Vehicle control method, device and equipment based on vehicle redundant braking system

Abstract

The application relates to a vehicle control method, device and equipment based on a vehicle redundant braking system. The method comprises the following steps: receiving a failure notification of a first actuator group and a power supply instruction issued by a main controller; wherein the failure notification and the power supply instruction are sent by the main controller after the main controller detects that the first actuator group fails to successfully execute a first braking instruction, and the first braking instruction is sent by the main controller to the first actuator group in response to a braking request sent by a driving assistance system; starting a second actuator group in response to the power supply instruction; based on the failure notification of the first actuator group, sending a second braking instruction to the second actuator group in response to the braking request sent by the driving assistance system, so that the second actuator group executes the second braking instruction and controls the vehicle. The method can reduce the development cost of the redundant braking system without affecting the braking requirement.

Description

Technical Field

[0001] The present application relates to the technical field of vehicle braking control, and in particular to a vehicle control method, device and equipment based on a vehicle redundant braking system. Background Art

[0002] With the development of intelligent driving technology, vehicle braking control technology has emerged. A vehicle's braking system typically consists of a primary braking system and a redundant braking system. If the primary braking system fails while the driver is using assisted driving, the redundant braking system must control the vehicle's braking according to the lowest-risk strategy.

[0003] In order to ensure the safety and accuracy of the actuator's execution results, the operation of the actuator in the redundant braking system requires control instructions with a higher safety level. Therefore, each device and controller in the current redundant braking system needs to have a higher safety level to send control instructions to the actuator, which leads to high development costs of the redundant braking system and urgent need for improvement. Summary of the Invention

[0004] Based on this, it is necessary to provide a vehicle control method, device and equipment based on a vehicle redundant braking system that can reduce the development cost of the redundant braking system in order to address the above technical problems.

[0005] In a first aspect, the present application provides a vehicle control method based on a vehicle redundant braking system. The vehicle redundant braking system includes a main controller, a redundant controller, a first actuator group controlled by the main controller, and a second actuator group controlled by the redundant controller, wherein the main controller has a higher safety level than the redundant controller. The method is executed by the redundant controller and includes:

[0006] receiving a fault notification and a power supply instruction for the first actuator group issued by the main controller; wherein the fault notification and the power supply instruction are issued by the main controller after detecting that the first actuator group has failed to successfully execute a first braking instruction, and the first braking instruction is issued by the main controller to the first actuator group in response to a braking request issued by the driving assistance system;

[0007] In response to a power supply instruction, the second actuator group is started;

[0008] Based on the fault notification of the first actuator group and in response to the braking request sent by the driving assistance system, a second braking instruction is sent to the second actuator group, so that the second actuator group executes the second braking instruction to control the vehicle.

[0009] In one embodiment, the main controller includes: a first brake control module, a first communication module and a first power control module; the redundant controller includes: a second brake control module, a second communication module and a second power control module; and the safety level of the first brake control module is higher than that of the first communication module, the first power control module, the second brake control module, the second communication module and the second power control module.

[0010] In one embodiment, receiving a fault notification and a power supply instruction of a first actuator group sent by a main controller includes:

[0011] receiving, via the second communication module, a fault notification of the first actuator group sent from the first communication module of the main controller; wherein the fault notification of the first actuator group is generated and sent to the first communication module after the first brake control module of the main controller detects that the first actuator group has failed to execute the first brake command;

[0012] The power supply instruction issued by the first power supply control module of the main controller is received through the second power supply control module; wherein, the power supply instruction is generated and sent to the first power supply control module after the first brake control module of the main controller detects that the first actuator group fails to successfully execute the first brake instruction.

[0013] In one embodiment, in response to a power supply instruction, starting the second actuator group includes:

[0014] The second power control module responds to the power supply instruction to supply power to the second actuator group to start the second actuator group.

[0015] In one embodiment, based on the first actuator failure notification and in response to a braking request sent by a driving assistance system, sending a second braking instruction to a second actuator group includes:

[0016] When the second communication module receives the first actuator failure notification, the second brake control module generates a second braking instruction in response to the braking request sent by the driving assistance system, and sends the second braking instruction to the second actuator group.

