA, AWB, CDD Stop&Go, and VLC to meet the control requirements of ADS / ADAS for vehicle driving and braking; ensuring driver comfort and safety through functions such as AVH, BDW, HAZ, HBA, HDC, HFC, HRB, and HSA, which are suitable for conditions such as hill starts, downhill driving, prolonged braking, and brake disc overheating.

[0177] For ease of understanding, the following example illustrates the application of the braking system and the above-mentioned braking function in the embodiments of this application by taking the redundant ECU123 connected to at least one brake actuator in a pressure control unit as an example.

[0178] Figure 3 This illustration shows a schematic diagram of a braking system provided in this application before the application of the aforementioned redundant braking scheme. Figure 3 As shown, the braking system includes a reservoir 130, a first module, and a second module. The reservoir 130 and the first module, as well as the first and second modules, are connected via three brake lines. The first module integrates the following components: ECU 10, motor M1, motor position sensor E1, solenoid valve P1, master cylinder module 140, push rod, brake pedal 150, pedal travel sensor E2, solenoid valve P2, pedal simulator, solenoid valve P3, master cylinder pressure sensor E3, solenoid valve P4, moving piston cylinder, one-way valve K1, brake circuit pressure sensor E4, solenoid valve P5, and solenoid valve P6. The components in the first module are connected via... Figure 3 The brake lines are connected as shown, and the ECU10 in the first module is connected to all other components in the first module. It is used to obtain the status information collected by various sensors in the first module and to control the motor M1 and all solenoid valves P1-P6 in the first module. The main function of the first module is boosting, enabling vehicle BBF and AEB (Autonomous Emergency Braking) and other VAF (Variable Valve Assist) functions. Correspondingly, the second module integrates the following components: ECU20, motor M2, one-way pump S1, one-way valve K2, accumulator, solenoid valves P7, P8, P9, P10, P11, P12, one-way pump S2, one-way valve K3, solenoid valves P13, P14, P15, P16, P17, and P18. The components in the second module are connected via... Figure 3The brake lines are connected as shown, and the ECU20 in the second module is connected to all other components in the second module, used to control the motor M2 and all solenoid valves P7 to P18 in the second module. The main function of the second module is wheel cylinder pressure control, enabling the vehicle's ESC, ABS, and TCS functions. Furthermore, although... Figure 3 Although not illustrated, the oil reservoir 130 may also integrate a liquid level sensor, and the second module may also integrate various pressure sensors. ECU10 and ECU20 communicate via CAN or other communication methods. This application embodiment does not specifically limit this.

[0179] Furthermore, when the redundant braking scheme in the embodiments of this application is applied to... Figure 3 When designing the braking system as shown, a redundant ECU30 can be designed. This redundant ECU30 can be applied in any of the following ways and can communicate with ECU10 and ECU20 via CAN or other communication methods to obtain a redundant braking scheme:

[0180] In one possible application, Figure 4 This illustration shows a schematic diagram of the specific structure of a braking system after applying a redundant braking scheme, as provided in an embodiment of this application. Figure 4 As shown, in this example, the redundant ECU30 can be applied to the first module. In the first module after application, the redundant ECU30 and the original ECU10 are connected to the motor M1 and solenoid valves P2-P6. The connection method can be referred to in Embodiment 3 below, which will not be described in detail here. Furthermore, since the solenoid valve P1 in the first module is used for quality inspection and is not significantly related to the braking function control process, the redundant ECU30 does not need to be connected to solenoid valve P1 to reduce the complexity of the shared connection.

[0181] exist Figure 4 In the illustrated braking system, since the redundant ECU30 and the original ECU10 are simultaneously connected to solenoid valves P2, P3, and P4, when ECU10 fails, if the driver presses the pedal, although ECU10 can no longer reproduce the driver's pedal feel, the redundant ECU30 can still obtain the pedal pressing information detected by the pedal travel sensor E2, and control solenoid valve P2 to open and solenoid valves P3 and P4 to close according to the pedal pressing information, so that the oil in the master cylinder module 140 can flow smoothly into the pedal simulator as the driver presses the pedal, maintaining the driver's pedal braking feel unchanged and ensuring the consistency of driver comfort and pedal feel.

[0182] exist Figure 4In the illustrated braking system, since the redundant ECU30 and the original ECU10 are simultaneously connected to solenoid valves P5 and P6, when ECU10 fails, if it is necessary to actively increase the pressure on the braked wheel, although ECU10 can no longer transmit oil to the second module by controlling motor M1 and solenoid valves P5 to P6, the redundant ECU30 can still control motor M1 to rotate in the first direction, and calibrate the rotation direction and speed of motor M1 according to the motor position information collected by motor position sensor E1, and control solenoid valves P5 and P6 to be turned on. Thus, the rotation of motor M1 in the first direction can push the piston rod in the moving piston cylinder to the right side of the figure, thereby pushing the oil in the moving piston cylinder (which flows into the moving piston cylinder through the brake pipe formed by oil reservoir 130 and one-way valve K1) into solenoid valves P5 and P6, and then into the two brake oil pipes between the first module and the second module through the conducting solenoid valves P5 and P6. Afterwards, the control of motor M2 and solenoid valves P7 to P18 in the second module by ECU20 causes the oil in the two brake oil pipes to be applied to the braked wheel, so as to realize the active pressurization of the braked wheel.

[0183] In addition, due to Figure 4 The movable piston cylinder in the illustrated braking system is a one-way movable piston cylinder. Therefore, after the redundant ECU 30 determines that the piston rod in the movable piston cylinder has been pushed to the far right of the diagram based on the motor position information collected by the motor position sensor E1, it needs to control the motor M1 to rotate in the second direction and control both solenoid valves P5 and P6 to disconnect. In this way, the rotation of motor M1 in the second direction can drive the piston rod to move to the left of the diagram, allowing the oil in the oil reservoir 130 to flow into the movable piston cylinder through the brake oil circuit containing the one-way valve K1. Furthermore, during the movement, since no new oil is added to the braked wheel, the pressurization process of the braked wheel is interrupted until it reaches the far left, at which point the movable piston cylinder is refilled with oil. The redundant ECU 30 then controls motor M1 and solenoid valves P5-P6 through the above process to continue pressurizing the braked wheel.

[0184] Assuming ECU10 is the default ECU in the first module, then Figure 4 The braking system shown can achieve any of the following operating modes:

[0185] In operating mode one, when both ECU10 and ECU20 are functioning correctly, they work together to achieve the vehicle's braking function. Specifically, ECU10 can control motor M1 and solenoid valves P2-P6 in the first module to maintain the driver's pedal feel or actively increase pressure on the braked wheels. ECU20 can control motor M2 and solenoid valves P7-P18 in the second module to achieve independent control of wheel cylinder pressure. In this operating mode, the braking system can have full functionality including BBF, ABS, TCS, ESC, and VAF. Furthermore, ECU10 can also control solenoid valve P1 to perform quality checks on the braking system.

[0186] In operating mode two, when ECU10 fails but ECU30 and ECU20 are not, ECU30 and ECU20 work together to achieve the vehicle's braking function. Specifically, ECU30 can control motor M1 and solenoid valves P2-P6 in the first module to maintain the driver's pedal feel or to actively increase the pressure on the braked wheel. ECU20 can control motor M2 and solenoid valves P7-P18 in the second module to achieve independent control of wheel cylinder pressure. In this operating mode, the braking system still has full functions such as BBF, ABS, TCS, ESC, and VAF. However, since ECU30 is not connected to solenoid valve P1, the braking system cannot be inspected.

[0187] In operating mode three, when ECU10 and ECU20 fail but ECU30 does not, ECU30 independently performs the vehicle's braking function. Since ECU30 can control motor M1 and solenoid valves P2-P6 in the first module, it enables active boosting. In this mode, the braking system still provides BBF and partial AEB (Autonomous Emergency Braking) and other VAF (Variable Emergency Braking) functions. BBF and partial AEB provide at least 0.6g of deceleration, which is suitable for most emergency braking scenarios. Therefore, although the original ECU10 and ECU20 in the braking system fail, preventing the system from providing maximum deceleration, the redundant ECU30 still ensures the vehicle's emergency braking needs in various scenarios.

[0188] It should be understood that when both ECU30 and ECU20 fail and ECU10 does not fail, ECU10 can independently perform the vehicle's braking function. The specific implementation method of this scheme is the same as the above-mentioned working mode three, and will not be repeated here.

[0189] In another possible application, Figure 5 This illustration shows a schematic diagram of a braking system with a redundant braking scheme provided in another embodiment of this application. In this example, the redundant ECU 30 refers to the above-described... Figure 4 Deploy in the manner shown, thereby also achieving... Figure 4 Both systems offer the same redundant braking function. The difference between the two braking systems lies in:

[0190] Figure 4 The movable piston cylinder in the middle is a one-way movable piston cylinder, while Figure 5 The movable piston cylinder in the reference is a bidirectional movable piston cylinder. Figure 5 As shown, the first module also includes solenoid valve P19. The bidirectional moving piston cylinder is connected to solenoid valve P19 at position g via a brake line, and then to solenoid valves P5 and P6 via brake lines. In addition to being connected to check valve K1 and oil reservoir 130 at position d via a brake line, the bidirectional moving piston cylinder is also connected to oil reservoir 130 at position e via a brake line, and to solenoid valves P5 and P6 at position f via a brake line. Figure 5 In the illustrated braking system, the original ECU10 and the redundant ECU30 in the first module are also connected to solenoid valve P19. Thus, when it is determined that the braked wheel needs to be actively pressurized, the redundant ECU30 controls the motor M1 to rotate in the first direction and controls solenoid valves P19, P5, and P6 to be turned on. The rotation of motor M1 in the first direction drives the piston rod to move to the right in the diagram. This movement causes the oil in the right cylinder of the bidirectional moving piston cylinder to be pushed into solenoid valve P19 through position g, and then enters solenoid valves P5 and P6 through the turned-on solenoid valve 19. After that, it flows into the two brake oil pipes between the first and second modules through the turned-on solenoid valves P5 and P6. On the other hand, it causes the oil in the oil reservoir 130 to flow into the left cylinder of the bidirectional moving piston cylinder through the brake oil circuit at position e. Furthermore, the redundant ECU30, based on the motor position information collected by the motor position sensor E1, determines that the piston rod in the bidirectional moving piston cylinder has been pushed to the far right of the diagram. It then controls the motor M1 to rotate in the second direction and disconnects solenoid valves P19, P5, and P6. Thus, the rotation of motor M1 in the second direction causes the piston rod to move to the left of the diagram. This movement causes the oil in the reservoir 130 to flow into the right cylinder of the bidirectional moving piston cylinder via the brake oil pipe where the one-way valve K1 is located. Simultaneously, it causes the oil in the left cylinder of the bidirectional moving piston cylinder to flow out at position f, and then into solenoid valves P5 and P6 via the brake oil pipe. Afterward, it flows into the two brake oil pipes between the first and second modules through the open solenoid valves P5 and P6. It is evident that although the bidirectional moving piston cylinder scheme requires an additional solenoid valve P19 compared to the unidirectional moving piston cylinder scheme, in the bidirectional moving piston cylinder scheme, regardless of whether the piston rod moves to the left or right, oil can be continuously added to the braked wheel, which helps to achieve bidirectional continuous pressure build-up of the braked wheel and effectively improves the pressure build-up speed of the braked wheel.

[0191] In another possible application, Figure 6 This illustration shows a schematic diagram of the specific structure of a braking system after applying a redundant braking scheme, as provided in an embodiment of this application. Figure 6 As shown, in this example, the redundant ECU30 can be applied to the second module. In the second module after application, the redundant ECU30 and the original ECU20 are connected to solenoid valves P9-P12 and solenoid valves P15-P18. The connection method can be referred to in Example 3 below, which will not be described in detail here. Furthermore, solenoid valves P7 and P14 in the second module are normally open solenoid valves, while solenoid valves P8 and P13 are normally closed solenoid valves. That is, even when solenoid valves P7, P8, P13, and P14 are not energized, the oil transmitted from the first module can still be successfully transferred to solenoid valves P9, P10, P15, and P16. Therefore, the control of solenoid valves P7, P8, P13, and P14 is not very relevant to the braking function. Therefore, the redundant ECU30 can be excluded from connecting to solenoid valves P7, P8, P13, and P14 to reduce the complexity of joint connection.