[0017] In one embodiment, after sending a second braking instruction to the second actuator group in response to a braking request sent by a driving assistance system based on a first actuator failure notification, the method further includes:

[0018] Detecting the execution result of the second braking instruction and feeding it back to the main controller; the execution result is used by the main controller to determine whether to send a power-off instruction to the redundant controller;

[0019] If a power-off command is received from the main controller, the second actuator group will stop running.

[0020] In one embodiment, the power-off instruction is sent to the redundant controller when the main controller receives an execution result indicating that the second actuator group fails to execute the second braking instruction, or receives no execution result.

[0021] In a second aspect, the present application further provides a redundant controller based on a vehicle redundant braking system. The redundant controller includes:

[0022] A second communication module is configured to receive a fault notification of the first actuator group sent by the main controller;

[0023] a second power control module, configured to receive a power supply instruction from the main controller and, in response to the power supply instruction, activate the second actuator group; wherein the fault notification and the power supply instruction are sent by the main controller after detecting that the first actuator group has failed to successfully execute a first braking instruction, the first braking instruction being sent by the main controller to the first actuator group in response to a braking request sent by the driving assistance system;

[0024] The second brake control module is configured to send a second brake instruction to the second actuator group in response to a brake request sent by the driving assistance system based on a fault notification of the first actuator group, so that the second actuator group executes the second brake instruction to control the vehicle.

[0025] In a third aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the following steps:

[0026] receiving a fault notification and a power supply instruction for the first actuator group issued by the main controller; wherein the fault notification and the power supply instruction are issued by the main controller after detecting that the first actuator group has failed to successfully execute a first braking instruction, and the first braking instruction is issued by the main controller to the first actuator group in response to a braking request issued by the driving assistance system;

[0027] In response to a power supply instruction, the second actuator group is started;

[0028] Based on the fault notification of the first actuator group and in response to the braking request sent by the driving assistance system, a second braking instruction is sent to the second actuator group, so that the second actuator group executes the second braking instruction to control the vehicle.

[0029] In a fourth aspect, the present application further provides a computer program product. The computer program product includes a computer program that, when executed by a processor, implements the following steps:

[0030] receiving a fault notification and a power supply instruction for the first actuator group issued by the main controller; wherein the fault notification and the power supply instruction are issued by the main controller after detecting that the first actuator group has failed to successfully execute a first braking instruction, and the first braking instruction is issued by the main controller to the first actuator group in response to a braking request issued by the driving assistance system;

[0031] In response to a power supply instruction, the second actuator group is started;

[0032] Based on the fault notification of the first actuator group and in response to the braking request sent by the driving assistance system, a second braking instruction is sent to the second actuator group, so that the second actuator group executes the second braking instruction to control the vehicle.

[0033] In the fifth aspect, the present application also provides a vehicle redundant braking system, comprising: a main controller, a redundant controller, a first actuator group controlled by the main controller, and a second actuator group controlled by the redundant controller, and the safety level of the main controller is higher than that of the redundant controller; the main controller is used to send a first actuator to the first actuator group in response to a braking request sent by a driving assistance system, and when it is detected that the first actuator group has not successfully executed the first braking instruction, it sends a fault notification and a power supply instruction of the first actuator group to the redundant controller; the redundant controller is used to receive the fault notification and the power supply instruction of the first actuator group sent by the main controller, and in response to the power supply instruction, start the second actuator group, and based on the fault notification of the first actuator group, send a second braking instruction to the second actuator group in response to the braking request sent by the driving assistance system, so that the second actuator group executes the second braking instruction to control the vehicle.