[0192] exist Figure 6 In the illustrated braking system, assuming that ECU10 in the first module is functioning correctly, hydraulic fluid can flow from the first module into solenoid valves P8 and P13 in the second module. Since the redundant ECU30 and the original ECU20 are simultaneously connected to solenoid valves P9, P10, P15, and P16, even if ECU20 fails, to achieve independent control of the wheel cylinder pressure, although ECU20 can no longer control it, the redundant ECU30 can still control the opening of solenoid valves P9, P10, P15, and P16. This allows the solenoid valve connected to the braked wheel requiring high pressure to have a larger opening, thus maximizing the amount of hydraulic fluid flowing into that solenoid valve and achieving high-pressure braking of the braked wheel. Conversely, it allows the solenoid valve connected to the braked wheel requiring low pressure to have a smaller opening, minimizing the amount of hydraulic fluid flowing into that solenoid valve and achieving low-pressure braking of the braked wheel.

[0193] exist Figure 6In the illustrated braking system, assuming that ECU10 in the first module fails, preventing hydraulic fluid from flowing from the first module into solenoid valves P8 and P13 in the second module, since the redundant ECU30 and the original ECU20 are simultaneously connected to solenoid valves P11, P12, P17, and P18, when ECU20 fails, if independent control of wheel cylinder pressure is to be achieved, although ECU20 can no longer perform control, the redundant ECU30 can still control the opening and closing of solenoid valves P11, P12, P17, and P18. This allows the solenoid valve connected to the braked wheel that requires pressure braking to be opened, thereby allowing hydraulic fluid in reservoir 130 to enter the braked wheel through the opened solenoid valve, achieving pressure braking of the braked wheel, and disconnecting the solenoid valve connected to the braked wheel that does not require pressure braking, thus preventing hydraulic fluid in reservoir 130 from entering the braked wheel through the disconnected solenoid valve. It should be understood that the redundant ECU30 can also control the opening of solenoid valves P11, P12, P17 and P18 in order to control the pressure applied to the braked wheels FL, RR, RL and FR. For details on the implementation, please refer to the above content, which will not be repeated here.

[0194] For example, the redundant ECU30 and the original ECU20 can also be connected to the motor M2 in the second module at the same time. In this way, if the oil reservoir 130 and the ECU10 in the first module both fail when the ECU20 fails, the oil cannot enter the second module through the oil reservoir 130 or the second module through the first module. At this time, the redundant ECU30 can still control the rotation of the motor M2 to drive the one-way pump S1 and one-way pump S2 to work. Then, the one-way pump S1 and one-way pump S2 will draw the oil stored in the energy storage device of the second module into the solenoid valves P9, P10, P15 and P16 through the brake oil pipe and the one-way valve K2. By controlling the opening of the solenoid valves P9, P10, P15 and P16 through the redundant ECU30, independent pressure control of each braked wheel can be achieved.

[0195] In another possible application, Figure 7 This illustration shows a schematic diagram of a braking system with a redundant braking scheme provided in another embodiment of this application. In this example, the redundant ECU 30 refers to the above-described... Figure 6 Deploy in the manner shown, thereby also achieving... Figure 6 Both systems offer the same redundant braking function. The difference between the two braking systems lies in: Figure 6 The movable piston cylinder in the middle is a one-way movable piston cylinder, while Figure 7 The movable piston cylinder in the design is a bidirectional movable piston cylinder, therefore... Figure 6 The application scheme described above can save a solenoid valve and simplify the structural complexity of the moving piston cylinder, helping to reduce the cost of redundant design. Figure 7The application scheme described above enables continuous bidirectional pressure build-up on the braked wheel, which helps to increase the speed of pressure build-up. For the difference between bidirectional and unidirectional moving piston cylinders, please refer directly to the above. Figure 4 and Figure 5 These will not be repeated here.

[0196] It should be noted that the above description only provides examples of several possible applications of redundant ECUs. The embodiments of this application can also employ other methods to apply redundant ECUs. For instance, when using redundant ECU 30 in the second module, redundant ECU 30 and the original ECU 20 can be simultaneously connected to motor M2 and all solenoid valves P7-P18 in the second module to further achieve redundancy for all braking functions originally achievable by the second module. Many other possible applications exist, and they will not be listed here.

[0197] Furthermore, the redundant braking scheme in this application embodiment is also compatible with any existing braking system, including but not limited to braking systems without redundant braking function, braking systems with dual redundant braking function, and braking systems with triple or more redundant braking function. It can be exemplarily applied to IPB+RBU configuration or iBooster+ESC, etc. For relevant implementation details, please refer to the above embodiment 1. This application will not describe it in detail.

[0198] This application also provides an integrated device that can integrate at least two ECUs onto one or more printed circuit boards (PCBs) and achieve a high degree of integration. This integrated device can be applied to terminal devices, which can be smart devices, including but not limited to: smart home devices such as televisions, robot vacuum cleaners, smart lamps, audio systems, smart lighting systems, electrical control systems, home background music systems, home theater systems, intercom systems, video surveillance, etc.; smart transportation equipment such as automobiles, ships, drones, trains, freight cars, trucks, etc.; and smart manufacturing equipment such as robots, industrial equipment, smart logistics, smart factories, etc. Alternatively, the terminal device can also be a computer device, such as a desktop computer, personal computer, server, etc. It should also be understood that the terminal device can also be a portable electronic device, such as a mobile phone, tablet computer, PDA, headphones, speakers, wearable devices (such as smartwatches), in-vehicle devices, virtual reality devices, augmented reality devices, etc. Examples of portable electronic devices include, but are not limited to, devices equipped with... Or other portable electronic devices with different operating systems. These portable electronic devices can also include, for example, laptops with touch-sensitive surfaces (such as touch panels).

[0199] The possible structure of this integrated device will be described in detail below through Embodiment 2.

[0200]

Example 2

[0201] Figure 8 An exemplary schematic diagram of an integrated device provided in an embodiment of this application is shown, such as... Figure 8 As shown in the example, the integrated device includes ECU1 (i.e., the first ECU), ECU2 (i.e., the second ECU), PCB1 (i.e., the first PCB), PCB (i.e., the second PCB), and inter-board connectors. First-type devices with power exceeding a power threshold in ECU1 and ECU2 are located on PCB1, while second-type devices with power not exceeding the power threshold in ECU1 and ECU2 are located on PCB2. Furthermore, a first-type device in any ECU on PCB1 is connected to a second-type device in an ECU on PCB2 via an inter-board connector; that is, a first-type device in ECU1 on PCB1 is connected to a second-type device in ECU1 on PCB2 via an inter-board connector, and vice versa. Thus, by integrating high-power devices on one PCB and low-power devices on another, not only can high-power and low-power devices be classified and managed, but the distributed deployment of all components in the two ECUs also reduces the number of components carried by each PCB, thereby reducing the area and weight of each PCB.

[0202] For ease of understanding, the first type of device will be referred to as a high-power device and the second type of device as a low-power device. That is, the term "high-power device" can be directly replaced with "first type device" and the term "low-power device" can be directly replaced with "second type device".

[0203] For example, low-power devices typically have smaller size and lighter weight than high-power devices. Therefore, the area of ​​PCB2, where low-power devices are deployed, can be set to be smaller than the area of ​​PCB1, where high-power devices are deployed, and the load-bearing capacity of PCB2 is also lower than that of PCB1. Thus, by further reducing the area of ​​PCB2, the utilization rate of PCB2's area can be improved while still using PCB2 to support low-power devices, thereby further enhancing the integration of the integrated device.

[0204] For example, continue to refer to Figure 8As shown, the integrated device may also include a support frame, through which PCB1 and PCB2 are fixedly connected to ensure that their relative positions remain unchanged. There are many ways to fix PCB1 and PCB2 together using a support frame; for example, in one example... Figure 8 As shown, the support frame is located on the top layer, PCB2 is on the bottom layer, and PCB1 is located between the support frame and PCB2. PCB1 has an opening through which the support frame passes and securely connects PCB1 and PCB2. Using this deployment scheme, no other boards need to be placed on the lower side of PCB2, which carries low-power devices, thus aiding in heat dissipation. Of course, in other examples, if heat dissipation is not a concern, the support frame can also be located on the last layer, or on the layer between PCB1 and PCB2. Alternatively, the support frame can be fixed to PCB1 and PCB2 using adhesive or other methods, eliminating the need for an opening in PCB1 and further increasing the effective usable area of ​​PCB1.

[0205] For example, when the support frame is fixedly connected to PCB1 and PCB2 through an opening, the opening can be in Figure 8 The positions a1, b1, and c1 are shown to improve the stability of the fixed connection between PCB1 and PCB2 by balancing the opening positions.

[0206] For example, continue to refer to Figure 8 As shown, the integrated device may also include a housing, a support frame, PCB1, and PCB2, which are placed inside the housing, with at least one end of the support frame fixed to the housing. In this example, since the low-power device generates relatively little heat, placing the PCB2, which integrates the low-power device, close to the housing helps to increase the heat dissipation area of ​​the PCB2 through the housing, further improving the heat dissipation effect of the PCB2.

[0207] For example, continue to refer to Figure 8 As shown, high-power devices can be placed on the surface of PCB1 opposite to the support frame, and low-power devices can be placed on the surface of PCB2 opposite to PCB1. Thus, by deploying high-power and low-power devices on the same plane of PCB1 and PCB2, it is easier to configure the routing between the high-power and low-power devices, reducing the complexity of integration.

[0208] For example, continue to refer to Figure 8 As shown, the integrated device may also include a valve body, also known as a hybrid combining unit (HCU), used to house the controlled components. The controlled components can be, for example... Figure 8The components shown include one or more of a motor, solenoid valve, and sensor, and may also include other peripheral devices, without specific limitations. In this case, the high-power device in each ECU may include the driver of the controlled component, and the low-power device in each ECU may include a microcontroller. The microcontrollers in ECU1 and ECU2 can also be connected through traces on PCB2 to enable communication between ECU1 and ECU2, thereby achieving joint redundant control of the same controlled component by ECU1 and ECU2.

[0209] For example, continue to refer to Figure 8 As shown, when the controlled components include a motor, a solenoid valve, and a sensor, the first type of device in each ECU may include a motor driver and a solenoid valve driver, and the second type of device in each ECU may include an interface between a microcontroller and a sensor. In this case, the microcontroller in each ECU on PCB2 can be connected to the sensor interface in that ECU on PCB2 via traces on PCB2, and can be connected to the motor driver and solenoid valve driver in that ECU on PCB1 via an inter-board connector. Furthermore, the microcontroller in ECU1 on PCB2 can also be connected to the microcontroller in ECU2 on PCB2 via traces on PCB2. The sensor may include, for example,... Figure 8 The illustrated components include a motor position sensor, a pressure sensor, and a pedal travel sensor; other sensors may also be included, and the specific components are not limited. In this example, the motor and solenoid valve in the valve body can be pin-connected or connected via interface points to the motor driver and solenoid valve driver of each ECU on PCB1. The sensors in the valve body can also be pin-connected to the inter-board connector and then connected via the inter-board connector traces to the sensor interface of each ECU on PCB2. Furthermore, a support frame can be positioned below the interface points or pin-connections of the motor, solenoid valve, and sensors as shown in the illustration, to simultaneously support the controlled components while supporting PCB1 and PCB2, thus maintaining the stability of the connection between the controlled components and the devices on the PCB via the pin points or pin-connections.

[0210] As a further example, when implementing joint redundant control of ECU1 and ECU2, the sensor data is synchronously transmitted via inter-board connectors to the sensor interfaces in ECU1 and ECU2 on PCB2. Assuming ECU1 is currently used for control, the data received by the sensor interface in ECU1 on PCB2 is further transmitted via traces on PCB2 to the microcontroller in ECU1, allowing the microcontroller in ECU1 to determine the next control method. If the next control method is to drive the motor, the microcontroller in ECU1 on PCB2 can then send the corresponding control message to the motor driver in ECU1 on PCB1 via the inter-board connector. The motor driver then transmits the message to the corresponding pin of the motor via plug-in or point-connected traces to drive the motor. Similarly, if the next control method is to drive the solenoid valve, the microcontroller in ECU1 on PCB2 can then send the corresponding control message to the solenoid valve driver in ECU1 on PCB1 via the inter-board connector. The solenoid valve driver then transmits the message to the corresponding pin of the solenoid valve via plug-in or point-connected traces to drive the solenoid valve to turn on or off. Furthermore, since ECU2 is not currently being used for control, even if the sensor data reaches the sensor interface of ECU2, ECU2 will not receive the data and will not use the sensor data to perform control operations.

[0211] For example, considering that the microcontrollers in ECU1 and ECU2 also need to communicate with devices outside the integrated device, a first connector and a second connector can be provided on PCB2. The microcontroller in ECU1 connects to other communication units outside the integrated device through the first connector, while the microcontroller in ECU2 connects to other communication units outside the integrated device through the second connector. The external appearance of the first and second connectors can be an interface, which is not limited to USB or Type-C.

[0212] Adopting such Figure 8 The integrated device shown not only achieves classified management of high-power and low-power devices by integrating high-power devices on one PCB and low-power devices on another PCB, but also reduces the number of components on each PCB by distributing all components from the two ECUs, thereby reducing the area and weight of each PCB. Furthermore, by placing the PCB2 containing the low-power devices close to the housing, the heat dissipation area of ​​PCB2 is increased through the housing, further improving its heat dissipation performance.

[0213] Figure 9An exemplary schematic diagram of another integrated device provided in an embodiment of this application is shown, such as... Figure 9 As shown in the example, the integrated device includes ECU1 (i.e., the first ECU), ECU2 (i.e., the second ECU), PCB1 (i.e., the first PCB), PCB2 (i.e., the second PCB), and a support frame. PCB1 and PCB2 are fixedly connected by the support frame. The components in ECU1 are mounted on PCB1, and the components in ECU2 are mounted on PCB2. Thus, by integrating the components of the two ECUs onto different PCBs, not only can the number of components carried by each PCB be reduced, thereby helping to reduce the area and load of each PCB, but the physical decoupling of the two ECUs can also be achieved, facilitating the development and design of the integrated device.

[0214] For example, continue to refer to Figure 9 As shown, the integrated device may further include a housing, a support frame, PCB1, and PCB2, all housed within the housing, with at least one end of the support frame fixed to the housing. Thus, the housing serves to fix the support frame, thereby improving the stability of the fixed connection between PCB1 and PCB2 by relying on the housing's robust characteristics.

[0215] For example, continue to refer to Figure 9 As shown, the support frame is located at the top layer, PCB2 at the bottom layer, and PCB1 is located between the support frame and PCB2. PCB1 has an opening, through which the support frame passes to securely connect PCB1 and PCB2. The opening can be, for example, in... Figure 9 Positions a2, b2, and c3 are shown to improve the accuracy of the fixed connection through balanced openings. Using the deployment scheme in this example, the lower side of PCB2 can be close to the housing, thus increasing the heat dissipation area of ​​PCB2 through the housing and further improving its heat dissipation effect.

[0216] It should be understood that the above-described deployment of the support frame, PCB1, and PCB2 within the housing is merely an example. Other deployment methods are also possible. For instance, in another example, the support frame is located on the top layer, PCB1 on the bottom layer, and PCB2 is positioned between the support frame and PCB1. In this way, the lower side of PCB2 can be close to the housing, thereby increasing the heat dissipation area of ​​PCB1 and improving its heat dissipation effect. Yet another example shows PCB1 on the top layer, PCB2 on the bottom layer, and the support frame positioned between PCB1 and PCB2. In this case, the upper side of PCB1 and the lower side of PCB2 can be close to the housing, further increasing the heat dissipation area of ​​PCB1 and PCB2 and improving their heat dissipation effect. Many other possible deployment methods exist, and they will not be listed here.

[0217] For example, continue to refer to Figure 9 As shown, the integrated device may also include an inter-board connector, and the devices in each ECU may include a microcontroller. The microcontroller in ECU1 is connected to the microcontroller in ECU2 via the inter-board connector to enable communication between the two ECUs on the two PCBs.

[0218] For example, continue to refer to Figure 9 As shown, the components on ECU1 can be positioned on the surface of PCB1 relative to the support frame, and the components on ECU2 can be positioned on the surface of PCB2 relative to PCB1. Thus, by deploying the components in ECU1 and ECU2 on the same plane of PCB1 and PCB2, it is also convenient to configure the routing between the components of ECU1 and ECU2 in the inter-board connector, such as the routing between the microcontrollers in ECU1 and ECU2, reducing the complexity of integration.

[0219] For example, continue to refer to Figure 9 As shown, the integrated device may also include a valve body, also known as an HCU, for housing the controlled component. The controlled component may be, for example... Figure 9 The components shown include one or more of a motor, solenoid valve, and sensor, and may also include other peripheral devices, without specific limitations. In this case, the devices in each ECU may include a driver for the controlled component and a microcontroller. The microcontroller in ECU1 can be connected to the driver of the controlled component in ECU1 via traces on PCB1, and the microcontroller in ECU2 can be connected to the driver of the controlled component in ECU2 via traces on PCB2. Furthermore, the microcontrollers in ECU1 and ECU2 can also be connected via inter-board connectors to achieve joint redundant control of the same controlled component by ECU1 and ECU2.

[0220] For example, continue to refer to Figure 9 As shown, when the controlled components include a motor, a solenoid valve, and a sensor, the devices in each ECU may include a motor driver, a solenoid valve driver, a microcontroller, and a sensor interface. In this case, the microcontroller in ECU1 on PCB1 can be connected to the motor driver, solenoid valve driver, and sensor interface in ECU1 on PCB1 via traces on PCB1. Similarly, the microcontroller in ECU2 on PCB2 can be connected to the motor driver, solenoid valve driver, and sensor interface in ECU2 on PCB2 via traces on PCB2. Furthermore, the microcontroller in ECU1 on PCB1 is also connected to the microcontroller in ECU2 on PCB2 via an inter-board connector. The sensor may include, for example,... Figure 9The illustrated components include a motor position sensor, a pressure sensor, and a pedal travel sensor; other sensors may also be included, and the specific components are not limited. In this example, the motor, solenoid valve, and sensors in the valve body can be connected via pins or interfaces to the motor driver, solenoid valve driver, and sensor interfaces of ECU1 on PCB1, and via pins or interfaces to the inter-board connectors, and then connected to the motor driver, solenoid valve driver, and sensor interfaces of ECU2 on PCB2 through traces in the inter-board connectors. Furthermore, a support frame can be positioned below the illustrated interfaces of the motor, solenoid valve, and sensor to simultaneously support the controlled components while supporting PCB1 and PCB2, thus maintaining the stability of the connection between the controlled components and the devices on the PCBs via the pins or interfaces.

[0221] Further exemplarily, when implementing joint redundant control of ECU1 and ECU2, the sensor data can be transmitted to the sensor interface in ECU1 on PCB1 via sensor pins, and also to the sensor interface in ECU2 on PCB2 via board-to-board connectors. Assuming ECU2 is the ECU currently used for control, ECU2 receives the data from the sensor interface and transmits it to the microcontroller in ECU2 on PCB2 via traces on PCB2. The microcontroller uses this data to determine the next control method. When the next control method is to drive the motor to rotate, the microcontroller in ECU2 on PCB2 sends the corresponding control message to the motor driver in ECU2 on PCB2 via traces on PCB2. The motor driver then transmits the message to the corresponding pin of the motor to drive it to rotate. Similarly, when the next control method is to drive the solenoid valve, the microcontroller in ECU2 on PCB2 sends the corresponding control message to the solenoid valve driver in ECU2 on PCB2 via traces on PCB2. The solenoid valve driver then transmits the message to the corresponding pin of the solenoid valve to turn it on or off. Furthermore, since ECU1 is not currently used for control, even if the sensor's data can reach the sensor interface in ECU1 on PCB1, ECU1 will not receive the data and will not use the sensor information to perform control operations.

[0222] For example, considering that the microcontrollers in ECU1 and ECU2 also need to communicate with devices outside the integrated device, a first connector can also be provided on PCB1. The microcontroller in ECU1 connects to other communication units outside the integrated device through the first connector to realize communication interaction between ECU1 and other communication units. Correspondingly, a second connector can also be provided on PCB2. The microcontroller in ECU2 connects to other communication units outside the integrated device through the second connector to realize communication interaction between ECU2 and other communication units. The external appearance of the first and second connectors can be interfaces, which are not limited to USB or Type-C, etc.

[0223] Adopting such Figure 9 The integrated device shown not only reduces the number of components on each PCB by integrating the components of the two ECUs onto different PCBs, thus reducing the area and weight of each PCB, but also decouples the two ECUs physically, facilitating the development and design of the integrated device. Furthermore, the layered deployment of the two PCBs improves heat dissipation for the PCB closer to the housing.

[0224] Figure 10 An exemplary schematic diagram of another integrated device provided in an embodiment of this application is shown, such as... Figure 10 As shown in the example, the integrated device includes ECU1 (i.e., the first ECU), ECU2 (i.e., the second ECU), and a PCB. Components in ECU1 and ECU2 are integrated onto the PCB. Thus, by integrating the components of both ECUs onto the same PCB, the height of the integrated device can be effectively reduced compared to integrating them onto two separate PCBs. Furthermore, this method allows all related component interfaces to be placed on a single PCB board, enabling a single press-fit connection between the components and the interfaces on the PCB, thereby simplifying the integration process.

[0225] For example, continue to refer to Figure 10 As shown, the integrated device may further include a support frame and a housing, with the support frame and PCB placed inside the housing, and at least one end of the support frame fixed to the housing. Thus, the housing serves to fix the support frame, thereby improving the stability of the fixed PCB by relying on the sturdiness of the housing.

[0226] For example, continue to refer to Figure 10 As shown, the support frame is located on the top layer, and the PCB is located on the bottom layer, closely attached to the lower shell of the housing. This allows the lower side of the PCB to rest against the housing, thus increasing the PCB's heat dissipation area and further improving its heat dissipation performance.

[0227] It should be understood that the above-described deployment of the support frame and PCB within the housing is merely an example, and other deployment methods can also be used. For instance, in another example, the support frame is located on the lowest layer, and the PCB is located on the top layer. In this way, the upper side of the PCB can be close to the housing, thus increasing the heat dissipation area of ​​the PCB and improving its heat dissipation effect.

[0228] For example, the devices in each ECU may include a microcontroller, and the microcontroller in ECU1 is connected to the microcontroller in ECU2 via traces on the PCB to enable communication between the two ECUs on the PCB.

[0229] For example, continue to refer to Figure 10 As shown, the devices in ECU1 and ECU2 can be placed on the surface of the PCB relative to the support frame. In this way, the devices in ECU1 and ECU2 can also be connected through traces set on the same surface of the PCB, simplifying the routing method on the PCB and reducing the complexity of integration.

[0230] For example, continue to refer to Figure 10 As shown, the integrated device may also include a valve body, also known as an HCU, for housing the controlled component. The controlled component may be, for example... Figure 10 The components shown include one or more of a motor, solenoid valve, and sensor, and may also include other peripheral devices, without specific limitations. In this case, the devices in each ECU may include a driver for the controlled component and a microcontroller. The microcontroller in ECU1 can be connected to the driver of the controlled component in ECU1 via traces on the PCB, and the microcontroller in ECU2 can be connected to the driver of the controlled component in ECU2 via traces on the PCB. Furthermore, the microcontrollers in ECU1 and ECU2 can also be connected via traces on the PCB to achieve joint redundant control of the same controlled component by ECU1 and ECU2.

[0231] For example, continue to refer to Figure 10As shown, when the controlled components include a motor, a solenoid valve, and a sensor, the devices in each ECU may include a motor driver, a solenoid valve driver, a microcontroller, and a sensor interface. In this case, the microcontroller in ECU1 on the PCB can be connected to the motor driver, solenoid valve driver, and sensor interface in ECU1 on the PCB via traces on the PCB. Similarly, the microcontroller in ECU2 on the PCB can be connected to the motor driver, solenoid valve driver, and sensor interface in ECU2 on the PCB via traces on the PCB. Furthermore, the microcontroller in ECU1 on the PCB is also connected to the microcontroller in ECU2 on the PCB via traces on the PCB. The sensor may include, for example,... Figure 10 The illustrated components include a motor position sensor, a pressure sensor, and a pedal travel sensor; other sensors may also be included, and the specific components are not limited. In this example, the motor, solenoid valve, and sensors in the valve body can also be connected via pins or interfaces to the motor driver, solenoid valve driver, and sensor interfaces in ECU1 on the PCB, and to the motor driver, solenoid valve driver, and sensor interfaces in ECU2 on the PCB. Furthermore, a support frame can be positioned below the illustrated interface or plug-in interface of the motor, solenoid valve, and sensor to simultaneously support the controlled components while supporting the PCB, thus maintaining the stability of the connection between the controlled components and the devices on the PCB via the pins or plug-in interfaces.