[0034] In the aforementioned vehicle control method, apparatus, and device based on a redundant vehicle braking system, when a fault occurs in a first actuator group controlled by a primary controller with a higher safety level in the redundant braking system, a fault notification and power supply instruction for the first actuator group are sent to the redundant controller with a lower safety level. After receiving the fault notification and power supply instruction for the first actuator group, the redundant controller, in response to the power supply instruction, sends a start signal to a second actuator group controlled by the redundant controller, activating the second actuator group. With the second actuator group activated, a second braking instruction is sent to the second actuator group based on the fault notification of the first actuator group and in response to a braking request from the driver assistance system, enabling the second actuator group to control the vehicle. Because the primary controller has a higher safety level than the redundant controller, although the second actuator group is controlled by the second braking instruction issued by the redundant controller with a lower safety level, its activation is controlled by the power supply instruction issued by the primary controller with a higher safety level. Therefore, the second actuator group can still control the vehicle under braking conditions with a higher safety level. That is to say, the redundant controller can be developed with a low safety level while achieving braking conditions with a high safety level for the second actuator group, thereby reducing the development cost of the redundant braking system without affecting the braking requirements. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 This is a diagram illustrating an application environment of the first vehicle control method based on a vehicle redundant braking system provided in this embodiment;

[0036] Figure 2 A schematic flow chart of a first vehicle control method based on a vehicle redundant braking system provided in this embodiment;

[0037] Figure 3 A diagram illustrating an application environment of a second vehicle control method based on a vehicle redundant braking system provided in this embodiment;

[0038] Figure 4 A schematic diagram of a flow chart of receiving a fault notification and a power supply instruction of a first actuator group issued by a main controller provided in this embodiment;

[0039] Figure 5 A schematic diagram of a process for stopping the second actuator group provided in this embodiment;

[0040] Figure 6 A schematic flow chart of a second vehicle control method based on a vehicle redundant braking system provided in this embodiment;

[0041] Figure 7 This is a structural block diagram of the first redundant controller based on the vehicle redundant braking system provided in this embodiment. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0043] Currently, the driving assistance systems of intelligent vehicles all include a primary braking system and a redundant braking system. When the driver activates a higher-level assisted driving function, if the primary braking system fails, the vehicle's redundant braking system will operate. Furthermore, the vehicle's redundant braking system must also achieve a high-safety level of braking (such as a safety level of ASILD). However, the vehicle's primary braking system generally does not fail, which means that the redundant braking system is generally not actually used. Currently, in the design of vehicle driving assistance systems, all controllers are typically designed with a high safety level in mind, resulting in high development and operating costs.

[0044] The vehicle control method based on the vehicle redundant braking system provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown in FIG. 1 , a vehicle redundant braking system 2 is provided, comprising: a main controller 20, a redundant controller 22, a first actuator group 21 controlled by the main controller 20, and a second actuator group 23 controlled by the redundant controller 22. In addition, the safety level of the main controller 20 is higher than that of the redundant controller 22. It should be noted that, as Figure 1 As shown, the vehicle control method based on the vehicle redundant braking system is not only applied to the vehicle redundant braking system 2 , but also includes a controller in a driving assistance system, such as an ADAS (Advanced Driving Assistance System) controller 1 .

[0045] The ADAS controller 1 is an electronic control unit for an advanced driver assistance system (ADAS) that integrates and processes data from various sensors (such as cameras, radars, and lidars) to enable various safe and automated driving functions. The ADAS controller 1 can be a centralized architecture, replacing traditional distributed architectures, thereby reducing system complexity, cost, and power consumption, and improving system performance, scalability, and functional safety. In this embodiment, the ADAS controller 1 is typically designed for Level 2 or Level 3 autonomous driving requirements. The ADAS controller 1 requires features such as high-speed communication, large-capacity storage, powerful computing capabilities, and a flexible software platform. The main controller 20 can be a controller that responds to braking commands from the ADAS controller 1 and controls the operation of the first actuator group 21 to achieve autonomous driving requirements. The redundant controller 22 can be a controller that responds to braking commands from the ADAS controller 1 and controls the operation of the second actuator group 24 to achieve autonomous driving requirements in the event of a failure of the first actuator group corresponding to the main controller. Both the first actuator 21 and the second actuator 24 are actuators that perform braking operations in accordance with braking commands to achieve autonomous driving requirements.