[0232] As a further example, when implementing joint redundant control of ECU1 and ECU2, the sensor data can be transmitted via two pins to the sensor interfaces in ECU1 and ECU2 on the PCB, respectively. Assuming ECU1 is the ECU currently used for control, it receives the data from its sensor interface and transmits it to the microcontroller in ECU1 on the PCB. The microcontroller uses this data to determine the next control method. When the next control method is to drive the motor to rotate, the microcontroller in ECU1 on the PCB can send the corresponding control message to the motor driver in ECU1 on the PCB via traces on the PCB. The motor driver then transmits the message to the corresponding pin of the motor to drive it to rotate. Similarly, when the next control method is to drive the solenoid valve, the microcontroller in ECU1 on the PCB can send the corresponding control message to the solenoid valve driver in ECU1 on the PCB via traces on the PCB. The solenoid valve driver then transmits the message to the corresponding pin of the solenoid valve to turn it on or off. Furthermore, since ECU2 is not currently used for control, even if the sensor's data can reach the sensor interface in ECU2 on the PCB, ECU2 will not receive the data and will not use the sensor information to perform control operations.

[0233] For example, considering that the microcontrollers in ECU1 and ECU2 also need to communicate with devices outside the integrated device, a first connector and a second connector can also be provided on the PCB. The microcontroller in ECU1 connects to other communication units outside the integrated device through the first connector, and the microcontroller in ECU2 connects to other communication units outside the integrated device through the second connector, so as to realize communication interaction with other communication units. The external appearance of the first connector and the second connector can be an interface, which is not limited to USB or Type-C, etc.

[0234] Adopting such Figure 10 The illustrated integrated device integrates components from both ECUs onto a single PCB, reducing the overall height of the device compared to integrating components onto two PCBs. Furthermore, since all relevant component interfaces are located on a single PCB, the interfaces in the valve body and on the PCB can be connected in a single press-fit process, simplifying the integration process. Moreover, because all components from both ECUs are integrated onto a single PCB, and this PCB is directly adjacent to the housing, heat generated by the components on the PCB can be directly transferred away through the housing, resulting in better heat dissipation.

[0235] It should be understood that the above Figures 8 to 10 ECU1 and EUC2 in the text are merely used to represent a collection of electronic components related to control functions, and do not represent that each ECU is an independent physical device. Furthermore, the components in the aforementioned integrated device can all be located in one physical device, or each can constitute a separate physical device, or some components can be combined to form a single physical device; this application embodiment does not specifically limit this. In addition, each PCB may include other devices besides those described above; this application embodiment also does not specifically limit this.

[0236] It should be noted that the above Figures 8 to 10 The illustrated integrated device is only an example of directly plugging or tapping the pins or ports of the controlled component into the corresponding ECU on the PCB. In actual operation, if the pins of the controlled component are not long enough, or if the pin types of the controlled component and the corresponding ECU on the PCB do not match, an adapter pin can be additionally set in the integrated device. One end of the adapter pin connects to the corresponding ECU on the PCB, and the other end connects to the pins or ports of the controlled component, so as to achieve smooth communication between the controlled component and the corresponding ECU.

[0237] also, Figures 8 to 10 These are just three possible integration schemes provided as examples. In other examples, other integration schemes can be used to integrate two ECUs. For example, three PCBs can be set up, with the high-power devices on ECU1 integrated on the first PCB, the high-power devices on ECU2 integrated on the second PCB, and the low-power devices on ECU1 and ECU2 integrated together on the third PCB. Although this integration scheme will increase the thickness of the integrated device, it can further reduce the area and load-bearing capacity of the PCB for integrating high-power devices, and further improve the heat dissipation capacity of the PCB for integrating high-power devices.

[0238] Furthermore, the above-described Embodiment 2 can also be applied to Embodiment 1. In Embodiment 2, ECU1 and ECU2 can correspond to any two of the first ECU, second ECU, and redundant ECU in Embodiment 1. In one possible example, ECU1 and ECU2 in Embodiment 2 can correspond to either the first ECU or the second ECU in Embodiment 1, and ECU2 in Embodiment 2 can correspond to the redundant ECU in Embodiment 1. That is, the integration scheme in Embodiment 2 can be applied to the first ECU and redundant ECU in Embodiment 1, or it can be applied to the second ECU and redundant ECU in Embodiment 1. This further improves the integration of the braking system when redundancy is added, thereby further reducing the size of the braking system. In addition, when the integration scheme is applied to Embodiment 1, the valve body in the braking system is also called the anti-lock brake system (ABS) actuator, which internally houses the brake actuator for implementing the braking function and braking-related sensors, including but not limited to motors, solenoid valves, motor position sensors, pressure sensors, and pedal travel sensors. Integration schemes for other brake actuators can be directly implemented with reference to the above content, and will not be elaborated here.

[0239] This application also provides an access control device that can connect at least two ECUs to the same brake actuator and enable flexible redundant control of the brake actuator. This access control device can be applied to terminal devices with braking functions, such as intelligent transportation equipment, including automobiles, ships, drones, trains, freight cars, and trucks.

[0240] The possible structure and control logic of the access control device will be described in detail below through Embodiment 3.

[0241]

Example 3

[0242] Figure 11 An exemplary schematic diagram of an access control device provided in an embodiment of this application is shown, such as... Figure 11As shown in the example, the control unit may include ECU1 (i.e., the first ECU), ECU2 (i.e., the second ECU), and a brake actuator. ECU1 and ECU2 are respectively connected to the brake actuator and can drive the brake actuator individually or in combination. That is, the brake actuator can be driven by ECU1 alone, by ECU2 alone, or by a combination of ECU1 and ECU2. Thus, by connecting two ECUs to the same brake actuator, redundant control of the same brake actuator can be achieved without the need for additional brake actuators in the redundancy, thereby helping to save on the number of components and cost while achieving redundant control.

[0243] As a further example, one of ECUs, ECU1 and ECU2, is the default ECU. Assuming ECU1 is the default ECU, when ECU1 is not faulty, the access control device will use ECU1 to drive the brake actuator by default. When ECU1 is faulty, the access control device will switch to ECU2 to drive the brake actuator. In this way, redundant control of the same brake actuator by two ECUs can be flexibly and orderly realized.

[0244] As a further example, the brake actuator can be any device capable of performing braking functions, such as, but not limited to, a motor or a solenoid valve. The specific access control schemes are described below from the perspectives of motors and solenoid valves, respectively.

[0245] The brake actuator is an electric motor.

[0246] Figure 12 This illustrative diagram illustrates a structure where two ECUs are connected to the same motor, as provided in an embodiment of this application. The motor includes a shaft, a rotor, and a stator. The rotor includes rotor windings and a rotor core wound around the rotor windings. The stator includes stator windings and a stator core wound around the stator windings. The stator windings are typically three-phase stator windings. (Refer to...) Figure 12 As shown:

[0247] In one possible access method, refer to Figure 12As shown in (A), the stator winding in the motor is a three-phase stator winding. The motor also includes three pins u, v, and w corresponding to the three-phase stator winding. Both ECU1 and ECU2 contain three-phase AC ports, and these three-phase AC ports are connected to the three pins u, v, and w. When the motor is driven to rotate, the active ECU in ECU1 and ECU2 can input three-phase AC power to the three pins u, v, and w through its own three-phase AC port, while the inactive ECU does not input three-phase AC power to the three pins u, v, and w. Specifically, when ECU1 is the default active ECU, when ECU1 is not faulty, ECU1 provides three-phase AC power to the three-phase stator winding; when ECU1 is faulty, ECU2 provides three-phase AC power to the three-phase stator winding. Furthermore, since any two adjacent stator windings in the three-phase stator windings of the motor are 120 degrees out of phase, this phase difference causes the three-phase stator windings to generate a rotating magnetic field under the action of the three-phase AC power input to ECU1 or ECU2. This rotating magnetic field then cuts the rotor windings, inducing a current in the rotor windings. This induced current then forms an electromagnetic torque on the motor shaft, driving the motor to rotate, and the direction of motor rotation is the same as the direction of the rotating magnetic field. This connection method can reuse the three-phase windings in the motor without adding any additional windings, thus it is directly compatible with existing motors and also helps to save costs.

[0248] according to Figure 12 As shown in (A), there are multiple ways to redundantly control the motor through ECU1 and ECU2. The following explanation uses ECU1 providing three-phase AC power as an example. It should be noted that the following redundant control methods can be executed individually or in combination:

[0249] Redundancy control method 1:

[0250] During the process of supplying three-phase AC power to the three-phase stator windings, ECU1 can also detect the current on the connection lines between ECU1 and each phase winding of the three-phase stator windings (for example, each connection line is equipped with a detection resistor, and ECU1 monitors the current flowing through the detection resistor on each connection line). When the current on the connection line between ECU1 and a certain phase winding of the three-phase stator windings is less than a threshold, it indicates that there is a problem with the electrical signal transmission of that phase winding by ECU1 (this may be due to a problem with the port of the connection line, a short circuit in the connection line, or other issues). In this case, ECU1 can send a supplementary instruction to ECU2, and after receiving the supplementary instruction, ECU2 can provide a supplementary electrical signal to that phase winding through the connection line between ECU2 and that phase winding. As can be seen, this example can supplement the electrical signal to a winding by another ECU when the process of one ECU providing an electrical signal to a certain winding fails, while the electrical signals on the other two windings can still be provided by the original ECU. In other words, it is not necessary to switch the entire process of providing electrical signals to the other ECU. In this way, the accurate supply of three-phase current can be guaranteed while improving the switching stability through a small number of switching operations.

[0251] Redundancy control method two:

[0252] While supplying three-phase AC power to the three-phase stator windings, ECU1 can also monitor the urgency of the current braking demand. If the braking demand suddenly becomes very urgent, it indicates that the motor needs to be driven urgently. In this case, ECU1 can continue to supply three-phase AC power to the three-phase stator windings while simultaneously sending an activation instruction to ECU2. Upon receiving the activation instruction, ECU2 can also supply three-phase AC power to the three-phase stator windings. In this way, by having both ECUs supply three-phase AC power to the motor together, the strong current from the two portions of three-phase AC power can accelerate the motor's driving speed and force.

[0253] Redundancy control method three:

[0254] During the process of supplying three-phase AC power to the three-phase stator windings, ECU1 can also monitor the changes in the magnitude of the supplied three-phase AC power. When it detects that the supplied three-phase AC power is significantly less than the generated three-phase AC power, it means that the generated three-phase AC power from ECU1 has experienced considerable losses during transmission. In this case, ECU1 can continue to supply three-phase AC power to the stator windings while simultaneously sending an activation instruction to ECU2. Upon receiving the activation instruction, ECU2 can also supply three-phase AC power to the stator windings. Thus, by having both ECUs supply three-phase AC power to the motor together when the three-phase AC power supplied by one ECU is insufficient, the motor's drive requirements can be met with two separate sets of three-phase AC power.

[0255] Redundancy control method four:

[0256] During the process of supplying three-phase AC power to the three-phase stator windings, ECU1 can also detect the current in the connection lines between ECU1 and each phase of the three-phase stator windings. If the current in the connection line between ECU1 and any phase of the three-phase stator windings is less than a threshold, it indicates a problem with the ECU1's drive process. In this case, ECU1 can stop supplying three-phase AC power to the three-phase stator windings and send an activation instruction to ECU2. Upon receiving the activation instruction, ECU2 can then supply three-phase AC power to the three-phase stator windings through the connection lines between ECU2 and the three-phase stator windings. Thus, by promptly switching to another ECU when a problem occurs in the drive process of one ECU, the use of a faulty ECU can be avoided, maintaining the accuracy of the motor drive.

[0257] It should be understood that the above content is merely an illustrative introduction to four possible redundancy control methods. In the embodiments of this application, any of the above methods can be modified to obtain other redundancy control methods. For example, in another possible redundancy control method, when ECU1 detects that the current braking demand suddenly becomes very urgent, or when it detects that the three-phase AC power supplied by ECU1 is much smaller than the three-phase AC power generated, ECU1 can also stop supplying three-phase AC power to the three-phase stator windings and send an activation instruction to ECU2 so as to switch to ECU2 driving the motor in a timely manner. There are many other possible redundancy drive methods, which will not be listed here.

[0258] For example, theoretically, although ECU1 and ECU2 will provide electrical signals to the three-phase stator windings individually or jointly according to the above-described redundant control method, due to software or hardware malfunctions, an ECU that should not be providing electrical signals in the actual circuit may also provide electrical signals to one or more stator windings. In this case, this additional electrical signal will obviously affect the accuracy of motor control. Based on this, in an optional embodiment, a switching circuit can be provided on the lines connecting the three pins u, v, and w of ECU1 and the lines connecting the three pins u, v, and w of ECU2. The switching circuit may include, for example, a single-pole single-throw switch, a single-pole multi-throw switch, or a multi-pole multi-throw switch. The switching circuit can be used to: connect ECU1 to its three pins u, v, and w when ECU1 is supplying three-phase AC power to the three-phase stator windings, and disconnect ECU2 from its three pins u, v, and w; and connect ECU2 to its three pins u, v, and w when ECU2 is supplying three-phase AC power to the three-phase stator windings, and disconnect ECU1 from its three pins u, v, and w. In this way, even if an ECU that should not normally supply three-phase AC power outputs three-phase AC power to the motor, the switching circuit can disconnect that ECU's drive link to the motor, ensuring that the motor operates only under the drive of another ECU, effectively improving the accuracy of redundant control.

[0259] As further exemplarily, when driving the motor according to the above-described redundant drive method, ECU1 can also send a supplementary instruction to ECU2 and a first switching instruction to the switching circuit when it determines that the current on the connection line with a certain phase winding of the three-phase stator winding is less than a threshold. After receiving the first switching instruction, the switching circuit can connect the connection line between ECU2 and that phase winding so that the supplementary electrical signal provided by ECU2 can be smoothly transmitted to that phase winding of the motor.

[0260] As further exemplarily, when driving the motor according to the above-mentioned redundant drive mode two, ECU1 can also send an activation instruction to ECU2 and a third switching instruction to the switching circuit when the current braking demand suddenly becomes very urgent, or when driving the motor according to the above-mentioned redundant drive mode three, and when it finds that the supplied three-phase AC power is much smaller than the generated three-phase AC power. After receiving the third switching instruction, the switching circuit can connect the connection line between ECU2 and the three-phase stator winding so that the three-phase AC power supplied by ECU2 can be smoothly transmitted to the three-phase stator winding of the motor.

[0261] As further exemplarily, when driving the four motors according to the above redundant drive method, ECU1 can also send an activation instruction to ECU2 and a second switching instruction to the switching circuit when it detects that the current on the connection line with any phase winding of the three-phase stator winding is less than a threshold. After receiving the second switching instruction, the switching circuit can disconnect the connection line between ECU1 and the three-phase stator winding and connect the connection line between ECU2 and the three-phase stator winding, so that the three-phase AC power provided by ECU2 can be smoothly transmitted to the three-phase stator winding of the motor, while cutting off the three-phase AC power still supplied to the three-phase stator winding due to the failure of ECU1, thus ensuring the accuracy of motor drive.

[0262] In another possible access method, refer to Figure 12 As shown in (B), the stator windings in the motor may include two sets of three-phase stator windings. The motor also includes three pins u1, v1 and w1 corresponding to the first set of three-phase stator windings, and three pins u2, v2 and w2 corresponding to the second set of three-phase stator windings. Both ECU1 and ECU2 include three-phase AC ports. The three-phase AC port of ECU1 is connected to the three pins u1, v1 and w1 corresponding to the first set of three-phase stator windings, and the three-phase AC port of ECU2 is connected to the three pins u2, v2 and w2 corresponding to the second set of three-phase stator windings. When the drive motor rotates, ECU1 and the active ECU within it can input three-phase AC power to the three connected pins via their respective three-phase AC ports. Specifically, when ECU1 is functioning correctly, it can input three-phase AC power to pins u1, v1, and w1 via its three-phase AC port. This three-phase AC power drives the first set of three-phase stator windings to generate a rotating magnetic field, thereby driving the rotation of the motor shaft. If ECU1 malfunctions, ECU2 can input three-phase AC power to pins u2, v2, and w2 via its three-phase AC port. This three-phase AC power drives the second set of three-phase stator windings to generate a rotating magnetic field, thereby driving the rotation of the motor shaft. This connection method, by adding an extra set of three-phase windings to the motor, allows each ECU to accurately drive the motor through its corresponding three-phase winding electrical signals, preventing interference between the electrical signals of one ECU and those of another.

[0263] It should be noted that when the motor contains two sets of three-phase stator windings, both sets can be wound around the entire area of ​​the stator core, but in different directions. Thus, regardless of which set of three-phase stator windings is energized, a rotating magnetic field will be generated over the entire area of ​​the stator core. Alternatively, the two sets of three-phase stator windings can be wound around different areas of the stator core. For example, the first and second sets of three-phase stator windings can be wound around two separate halves of the core, and the size relationship between the two halves is not limited; for example, they can be halved or one side can be larger than the other. Or, some windings of the two sets of three-phase stator windings can be wound around the same area of ​​the stator core, while other windings can be wound around different areas of the stator core. There are many possible implementations, which will not be listed here.

[0264] according to Figure 12 The connection method shown in (B) is illustrated using ECU1 providing three-phase AC power as an example. During the process of ECU1 providing three-phase AC power to the first set of three-phase stator windings, ECU1 can also detect the current on the connection lines between ECU1 and each phase winding in the first set of three-phase stator windings. When the current on the connection line between ECU1 and a certain phase winding in the first set of three-phase stator windings is less than a threshold, it indicates a problem with the electrical signal transmission from ECU1 to the first set of three-phase windings. In this case, ECU1 can send an activation instruction to ECU2. After receiving the activation instruction, ECU2 can provide three-phase AC power to the second set of three-phase stator windings through the connection line between ECU2 and the second set of three-phase stator windings. Therefore, this example demonstrates that when a fault occurs in the process of one ECU providing electrical signals to a certain set of three-phase stator windings, preventing the motor from driving, the motor can be driven by three-phase AC power provided by another ECU to another set of three-phase stator windings, thus achieving motor redundancy control while improving the timeliness of switching.

[0265] For example, switching circuits can be provided on the lines connecting ECU1 to the three pins u1, v1, and w1, and on the lines connecting ECU2 to the three pins u2, v2, and w2. These switching circuits can include, for example, single-pole single-throw (SPS), single-pole multi-throw (SPS), or multi-pole multi-throw (MPMS) switches. The switching circuits can be used to: connect ECU1 to the three pins u1, v1, and w1 and disconnect ECU2 from the three pins u2, v2, and w2 when ECU1 provides three-phase AC power to the second set of three-phase stator windings; and connect ECU2 to the three pins u2, v2, and w2 and disconnect ECU1 from the three pins u1, v1, and w1 when ECU2 provides three-phase AC power to the second set of three-phase stator windings. In this way, even if an ECU that should not normally provide three-phase AC power outputs three-phase AC power to the motor, the switching circuit can disconnect the drive link of that ECU to the motor, ensuring that the motor only operates under the drive of another ECU, effectively improving the accuracy of redundant control.

[0266] As further exemplarily, when ECU1 detects that the current on the connection line to any phase winding of the first set of three-phase stator windings is less than a threshold, it can send an activation instruction to ECU2 and a switching instruction to the switching circuit. After receiving the switching instruction, the switching circuit can disconnect the connection lines between ECU1 and the three pins u1, v1 and w1, and connect the connection lines between ECU2 and the three pins u2, v2 and w2, so that the three-phase AC power provided by ECU2 can be smoothly transmitted to the second set of three-phase stator windings of the motor, while cutting off the three-phase AC power still supplied to the first set of three-phase stator windings due to the ECU1 fault, thus ensuring the accuracy of motor drive.

[0267] It should be noted that the above are merely illustrative examples of two possible solutions for connecting two ECUs to the same motor. In actual operation, two ECUs can also connect to the same motor in other ways. For example, in two sets of three-phase stator windings, one or more windings in one set of three-phase stator windings may be identical to one or more windings in the second set of three-phase stator windings. Furthermore, these identical windings may correspond to the same one or more pins. These pins can be connected to one or more ports in both ECUs simultaneously, while the other ports of the two ECUs are connected to the pins corresponding to individual windings in their respective three-phase stator windings. This allows for individual control of the same motor by two ECUs while saving on the number of pins and windings, facilitating redundant connection while saving costs. For a detailed explanation of this implementation, please refer to the section on solenoid valves below; it will not be discussed in detail here.

[0268] The brake actuator is a solenoid valve.

[0269] Figure 13 An exemplary schematic diagram of a structure provided in this application, in which two ECUs are connected to the same solenoid valve, is shown, wherein:

[0270] In one possible access method, refer to Figure 13 As shown in Figure (A), the solenoid valve includes a double coil and an iron core wound around the double coil. The double coil consists of two coils, and the solenoid valve also includes a positive pin (the pin corresponding to the symbol "+" in the figure) and a negative pin (the pin corresponding to the symbol "-" in the figure) corresponding to the double coil. The positive pin is connected to one of the coils of the double coil, and the negative pin is connected to the other coil. ECU1 and ECU2 both have positive and negative ports. The positive ports of ECU1 and ECU2 are connected to the positive pins of the double coil, and the negative ports of ECU1 and ECU2 are connected to the negative pins of the double coil. When driving the solenoid valve, the active ECU in ECU1 and ECU2 can input DC power to the positive and negative pins of the double coil through its own positive and negative ports, while the inactive ECU does not input DC power to the positive and negative pins of the double coil. Specifically, when ECU1 is functioning correctly, it can input DC power to the positive and negative pins of the connected dual coils. When ECU1 malfunctions, ECU2 can input DC power to the positive and negative pins of the connected dual coils. In this way, the dual coils generate a magnetic field under the influence of the DC power output from the ECUs. This magnetic field causes the iron core wound around the dual coils to move. If the solenoid valve is normally open (a normally open valve is one that is open by default when not energized and closed when energized), it will open under the DC power input from the active ECU. If the solenoid valve is normally closed (a normally closed valve is one that is closed by default when not energized and open when energized), it will open under the DC power input from the active ECU. This connection method reuses the dual coils in the solenoid valve to achieve redundant drive of the same solenoid valve by two ECUs without the need for additional coils. Therefore, it is not only directly compatible with existing solenoid valves but also helps save costs.

[0271] according to Figure 13 As shown in (A), there are multiple ways to redundantly control the solenoid valves through ECU1 and ECU2. The following explanation uses ECU1 providing DC power as an example. It should be noted that the following redundant control methods can be executed individually or in combination:

[0272] Redundancy control method 1:

[0273] During the process of supplying DC power to the dual coils, ECU1 can also detect the current on the connection lines between ECU1 and each coil in the dual coils. When the current on the connection line between ECU1 and one of the coils is less than a threshold, it indicates a problem with the electrical signal transmission from ECU1 to that coil. In this case, ECU1 can send a supplementary instruction to ECU2. Upon receiving the supplementary instruction, ECU2 can provide a supplementary electrical signal to that coil through its connection line. Thus, this example demonstrates that when a fault occurs in the process of one ECU supplying an electrical signal to a coil, another ECU can supplement the signal to that coil, while the electrical signal to the other coil can still be provided by the original ECU. In other words, it is not necessary to switch the entire process of supplying electrical signals to the other ECU. This allows for a small number of switching operations, improving switching stability while enabling two ECUs to jointly supply accurate DC power to the solenoid valve.

[0274] Redundancy control method two:

[0275] While supplying DC power to the dual coils, ECU1 can also monitor the urgency of the current braking demand. If the braking demand suddenly becomes very urgent, it indicates that the solenoid valve needs to be activated immediately. In this case, ECU1 can continue to supply DC power to the dual coils while simultaneously sending an activation instruction to ECU2. Upon receiving the activation instruction, ECU2 can also supply DC power to the dual coils. In this way, by having both ECUs supply DC power to the solenoid valve together, the strong current from the two DC sources can accelerate the solenoid valve's actuation speed.