[0046] In addition, the safety level of the main controller 20 is higher than that of the redundant controller 22. In this embodiment, the safety levels of the main controller 20 and the redundant controller 22 can both be assessed using ASIL (Automotive Safety Integrity Level). ASIL refers to the Automotive Safety Integrity Level, which is a risk classification system defined by the ISO 26262 standard for the functional safety of road vehicles. The standard defines functional safety as "the absence of unreasonable risk of hazards due to the faulty behavior of electrical or electronic systems." ASIL determines safety requirements based on the likelihood and acceptability of damage so that automotive components comply with ISO 26262. ISO 26262-A, B, C, and D identify four ASILs. ASILA represents the lowest level, while ASILD represents the highest automotive safety level.

[0047] like Figure 1 As shown, ADAS controller 1 is connected to main controller 20 and redundant controller 22 in vehicle redundant braking system 2. Main controller 20 is connected to redundant controller 22 and first actuator group 21. Redundant controller 22 is connected to main controller 20 and second actuator group. It is understood that the connection between the various components described above can be wired or wireless, and this is not limited to this.

[0048] In one embodiment, Figure 2 As shown, a vehicle control method based on a vehicle redundant braking system is provided, and the method is applied to Figure 1 The redundant controller 22 in the example is used as an example to illustrate, including the following steps:

[0049] S201, receiving a fault notification and a power supply instruction of a first actuator group sent by a main controller.

[0050] The fault notification and power supply command are generated and sent by the main controller after it detects that the first actuator group has failed to successfully execute the first braking command. The first braking command is generated and sent to the first actuator group by the main controller in response to a braking request from the driver assistance system. The main controller can be the controller used to control the first actuator group to execute the braking command. The first actuator group can be the actuator group that completes the braking request in response to the braking command issued by the main controller. The power supply command can be triggered by the main controller when it detects a fault in the first actuator group and is used to provide power to the redundant controller.

[0051] Specifically, in this embodiment, when the first actuator group controlled by the main controller fails, the redundant controller will receive a failure notification of the first actuator group issued by the main controller and a power supply instruction for controlling the redundant controller to supply power to the second actuator group.

[0052] It should be noted that when the driver turns on a higher-level assisted driving function, the ADAS controller will first send a braking command to the main braking system in the vehicle's driving assistance system in response to the driver's braking request. Only when the ADAS controller detects a failure in the main braking system will it send a braking command to the redundant braking system. For example, when the ADAS controller detects that the main braking system has not responded to the above braking command within a preset time period, the ADAS controller determines that the main braking system has failed. At the same time, it sends a braking command to the redundant braking system in the vehicle's driving assistance system, and the redundant braking system completes the braking request. Furthermore, when the main braking system fails, the ADAS controller can simultaneously send a braking command to the main controller and the redundant controller in the redundant braking system. When the main controller in the redundant braking system fails, the main controller will feedback a fault notification to the ADAS controller and the redundant brake, and at the same time, send a power supply command to the redundant brake to provide power to the second actuator group.

[0053] S202, responding to the power supply instruction, starting the second actuator group.

[0054] The second actuator group may be an actuator group that completes the braking request in response to the braking instruction issued by the redundant controller and the power supply instruction issued by the main controller.

[0055] Specifically, in this embodiment, after the redundant controller receives the fault notification and power supply instruction of the first actuator group sent by the main controller, it starts the second actuator group based on the power supply instruction.

[0056] It should be noted that, since the power supply instruction is issued by the main controller and the security level of the main controller is high, the security level of the power supply instruction will be the same as the security level of the main controller, that is, the security level of the power supply instruction is high.

[0057] S203 , based on the fault notification of the first actuator group and in response to the braking request sent by the driving assistance system, sending a second braking instruction to the second actuator group, so that the second actuator group executes the second braking instruction to control the vehicle.

[0058] The second braking command may be a command for activating the second actuator group.

[0059] Specifically, in this embodiment, when a primary braking system in a redundant braking system fails, the redundant controller can, based on a failure notification of the first actuator group issued by the primary controller in the redundant braking system, respond to a braking request from the driver assistance system and send a second braking command to the corresponding second actuator group, causing the second actuator group to execute the second braking command and control the vehicle. Alternatively, upon receiving a braking request from the ADAS controller, the redundant controller may not initially respond to the braking request, i.e., may not send the second braking command to the second actuator group. Only after the second actuator group is activated can the redundant controller, in response to a failure notification of the first actuator group issued by the primary controller, send the second braking command to the second actuator group, causing the second actuator group to operate.

[0060] It should be noted that another situation may be that when the redundant controller receives the braking request issued by the ADAS controller, it responds to the braking request and sends a second braking instruction to the second actuator group. However, at this time, since the redundant controller does not start the second actuator group based on the power supply instruction, the second actuator group does not work at this time. When the redundant controller receives the fault notification and power supply instruction of the first actuator group issued by the main controller, it will supply power to the second actuator group. At this time, the redundant controller will respond to the braking request again, generate a second braking instruction and send it to the second actuator group. At this time, the second actuator group can execute the second braking instruction to control the vehicle.

[0061] In the vehicle control method based on a redundant braking system, when a fault occurs in a first actuator group controlled by a primary controller with a higher safety level in the redundant braking system, a fault notification and power supply instruction for the first actuator group are sent to the redundant controller with a lower safety level. After receiving the fault notification and power supply instruction for the first actuator group, the redundant controller, in response to the power supply instruction, sends a start signal to a second actuator group controlled by the redundant controller, activating the second actuator group. With the second actuator group activated, a second braking instruction is sent to the second actuator group based on the fault notification of the first actuator group and in response to a braking request from the driver assistance system, enabling the second actuator group to control the vehicle. Because the primary controller has a higher safety level than the redundant controller, although the second actuator group is controlled by the second braking instruction from the redundant controller with a lower safety level, its activation is controlled by the power supply instruction from the primary controller with a higher safety level. Therefore, the second actuator group can still control the vehicle under braking conditions with a higher safety level. That is to say, the redundant controller can be developed with a low safety level while achieving braking conditions with a high safety level for the second actuator group, thereby reducing the development cost of the redundant braking system without affecting the braking requirements.

[0062] Furthermore, in order to make the vehicle control method based on the vehicle redundant braking system clearer, the vehicle redundant braking system provided in this embodiment can be as follows: Figure 3The vehicle redundant braking system shown in the figure. The main controller 20 includes a first brake control module 200, a first communication module 201, and a first power control module 202. The redundant controller 22 includes a second brake control module 220, a second communication module 221, and a second power control module 222. The safety level of the first brake control module 200 is higher than that of the first communication module 201, the first power control module 202, the second brake control module 220, the second communication module 221, and the second power control module 222. The first communication module 201 is used to receive brake requests from the ADAS controller 1 and transmit these requests to the first brake control module 200 in the main controller 20. Furthermore, the first communication module 201 is used to receive fault notifications from the first actuator group 21 controlled by the main controller 20 when the first actuator group 21 fails, and transmit these fault notifications to the second communication module 221 in the redundant controller 22. In response to the braking request, the first brake control module 200 is configured to send a first braking command to the first actuator group 21, causing the first actuator group 21 to control the vehicle based on the first braking command. In response to a power supply command issued by the first brake control module 200, the first power control module 202 is configured to provide power to the second power control module 222 in the redundant controller 22, causing the second power control module 222 to power the second actuator group 23, thereby activating the second actuator group 23. In response to a failure notification of the first actuator group 21 issued by the first communication module 201, the second communication module 221 is configured to send a braking request to the second brake control module 220, causing the second brake control module 220 to send a second braking command to the second actuator group 23 based on the braking request, causing the second actuator group 23 to control the vehicle based on the second braking command. In the above embodiment, the modules in the main controller and the redundant controller cooperate with each other, enabling both the first and second actuators to control the vehicle with a high level of safety. And because the safety level of the first brake control module is higher than that of the first communication module, the first power control module, the second brake control module, the second communication module and the second power control module, the development cost of the redundant brake system can be greatly reduced.