[0276] Redundancy control method three:

[0277] During the process of supplying DC power to the dual coils, ECU1 can also monitor the changes in the magnitude of the supplied DC power. When it detects that the supplied DC power is significantly less than the emitted DC power, it means that the DC power emitted by ECU1 has experienced considerable losses during intermediate transmission. In this case, ECU1 can continue to supply DC power to the dual coils while simultaneously sending an activation instruction to ECU2. Upon receiving the activation instruction, ECU2 can also supply DC power to the dual coils. In this way, by having both ECUs supply DC power to the solenoid valve together when the DC power supplied by one ECU is insufficient, the actuation requirements of the solenoid valve can be met with two separate DC power supplies.

[0278] Redundancy control method four:

[0279] During the process of supplying DC power to the dual coils, ECU1 can also detect the current in the connection lines between ECU1 and each coil in the dual coils. If the current in the connection line between ECU1 and any of the coils is less than a threshold, it indicates a problem with the driving process of ECU1. In this case, ECU1 can stop supplying DC power to the dual coils and send an activation instruction to ECU2. Upon receiving the activation instruction, ECU2 can then supply DC power to the dual coils through the connection line between ECU2 and the dual coils. In this way, by promptly switching to another ECU when a problem occurs in the driving process of one ECU, the use of a faulty ECU can be avoided, maintaining the accuracy of the solenoid valve driving.

[0280] It should be understood that the above content is merely an illustrative description of four possible redundancy control methods. In the embodiments of this application, any of the above methods can be modified to obtain other redundancy control methods. For example, in another possible redundancy control method, when ECU1 detects that the current braking demand suddenly becomes very urgent, or when it detects that the DC power supplied by ECU1 is much smaller than the DC power it generates, ECU1 can also stop supplying DC power to the dual coils and send an activation instruction to ECU2 so as to switch to ECU2 driving the solenoid valve in a timely manner. There are many other possible redundancy driving methods, which will not be listed here.

[0281] For example, switching circuits can be provided on the lines connecting the positive and negative pins of ECU1 and ECU2. These switching circuits can include, for example, a single-pole single-throw switch, a single-pole multi-throw switch, or a multi-pole multi-throw switch. The switching circuits can be used to: connect ECU1 to the positive and negative pins and disconnect ECU2 from the positive and negative pins when ECU1 is supplying DC power to the dual coils; and connect ECU2 to the positive and negative pins and disconnect ECU1 from the positive and negative pins when ECU2 is supplying DC power to the dual coils. Thus, even if an ECU that should not normally supply DC power outputs DC power to the solenoid valve, the switching circuit can cut off the drive link of that ECU to the solenoid valve, ensuring that the solenoid valve only operates under the drive of another ECU, effectively improving the accuracy of redundant control.

[0282] As further exemplarily, when driving the solenoid valve according to the above-described redundant driving method, ECU1 can also send a supplementary instruction to ECU2 and a first switching instruction to the switching circuit when it determines that the current on the connection line with one of the two coils is less than a threshold. After receiving the first switching instruction, the switching circuit can connect the connection line between ECU2 and the coil so that the supplementary electrical signal provided by ECU2 can be smoothly transmitted to the coil of the solenoid valve.

[0283] As further exemplarily, when driving the solenoid valve according to the above-mentioned redundant driving mode two, ECU1 can also send an activation instruction to ECU2 and a third switching instruction to the switching circuit when the current braking demand suddenly becomes very urgent, or when driving the solenoid valve according to the above-mentioned redundant driving mode three, and when it finds that the supplied DC power is much smaller than the emitted DC power. After receiving the third switching instruction, the switching circuit can connect the connection line between ECU2 and the dual coil so that the DC power supplied by ECU2 can be smoothly transmitted to the dual coil of the solenoid valve.

[0284] As further exemplarily, when driving the solenoid valve in the above-described redundant driving mode, ECU1 can also send an activation instruction to ECU2 and a second switching instruction to the switching circuit when it detects that the current on the connection line with either of the two coils is less than a threshold. After receiving the second switching instruction, the switching circuit can disconnect the connection line between ECU1 and the two coils and connect the connection line between ECU2 and the two coils, so that the DC power provided by ECU2 can be smoothly transmitted to the two coils of the solenoid valve, while cutting off the DC power still supplied to the two coils due to the failure of ECU1, thus ensuring the accuracy of the solenoid valve driving.

[0285] In another possible access method, refer to Figure 13As shown in (B), the solenoid valve may include two sets of double coils and an iron core wound around the two sets of double coils. The first set of double coils includes a first positive coil and a first negative coil, and the second set of double coils includes a second positive coil and a second negative coil. The solenoid valve may also include a first positive pin (the "+" pin at the top of the diagram), a second positive pin (the "+" pin at the bottom of the diagram), and a negative pin. The first positive pin is connected to the first positive coil in the first set of double coils, the second positive pin is connected to the second positive coil in the second set of double coils, and the negative pin is connected to both the first negative coil in the first set of double coils and the second negative coil in the second set of double coils. ECU1 and ECU2 both include positive and negative ports. The negative ports of ECU1 and ECU2 are respectively connected to the negative pins of the solenoid valve. The positive port of ECU1 is connected to the first positive pin of the solenoid valve, and the positive port of ECU2 is connected to the second positive pin of the solenoid valve. When controlling the solenoid valve, the active ECU in ECU1 and ECU2 can input DC current to the corresponding positive and negative pins of the solenoid valve through its own positive and negative ports. The inactive ECU, however, does not input DC current to the other positive and negative pins of the solenoid valve. Specifically, when ECU1 is functioning correctly, it can input DC current to its first positive and negative pins. This causes the first set of dual coils to generate a magnetic field under the DC current output from ECU1. This magnetic field moves the iron core wound around the dual coils, causing either the normally open solenoid valve to open or the normally closed solenoid valve to close. Alternatively, if ECU2 is faulty, it can input DC current to its second positive and negative pins. This causes the second set of dual coils to generate a magnetic field under the DC current output from ECU2. This magnetic field moves the iron core wound around the dual coils, causing either the normally open solenoid valve to open or the normally closed solenoid valve to close. In this access method, by reusing the negative coil in the solenoid valve and setting a separate positive coil for each ECU, the complexity of the solenoid valve setup can be reduced, costs can be saved, and interference from the electrical signal of one ECU to the drive of another ECU can be minimized.

[0286] It should be noted that in the above connection method, since the negative pin of the solenoid valve is connected to the first negative coil and the second negative coil in the two sets of dual coils at the same time, the first negative coil and the second negative coil can also be set as the same coil, collectively referred to as the negative coil. In this way, two ECUs can be connected to the same solenoid valve, and the number of coils can be saved, which helps to achieve redundant control while saving costs.

[0287] according to Figure 13As shown in (B), there are several ways to redundantly control the solenoid valves through ECU1 and ECU2. The following explanation uses ECU1 providing DC power as an example. It should be noted that the following redundant control methods can be executed individually or in combination:

[0288] Redundancy control method 1:

[0289] During the process of supplying DC power to the first set of dual coils, ECU1 can also detect the current in the connection line between ECU1 and the negative coil. When the current in the connection line between ECU1 and the negative coil is less than a threshold, it indicates a problem with the electrical signal transmission from ECU1 to the negative coil. In this case, ECU1 can send a supplementary instruction to ECU2. After receiving the supplementary instruction, ECU2 can provide a supplementary electrical signal to the negative coil through the connection line between ECU2 and the negative coil. Thus, this example demonstrates that when a fault occurs in the process of one ECU supplying an electrical signal to the negative coil, another ECU can supplement the negative coil with an electrical signal, while the electrical signal on the first positive coil can still be provided by the original ECU. In other words, there is no need to switch the electrical signal supply process of the other coil to another ECU. Therefore, with minimal switching operations, accurate DC power supply is guaranteed while improving switching stability.

[0290] Redundancy control method two:

[0291] While ECU1 is supplying DC power to the first set of dual coils, it can also detect the current in the connection lines between ECU1 and the first positive and negative coils. If the current in the connection line to either coil is less than a threshold, it indicates a problem with the driving process of ECU1. In this case, ECU1 can stop supplying DC power to the first set of dual coils and send an activation instruction to ECU2. Upon receiving the activation instruction, ECU2 can then supply DC power to the second set of dual coils through the connection line between ECU2 and the second set of dual coils. Thus, by promptly switching to another ECU when a problem occurs in the driving process of one ECU, the use of a faulty ECU can be avoided, maintaining the accuracy of the solenoid valve's actuation.

[0292] For example, switching circuits can be provided on the lines connecting ECU1 to the first positive and negative coils and on the lines connecting ECU2 to the second positive and negative coils. These switching circuits can include, for example, a single-pole single-throw switch, a single-pole multi-throw switch, or a multi-pole multi-throw switch. The switching circuits can be used to: connect ECU1 to the first positive and negative coils and disconnect ECU2 from the second positive and negative coils when ECU1 supplies DC power to the first set of dual coils; and connect ECU2 to the second positive and negative coils and disconnect ECU1 from the first positive and negative coils when ECU2 supplies DC power to the second set of dual coils. Thus, even if an ECU that should not normally supply DC power outputs DC power to the solenoid valve, the switching circuit can cut off the drive link of that ECU to the solenoid valve, ensuring that the solenoid valve only operates under the drive of another ECU, effectively improving the accuracy of redundant control.

[0293] As further exemplarily, when driving the solenoid valve according to the above-described redundant driving method, ECU1 can also send a supplementary instruction to ECU2 and a first switching instruction to the switching circuit when it determines that the current on the connection line with the negative coil is less than a threshold. After receiving the first switching instruction, the switching circuit can connect the connection line between ECU2 and the positive coil so that the supplementary electrical signal provided by ECU2 can be smoothly transmitted to the negative coil of the solenoid valve.

[0294] As further exemplarily, when driving the solenoid valve according to the above-described redundant driving method two, ECU1 can also send an activation instruction to ECU2 and a second switching instruction to the switching circuit when it detects that the current on the connection line with any one of the coils in the first set of dual coils is less than a threshold. After receiving the second switching instruction, the switching circuit can disconnect the connection line between ECU1 and the first set of dual coils and connect the connection line between ECU2 and the second set of dual coils, so that the DC power provided by ECU2 can be smoothly transmitted to the second set of dual coils of the solenoid valve, while cutting off the DC power still supplied to the first set of dual coils due to the failure of ECU1, thus ensuring the accuracy of the solenoid valve driving.

[0295] It should be noted that the above can also be applied to... Figure 13 The structure shown in (B) can be modified to obtain other connection schemes. For example, in another connection scheme, the solenoid valve can also include a first negative coil, a second negative coil, and a positive coil. ECU1 is connected to the positive coil and the first negative coil, and ECU2 is connected to the positive coil and the second negative coil, so as to achieve redundant control while reducing the number of coils through a common positive coil. The specific redundancy implementation process can be directly referred to the redundancy implementation method of the common negative coil described above, and will not be repeated here.

[0296] In another possible access method, refer to Figure 13 As shown in (C), the solenoid valve includes two sets of double coils and an iron core wound around the two sets of double coils. The first set of double coils includes a first positive coil and a first negative coil, and the second set of double coils includes a second positive coil and a second negative coil. The solenoid valve may also include two positive pins and two negative pins. One positive pin and one negative pin are connected to the first positive coil and the first negative coil, and the other positive pin and the other negative pin are connected to the second positive coil and the second negative coil. ECU1 and ECU2 both include positive and negative ports. The positive and negative ports of ECU1 are connected to the corresponding positive and negative pins of the first set of double coils, and the positive and negative ports of ECU2 are connected to the corresponding positive and negative pins of the second set of double coils. When controlling the solenoid valve, the active ECU in ECU1 and ECU2 can input DC power to the corresponding positive and negative pins of the solenoid valve through its own positive and negative ports, while the inactive ECU does not input DC power to the other positive and negative pins of the solenoid valve. Specifically, when ECU1 is functioning correctly, ECU1 inputs DC current to the first positive and first negative coils. This causes the first set of dual coils to generate a magnetic field under the DC current output from ECU1, driving the iron core wound around the first set of dual coils to move. This, in turn, causes the normally open solenoid valve to open when energized, or the normally closed solenoid valve to open when energized. Alternatively, when ECU1 is faulty, ECU2 inputs DC current to the second positive and second negative coils. This causes the second set of dual coils to generate a magnetic field under the DC current output from ECU2, driving the iron core wound around the second set of dual coils to move. This, in turn, causes the normally open solenoid valve to open when energized, or the normally closed solenoid valve to open when energized. Using this connection method, by adding an extra set of dual coils to the solenoid valve, each ECU can accurately drive the solenoid valve through the electrical signals of its corresponding dual coils, avoiding interference between the electrical signals of one ECU and the electrical signals of another ECU.