[0063] Furthermore, the above vehicle control method based on vehicle redundant braking system is applied to Figure 3 In the vehicle redundant braking system shown in FIG, a process of receiving a fault notification and a power supply instruction of the first actuator group issued by the main controller is described in detail, such as Figure 4 As shown, this may include:

[0064] S401: Receive, through a second communication module, a fault notification of a first actuator group sent by a first communication module of a main controller.

[0065] The fault notification of the first actuator group is generated and sent to the first communication module after the first brake control module of the main controller detects that the first actuator group fails to execute the first brake instruction.

[0066] The second communication module of the redundant controller receives the first actuator group fault notification sent by the first communication module. Specifically, the first actuator group fault notification is sent by the first brake control module of the primary controller to its corresponding first communication module based on the failure of the first actuator group. In this embodiment, when the first brake control module of the primary controller of the redundant braking system detects a failure in the first actuator group it controls, it generates and sends the first actuator group fault notification to the first communication module. After receiving this fault notification, the first communication module forwards the first actuator group fault notification to the second communication module corresponding to the second brake control module of the redundant controller.

[0067] S402: Receive, through the second power control module, a power supply instruction sent by the first power control module of the main controller.

[0068] The power supply instruction is generated by the first brake control module of the main controller after detecting that the first actuator group fails to execute the first brake instruction and is sent to the first power control module.

[0069] Specifically, when the vehicle redundant braking system is as follows Figure 3 In the vehicle redundant braking system shown, responding to the power supply instruction to start the second actuator group includes: responding to the power supply instruction through the second power control module to supply power to the second actuator group to start the second actuator group.

[0070] For example, the second power supply control module of the redundant controller receives a power supply instruction from the first power supply control module, causing the second power supply control module to supply power to the second actuator group controlled by the first brake control module of the redundant controller based on the power supply instruction. In this embodiment, when the first brake control module of the master controller of the redundant brake system detects a failure in the first actuator group it controls, it sends a power supply instruction to the first power supply control module. The first power supply control module responds to the power supply instruction by sending a power supply instruction to the second power supply control module.

[0071] Furthermore, if the second communication module receives a first actuator failure notification, the second brake control module generates a second brake command in response to the braking request sent by the driver assistance system, and sends the second brake command to the second actuator group. Specifically, only when the second communication module of the redundant controller receives a first actuator failure notification sent by the first communication module of the primary controller will the second brake control module of the redundant controller respond to the braking request sent by the driver assistance system (ADAS controller) and generate a second brake command and send it to the second actuator group it controls, so that the second actuator group can control the vehicle in response to the second brake command.

[0072] In the above embodiment, both the main controller and the redundant controller of the redundant braking system are modularized, each with its own specific functionality. This means that the redundant controller receives fault notifications and power supply commands from the first actuator group via two different channels. Since the second brake control module has a lower safety level, controlling the second actuator group solely by the second control module cannot meet the operating requirements of the second actuator, compromising the safety of the second brake control module in responding to the second braking command. Therefore, in this embodiment, the second power control module also receives the power supply command from the first power control module at the same time as the second brake control module receives the fault notification from the first actuator group. Because the second power control module is controlled by the higher-safety main controller, inadvertent activation of the second actuator group is avoided. By combining the second brake command from the second brake control module with the power supply command from the second power control module, the safety performance of the second actuator group is improved, thereby reducing the development cost of the redundant braking system without compromising braking requirements.

[0073] Furthermore, in order to enable the redundant controller to synchronously understand the operation status of the second actuator group, in one embodiment, as Figure 5 As shown, based on the first actuator failure notification, in response to the braking request sent by the driving assistance system, after sending the second braking instruction to the second actuator group, the method further includes:

[0074] S501, detecting the execution result of the second braking instruction and feeding back to the main controller.

[0075] The execution result is used by the main controller to determine whether to send a power-off instruction to the redundant controller.

[0076] Optionally, the power-off instruction may be an instruction for stopping supplying power to the second power control module. Exemplarily, the power-off instruction is sent to the redundant controller when the main controller receives an execution result that the second actuator group has failed to successfully execute the second braking instruction, or has not received an execution result. Accordingly, the execution result of the second actuator group in response to the second braking instruction may include many situations, one of which is normal execution, another may be failure to execute (at this time the main controller cannot receive the execution result), and another may be a failure during the execution process (at this time the main controller may have received the execution result of the running operation at the previous moment, but cannot receive the execution result at the next moment). It is understandable that when the execution result of the second actuator group in response to the second braking instruction is a failure during the execution process, the second actuator group may still be running, but cannot be stopped.

[0077] Optionally, in this embodiment, the redundant controller can detect the execution result of the second actuator group it controls in response to the second braking instruction, and feed the execution result back to the main controller. The main controller can judge the status of the second actuator group based on the execution result, and issue corresponding instructions based on the status of the second actuator group.

[0078] S502: If a power-off instruction is received from the main controller, the second actuator group is stopped.

[0079] Specifically, after receiving the power-off instruction sent by the main controller, the redundant controller stops supplying power to the second actuator group, thereby stopping the operation of the second actuator group.

[0080] by Figure 3As shown, the second power control module 222 in the redundant controller 22 may receive a power-off command from the first power control module 202 of the main controller 20, and the second power control module 222 may stop supplying power to the second actuator group 23, thereby stopping the operation of the second actuator group 23. For example, the second brake control module 220 in the redundant controller 22 may detect the result of the second actuator group 23 executing the second brake command, and then feedback the execution result to the first communication module 201 of the main controller 20 and the first brake control module 200 via the second communication module 221. For example, if the ADAS controller receives a driver's request to end assisted driving, and the second actuator group 23 is still running and cannot be stopped, the main controller 20 may immediately issue a power-off command, causing the first power control module 202 to stop supplying power to the second power control module 222 based on the power-off command, thereby stopping the operation of the second actuator group 23, thereby improving safety. For another example, if the status of the second actuator group 23 is failure and non-execution, the main controller 20 cannot receive the execution result of the second actuator group 23 at this time, and the main controller 20 sends a power-off instruction to the first power control module 202, so that the first power control module 202 stops supplying power to the second power module 222, so that the second actuator group 23 is powered off.

[0081] In the above embodiment, after the second actuator group controlled by the redundant controller responds to the second braking instruction, it will also feedback the execution result to the main controller, so that when the main controller detects a failure of the second actuator group, it will give a power-off instruction based on the execution result of the second actuator group, thereby avoiding vehicle failure and improving safety.

[0082] In order to facilitate the understanding of those skilled in the art, the vehicle control method based on the vehicle redundant braking system is described in detail. Figure 6 As shown, the method may include:

[0083] S601: A main controller sends a first braking instruction to a first actuator group in response to a braking request sent by a driving assistance system.

[0084] S602: After detecting that the first actuator group fails to execute the first braking instruction, the main controller generates a fault notification and a power supply instruction for the first actuator group.

[0085] S603, the main controller sends a fault notification of the first actuator group to the second communication module of the redundant controller through the first communication module; at the same time, it sends a power supply instruction to the second power control module of the redundant controller through the first power control module.

[0086] S604, the redundant controller receives a fault notification of the first actuator group sent from the first communication module of the main controller through the second communication module; and receives a power supply instruction sent from the first power control module of the main controller through the second power control module.

[0087] S605: The redundant controller responds to the power supply instruction through the second power supply control module to supply power to the second actuator group to start the second actuator group.

[0088] S606, when the second communication module of the redundant controller receives the first actuator failure notification, the second braking control module generates a second braking instruction in response to the braking request sent by the driving assistance system, and sends the second braking instruction to the second actuator group, so that the second actuator group executes the second braking instruction to control the vehicle.

[0089] S607: The redundant controller detects the execution result of the second braking instruction through the second braking control module, and feeds back the execution result to the main controller through the second communication module.

[0090] S608: The first communication module of the main controller receives the execution result sent by the second communication module of the redundant controller.