[0297] It should be noted that when the solenoid valve contains two sets of double coils, both sets of double coils can be wound around the entire area of ​​the iron core, but in different directions. Thus, regardless of which set of double coils is energized, a magnetic field will be generated across the entire area of ​​the iron core. Alternatively, the two sets of double coils can be wound around different areas of the iron core. For example, the first and second sets of double coils can be wound around two separate halves of the iron core, and the size relationship between the two halves is not limited; for example, they can be halved or one side can be larger than the other. Or, some coils of the two sets of double coils can be wound around the same area of ​​the iron core, while other coils can be wound around different areas. There are many possible implementations, which will not be listed here.

[0298] according to Figure 13 The connection method shown in (C) is illustrated using ECU1 providing DC power as an example. While ECU1 is providing DC power to the first set of dual coils, it can also detect the current in the connection lines between ECU1 and each coil in the first set of dual coils. When the current in the connection line between ECU1 and any coil in the first set of dual coils is less than a threshold, it indicates a problem with the electrical signal transmission from ECU1 to the first set of dual coils. In this case, ECU1 can send an activation instruction to ECU2. Upon receiving the activation instruction, ECU2 can provide DC power to the second set of dual coils through the connection line between ECU2 and the second set of dual coils. Therefore, this example demonstrates that when a fault occurs in the process of one ECU providing electrical signals to a set of dual coils, preventing the solenoid valve from being driven, the solenoid valve can be driven by DC power supplied by another ECU to another set of dual coils. This achieves redundant control of the solenoid valve while improving the timeliness of switching.

[0299] For example, switching circuits can be provided on the lines connecting ECU1 to the first positive and first negative coils, and on the lines connecting ECU2 to the second positive and second negative coils. These switching circuits can include, for example, a single-pole single-throw switch, a single-pole multi-throw switch, or a multi-pole multi-throw switch. The switching circuits can be used to: connect ECU1 to the first positive and first negative coils and disconnect ECU2 from the second positive and second negative coils when ECU1 provides DC power to the first set of dual coils; and connect ECU2 to the second positive and second negative coils and disconnect ECU1 from the first positive and first negative coils when ECU2 provides DC power to the second set of dual coils. Thus, even if an ECU that should not normally provide DC power outputs DC power to the solenoid valve, the switching circuit can cut off the drive link of that ECU to the solenoid valve, ensuring that the solenoid valve only operates under the drive of another ECU, effectively improving the accuracy of redundant control.

[0300] As a further example, when ECU1 detects that the current on the connection line to any one of the coils in the first set of dual coils is less than a threshold, it can send an activation instruction to ECU2 and a switching instruction to the switching circuit. After receiving the switching instruction, the switching circuit can disconnect the connection line between ECU1 and the first positive coil and the first negative coil, and connect the connection line between ECU2 and the second positive coil and the second negative coil, so that the DC power provided by ECU2 can be smoothly transmitted to the second set of dual coils of the solenoid valve, while cutting off the DC power still supplied to the first set of dual coils due to the ECU1 malfunction, thus ensuring the accuracy of the solenoid valve drive.

[0301] In the above embodiment three, by connecting two ECUs to the same brake actuator, not only can redundant control of the same brake actuator be achieved, but there is also no need to set up other brake actuators in the redundancy. Therefore, it helps to save the number of devices and costs while achieving redundant control. According to the solution provided in the embodiments of this application, this application also provides a control method for redundant control of the same brake actuator by two ECUs. The specific implementation process can be referred to ECU1 and ECU2 in the above embodiment three.

[0302] According to the solution provided in the embodiments of this application, this application also provides a computer program product, which includes: computer program code, which, when the computer program code is run on a computer, causes the computer to execute the above-described control method.

[0303] According to the solution provided in the embodiments of this application, this application also provides a computer-readable storage medium storing program code, which, when run on a computer, causes the computer to execute the above-described control method.

[0304] According to the solutions provided in the embodiments of this application, this application also provides a terminal device, including a braking system as shown in Embodiment 1 above, or an integrated device as shown in Embodiment 2 above, or an access control device as shown in Embodiment 3 above.

[0305] For example, the terminal device may be a smart home device (including but not limited to televisions, robot vacuum cleaners, smart lamps, audio systems, smart lighting systems, electrical control systems, home background music systems, home theater systems, intercom systems, video surveillance, etc.), a smart transportation device (including but not limited to automobiles, ships, drones, trains, freight cars, trucks, etc.), a smart manufacturing device (including but not limited to robots, industrial equipment, smart logistics, smart factories, etc.), a computer device (including but not limited to desktop computers, personal computers, servers, etc.), a portable electronic device (including but not limited to mobile phones, tablets, PDAs, headphones, speakers, wearable devices (such as smartwatches), in-vehicle devices, virtual reality devices, augmented reality devices, etc.).

[0306] The terms “component,” “module,” “system,” etc., used in this specification are used to refer to computer-related entities, hardware, firmware, combinations of hardware and software, software, or software in execution. For example, a component can be, but is not limited to, a process running on a processor, a processor, an object, an executable file, an execution thread, a program, and / or a computer. As illustrated, applications running on computing devices and computing devices can both be components. One or more components may reside in a process and / or an execution thread, and components may be located on a single computer and / or distributed among two or more computers. Furthermore, these components can be executed from various computer-readable media on which various data structures are stored. Components can communicate, for example, via local and / or remote processes based on signals having one or more data packets (e.g., data from two components interacting with another component between a local system, a distributed system, and / or a network, such as the Internet interacting with other systems via signals).

[0307] Those skilled in the art will recognize that the various illustrative logical blocks and steps described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this application.

[0308] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0309] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0310] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0311] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0312] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0313] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A braking system, characterized in that, include: Oil reservoir, master cylinder module, brake pedal, push rod, first pressure control unit, second pressure control unit, first ECU, second ECU and redundant ECU; The brake pedal is connected to the master cylinder module via the push rod. The oil reservoir, the master cylinder module, the first pressure control unit, and the second pressure control unit are sequentially connected via oil circuits. The second pressure control unit is also connected to the braked wheel via an oil circuit. The first ECU is used to control the brake actuator in the first pressure control unit; The second ECU is used to control the brake actuator in the second pressure control unit; The redundant ECU is used to control at least one brake actuator in the first pressure control unit, and / or to control at least one brake actuator in the second pressure control unit; The first pressure control unit and the second pressure control unit are used to perform braking operations on the braked wheel individually or jointly under the control of at least one of the first ECU, the second ECU and the redundant ECU. Wherein, when the brake actuator includes a motor and the motor includes a three-phase winding, one of the first ECU and the second ECU, as well as the redundant ECU, are respectively connected to the three-phase winding via lines. The braking system also includes a switching circuit, which is disposed on the connection line between the one ECU and the three-phase winding, and the connection line between the redundant ECU and the three-phase winding. The ECU is configured to, during the process of supplying three-phase AC power to the three-phase winding, when it detects that the current on the connection line between the ECU and any phase winding of the three-phase winding is less than a threshold, send a supplementary instruction to the redundant ECU and a first switching instruction to the switching circuit; and when it detects that the current braking demand has increased to a set level, or when it detects that the three-phase AC power supplied to the three-phase winding is less than a set value compared to the generated three-phase AC power, send an activation instruction to the redundant ECU and a third switching instruction to the switching circuit. The switching circuit is configured to: disconnect the connection line between the one ECU and any phase winding according to the first switching instruction, and connect the connection line between the redundant ECU and any phase winding; and connect the connection line between the redundant ECU and the three-phase winding according to the third switching instruction. The redundant ECU is used to provide a supplementary electrical signal to any phase winding through the connection line between the redundant ECU and any phase winding according to the supplementary instruction, or to provide supplementary three-phase AC power to the three-phase winding through the connection line between the redundant ECU and the three-phase winding according to the activation instruction.

2. The braking system as described in claim 1, characterized in that, In the case where the redundant ECU controls at least one brake actuator in the first pressure control unit: When the first ECU is not faulty, the first ECU is used to control the brake actuator in the first pressure control unit. When the first ECU fails, the redundant ECU is used to control at least one brake actuator in the first pressure control unit.

3. The braking system as described in claim 2, characterized in that, The first pressure control unit is used to perform basic braking operation or automatic emergency braking operation on the braked wheel under the control of the first ECU or the redundant ECU. The second pressure control unit is used to perform anti-lock braking operation, traction control operation or electronic stability control operation on the braked wheel under the control of the second ECU; The first pressure control unit and the second pressure control unit are used to perform basic braking operation, automatic emergency braking operation, anti-lock braking operation, traction control operation, electronic stability control operation, adaptive cruise control operation, or additional braking operation on the braked wheel under the control of the first ECU and the second ECU, or the redundant ECU and the second ECU.

4. The braking system as claimed in claim 1, characterized in that, In the case where the redundant ECU controls at least one brake actuator in the second pressure control unit: When the second ECU is not faulty, the second ECU is used to control the brake actuator in the second pressure control unit. When the second ECU fails, the redundant ECU is used to control at least one brake actuator in the second pressure control unit.

5. The braking system as described in claim 4, characterized in that, In the case where the redundant ECU controls at least one brake actuator in the second pressure control unit: The first pressure control unit is used to perform basic braking operation or automatic emergency braking operation on the braked wheel under the control of the first ECU. The second pressure control unit is used to perform anti-lock braking operation, traction control operation or electronic stability control operation on the braked wheel under the control of the second ECU or the redundant ECU. The first pressure control unit and the second pressure control unit are used to perform basic braking operation, automatic emergency braking operation, anti-lock braking operation, traction control operation, electronic stability control operation, adaptive cruise control operation, or additional braking operation on the braked wheel under the control of the first ECU and the second ECU, or the first ECU and the redundant ECU.

6. The braking system as described in any one of claims 1 to 5, characterized in that, The master cylinder module is integrated within the first pressure control unit, or the master cylinder module is independent of the first pressure control unit.

7. The braking system as described in any one of claims 1 to 5, characterized in that, The brake actuator includes a motor and / or a solenoid valve.

8. The braking system as described in any one of claims 1 to 5, characterized in that, Also includes: First PCB, second PCB, and inter-board connectors; One of the first ECUs and the second ECU, and a first-type device in the redundant ECU with a power greater than a power threshold, are disposed on the first PCB. The one ECU and a second-type device in the redundant ECU with a power less than the power threshold are disposed on the second PCB. The first-type device in any ECU on the first PCB is connected to the second-type device in the ECU on the second PCB via the board-to-board connector.

9. The braking system as claimed in claim 8, characterized in that, It also includes a support frame, through which the first PCB and the second PCB are fixedly connected.

10. The braking system as claimed in claim 9, characterized in that, The support frame is located at the top layer, the second PCB is located at the bottom layer, the first PCB is located between the support frame and the second PCB, and the first PCB has an opening, through which the support frame passes to fix the first PCB and the second PCB.

11. The braking system as claimed in claim 10, characterized in that, The first type of device is disposed on the surface of the first PCB relative to the support frame, and the second type of device is disposed on the surface of the second PCB relative to the first PCB.

12. The braking system as described in any one of claims 9 to 11, characterized in that, It also includes a housing, in which the support frame, the first PCB and the second PCB are placed, and at least one end of the support frame is fixed to the housing.

13. The braking system as claimed in claim 8, characterized in that, The area of ​​the second PCB is smaller than that of the first PCB.

14. The braking system as claimed in claim 8, characterized in that, It also includes a valve body for housing the controlled component; The first type of device in any ECU includes a driver for the controlled component, and the second type of device in any ECU includes a microcontroller; and, The microcontroller of one ECU and the microcontroller of the redundant ECU are connected through traces on the second PCB.

15. The braking system as claimed in claim 14, characterized in that, The controlled components include motors, solenoid valves, and sensors; The first type of device in any ECU includes a driver for the motor and a driver for the solenoid valve, and the second type of device in any ECU includes an interface between the microcontroller and the sensor.

16. The braking system as claimed in any one of claims 1 to 5, characterized in that, Also includes: A first PCB, a second PCB, and a support frame, wherein the first PCB and the second PCB are fixedly connected by the support frame; The components of one of the first ECU and the second ECU are disposed on the first PCB, and the components of the redundant ECU are disposed on the second PCB.

17. The braking system as claimed in claim 16, characterized in that, It also includes inter-board connectors; The components in any ECU include a microcontroller; and, The microcontroller of one ECU is connected to the microcontroller in the redundant ECU via the board connector.

18. The braking system as claimed in claim 17, characterized in that, It also includes a valve body for housing the controlled component; The devices in any ECU also include a driver for the controlled component; The microcontroller of the ECU is connected to the driver of the controlled component of the ECU through traces on the first PCB; The microcontroller in the redundant ECU is connected to the driver of the controlled component in the redundant ECU via traces on the second PCB.

19. The braking system as claimed in claim 17 or 18, characterized in that, The controlled components include motors, solenoid valves, and sensors; The components in any ECU also include a driver for the motor, a driver for the solenoid valve, and an interface for the sensor.

20. The braking system as claimed in claim 16, characterized in that, It also includes a housing, in which the support frame, the first PCB and the second PCB are placed, and at least one end of the support frame is fixed to the housing.

21. The braking system as claimed in claim 16, characterized in that, The support frame is located at the top layer, the second PCB is located at the bottom layer, the first PCB is located between the support frame and the second PCB, and the first PCB has an opening, through which the support frame passes to fix the first PCB and the second PCB.

22. The braking system as claimed in claim 21, characterized in that, The components of the one ECU are disposed on the surface of the first PCB relative to the support frame, and the components of the redundant ECU are disposed on the surface of the second PCB relative to the first PCB.

23. The braking system as described in any one of claims 1 to 5, characterized in that, Also includes: Printed circuit board (PCB); The components of one of the first ECU and the second ECU, as well as the components of the redundant ECU, are integrated on the PCB.

24. The braking system as claimed in claim 23, characterized in that, The device in any of the ECUs includes a microcontroller, and the microcontroller of the one ECU is connected to the microcontroller in the redundant ECU via traces on the PCB.

25. The braking system as claimed in claim 24, characterized in that, It also includes a valve body for housing the controlled component; The device in any of the ECUs also includes a driver for the controlled component, and the microcontroller in the ECU is connected to the driver for the controlled component in the ECU via traces on the PCB.

26. The braking system as claimed in claim 24 or 25, characterized in that, The controlled components include motors, solenoid valves, and sensors; The devices in any of the ECUs also include the driver for the motor, the driver for the solenoid valve, and the interface for the sensor.

27. The braking system as claimed in claim 23, characterized in that, It also includes a support frame and a housing, wherein the support frame and the PCB are placed inside the housing, and at least one end of the support frame is fixed to the housing.

28. The braking system as claimed in claim 27, characterized in that, The support frame is located at the top layer, and the PCB is located at the bottom layer and is in close contact with the lower shell of the housing.

29. The braking system as claimed in claim 28, characterized in that, The devices in the one ECU and the devices in the redundant ECU are disposed on the surface of the PCB relative to the support frame.

30. The braking system as described in any one of claims 1 to 5, characterized in that, The aforementioned ECU is the ECU that is enabled by default: When the ECU is not faulty, the ECU is used to supply three-phase AC power to the three-phase winding; In the event of a failure of one of the ECUs, the redundant ECU is used to supply three-phase AC power to the three-phase winding.

31. The braking system as described in any one of claims 1 to 5, characterized in that, When the brake actuator includes a motor and the motor includes three-phase windings... The ECU is also used to send an activation instruction to the redundant ECU when it detects that the current on the connection line between the ECU and any phase winding of the three-phase winding is less than a threshold during the process of providing three-phase AC power to the three-phase winding. The redundant ECU is used to provide three-phase AC power to the three-phase winding through the connection line between the redundant ECU and the three-phase winding, according to the activation instruction.

32. The braking system as claimed in claim 31, characterized in that, The ECU is further configured to: send a second switching instruction to the redundant ECU when the current on the connection line to any phase winding is less than a threshold. The switching circuit is used to: disconnect the connection line between the one ECU and the three-phase winding according to the second switching instruction, and connect the connection line between the redundant ECU and the three-phase winding.

33. The braking system as described in any one of claims 1 to 5, characterized in that, When the brake actuator includes a motor and the motor includes a first set of three-phase windings and a second set of three-phase windings, one of the first ECU and the second ECU is connected to the first set of three-phase windings via a line, and the redundant ECU is connected to the second set of three-phase windings via a line. The aforementioned ECU is the ECU that is enabled by default: When the ECU is not faulty, the ECU is used to supply three-phase AC power to the first group of three-phase windings; In the event of a failure of one of the ECUs, the redundant ECU is used to supply three-phase AC power to the second set of three-phase windings.

34. The braking system as claimed in claim 33, characterized in that, The ECU is used to detect the current on the connection line between the ECU and each phase winding in the first group of three-phase windings during the process of providing three-phase AC power to the first group of three-phase windings. When the current on the connection line with any phase winding is less than a threshold, the ECU sends an activation instruction to the redundant ECU and stops providing three-phase AC power to the first group of three-phase windings. The redundant ECU is used to provide three-phase AC power to the second group of three-phase windings through the connection line between the redundant ECU and the second group of three-phase windings, according to the activation instruction.

35. The braking system as claimed in claim 33, characterized in that, It also includes a switching circuit, which is disposed on the connection line between the one ECU and the first group of three-phase windings, and the connection line between the redundant ECU and the second group of three-phase windings; The ECU is further configured to: send a switching instruction to the switching circuit when the current on the connection line to any phase winding is less than a threshold. The switching circuit is used to: disconnect the connection line between the one ECU and the first group of three-phase windings according to the switching instruction, and connect the connection line between the redundant ECU and the second group of three-phase windings.

36. The braking system as described in any one of claims 1 to 5, characterized in that, When the brake actuator includes a solenoid valve and the solenoid valve includes a dual coil, one of the first ECU and the second ECU and the redundant ECU are respectively connected to the dual coil via wiring; The aforementioned ECU is the ECU that is enabled by default: When the ECU is not faulty, the ECU is used to supply DC power to the dual coils; In the event of a failure of one of the ECUs, the redundant ECU is used to supply DC power to the dual coils.

37. The braking system as claimed in claim 36, characterized in that, The ECU is configured to detect the current on the connection line between the ECU and each coil in the dual coils during the process of supplying DC power to the dual coils, and send a supplementary instruction to the redundant ECU when the current on the connection line with the first coil in the dual coils is less than a threshold; the first coil is any one of the dual coils. The redundant ECU is used to provide a supplementary electrical signal to the first coil through the connection line between the redundant ECU and the first coil, according to the supplementary instruction.

38. The braking system as claimed in claim 37, characterized in that, It also includes a switching circuit, which is disposed on the connection line between the one ECU and the dual coil, and the connection line between the redundant ECU and the dual coil; The ECU is further configured to: send a first switching instruction to the switching circuit when the current on the connection line with the first coil is less than a threshold. The switching circuit is configured to: disconnect the connection line between the one ECU and the first coil according to the first switching instruction, and connect the connection line between the redundant ECU and the first coil.

39. The braking system as claimed in claim 36, characterized in that, The ECU is used to detect the current on the connection line between the ECU and each coil in the dual coils during the process of supplying DC power to the dual coils. When the current on the connection line with any coil is less than a threshold, the ECU sends an activation instruction to the redundant ECU and stops supplying DC power to the dual coils. The redundant ECU is used to provide DC power to the dual coils through the connection line between the redundant ECU and the dual coils, according to the activation instruction.

40. The braking system as claimed in claim 39, characterized in that, It also includes a switching circuit, which is disposed on the connection line between the one ECU and the dual coil, and on the connection line between the redundant ECU and the dual coil; The ECU is further configured to: send a second switching instruction to the switching circuit when the current on the connection line to any coil is less than a threshold. The switching circuit is used to connect the redundant ECU to the dual coil and disconnect the connection between the one ECU and the dual coil according to the second switching instruction.

41. The braking system as described in any one of claims 1 to 5, characterized in that, When the brake actuator includes a solenoid valve and the solenoid valve includes a first positive coil, a second positive coil, and a negative coil, one of the first ECU and the second ECU is connected to the first positive coil and the negative coil via a line, and the redundant ECU is connected to the second positive coil and the negative coil via a line. The aforementioned ECU is the ECU that is enabled by default: When the ECU is not faulty, the ECU is used to provide DC power to the first positive coil and the negative coil; In the event of a failure of one of the ECUs, the redundant ECU is used to provide DC power to the second positive coil and the negative coil.

42. The braking system as claimed in claim 41, characterized in that, The ECU is used to detect the current in the connection line between the ECU and the negative coil during the process of providing DC power to the first positive coil and the negative coil, and to send a supplementary instruction to the redundant ECU when the current in the connection line with the negative coil is less than a threshold. The redundant ECU is used to provide an electrical signal to the negative coil through the connection line between the redundant ECU and the negative coil, according to the supplementary instruction.

43. The braking system as claimed in claim 42, characterized in that, It also includes a switching circuit, which is disposed on the connection line between the one ECU and the first positive coil, the connection line between the one ECU and the negative coil, the connection line between the redundant ECU and the second positive coil, and the connection line between the redundant ECU and the negative coil. The ECU is further configured to: send a first switching instruction to the switching circuit when the current on the connection line with the first positive coil is less than a threshold. The switching circuit is configured to: disconnect the connection line between the one ECU and the first positive coil according to the first switching instruction, and connect the connection line between the redundant ECU and the second positive coil.

44. The braking system as claimed in claim 41, characterized in that, The ECU is configured to detect the current on the connection line between the ECU and each of the first positive coil and the negative coil during the process of providing DC power to the first positive coil and the negative coil; when the current on the connection line with any coil is less than a threshold, send an activation instruction to the redundant ECU and stop providing DC power to the first positive coil and the negative coil. The redundant ECU is used to provide DC power to the second positive coil and the negative coil through the connection line between the redundant ECU and the second positive coil and the negative coil, according to the activation instruction.

45. The braking system as claimed in claim 44, characterized in that, It also includes a switching circuit, which is disposed on the connection line between the one ECU and the first positive coil, the connection line between the one ECU and the negative coil, the connection line between the redundant ECU and the second positive coil, and the connection line between the redundant ECU and the negative coil. The ECU is further configured to: send a second switching instruction to the switching circuit when the current on the connection line to any one of the coils is less than a threshold. The switching circuit is used to, according to the second switching instruction, connect the redundant ECU to the second positive coil and the redundant ECU to the negative coil, and disconnect the connection between the one ECU and the first positive coil and the one ECU and the negative coil.

46. ​​The braking system as claimed in any one of claims 1 to 5, characterized in that, When the brake actuator includes a solenoid valve and the solenoid valve includes a first set of dual coils and a second set of dual coils, one of the first ECU and the second ECU is connected to the first set of dual coils via a line, and the redundant ECU is connected to the second set of dual coils via a line. The aforementioned ECU is the ECU that is enabled by default: When the ECU is not faulty, the ECU is used to supply DC power to the first set of dual coils; In the event of a failure of one of the ECUs, the redundant ECU is used to supply DC power to the second set of dual coils.

47. The braking system as claimed in claim 46, characterized in that, The ECU is used to detect the current on the connection line between the ECU and each coil in the first group of dual coils during the process of supplying DC power to the first group of dual coils. When the current on the connection line with any coil is less than a threshold, the ECU sends an activation instruction to the redundant ECU and stops supplying DC power to the first group of dual coils. The redundant ECU is used to provide DC power to the second set of dual coils through the connection line between the redundant ECU and the second set of dual coils, according to the activation instruction.

48. The braking system as claimed in claim 47, characterized in that, It also includes a switching circuit, which is disposed on the connection line between the one ECU and the first set of dual coils, and on the connection line between the redundant ECU and the second set of dual coils; The ECU is also configured to send a switching instruction to the switching circuit when the current on the connection line to any one of the coils is less than a threshold. The switching circuit is used to connect the redundant ECU to the second group of dual coils according to the switching instruction, and disconnect the connection between the one ECU and the first group of dual coils.

49. A terminal device, characterized in that, Includes the braking system as described in any one of claims 1-48.

Images