[0091] S609 , when the first communication module of the main controller receives an execution result indicating that the second actuator group has failed to execute the second braking instruction, or receives no execution result, a power-off instruction is generated.

[0092] S610: The first power control module of the main controller sends a power-off instruction to the second power control module of the redundant controller.

[0093] S611: If the redundant controller receives a power-off instruction from the main controller, it stops the operation of the second actuator group through the second power control module.

[0094] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0095] Based on the same inventive concept, embodiments of the present application also provide a vehicle control device based on a redundant vehicle braking system for implementing the aforementioned vehicle control method based on a redundant vehicle braking system. The solution provided by this device is similar to the solution described in the aforementioned method. Therefore, the specific limitations of one or more of the following embodiments of the vehicle control device based on a redundant vehicle braking system can be found in the aforementioned limitations of the vehicle control method based on a redundant vehicle braking system, and will not be further elaborated here.

[0096] In one embodiment, Figure 7 As shown, a redundant controller 22 based on a vehicle redundant braking system is provided, comprising: a second communication module 221, a second power supply control module 222 and a second braking control module 220, wherein:

[0097] The second communication module 221 is configured to receive a fault notification of the first actuator group sent by the main controller.

[0098] The second power control module 222 is configured to receive a power supply instruction from the main controller, and respond to the power supply instruction to start the second actuator group.

[0099] Among them, the fault notification and power supply instruction are sent by the main controller after detecting that the first actuator group fails to successfully execute the first braking instruction. The first braking instruction is sent by the main controller to the first actuator group in response to the braking request sent by the driving assistance system.

[0100] The second brake control module 220 is configured to send a second brake instruction to the second actuator group based on the fault notification of the first actuator group and in response to the brake request sent by the driving assistance system, so that the second actuator group executes the second brake instruction to control the vehicle.

[0101] In one embodiment, the main controller includes: a first brake control module, a first communication module and a first power control module, and the redundant controller includes: a second brake control module, a second communication module and a second power control module; and the safety level of the first brake control module is higher than that of the first communication module, the first power control module, the second brake control module, the second communication module and the second power control module.

[0102] In one embodiment, the second communication module 221 is configured to receive a fault notification of the first actuator group sent by the first communication module of the main controller.

[0103] The fault notification of the first actuator group is generated and sent to the first communication module after the first brake control module of the main controller detects that the first actuator group fails to execute the first brake instruction.

[0104] The second power control module 222 is configured to receive a power supply instruction sent by the first power control module of the main controller.

[0105] The power supply instruction is generated by the first brake control module of the main controller after detecting that the first actuator group fails to execute the first brake instruction and is sent to the first power control module.

[0106] In one embodiment, the second power control module 222 is specifically configured to: respond to a power supply instruction and supply power to the second actuator group to start the second actuator group.

[0107] In one embodiment, the second brake control module 220 is specifically configured to: generate a second braking instruction in response to a braking request sent by the driving assistance system, and send the second braking instruction to the second actuator group when the second communication module receives a first actuator failure notification.

[0108] In one embodiment, the second brake control module 220 is further configured to detect the execution result of the second brake command and feed it back to the main controller, wherein the execution result is used by the main controller to determine whether to issue a power-off command to the redundant controller.

[0109] The second brake control module 220 is further configured to stop the second actuator group if a power-off instruction is received from the main controller.

[0110] In one embodiment, the power-off instruction is sent to the redundant controller when the main controller receives an execution result indicating that the second actuator group fails to execute the second braking instruction, or when the main controller receives no execution result.

[0111] Each module in the redundant controller for the redundant vehicle braking system can be implemented in whole or in part through software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in hardware form, or stored in a computer device memory in software form, so that the processor can call and execute the corresponding operations of each module.

[0112] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented:

[0113] receiving a fault notification and a power supply instruction for the first actuator group issued by the main controller; wherein the fault notification and the power supply instruction are issued by the main controller after detecting that the first actuator group has failed to successfully execute a first braking instruction, and the first braking instruction is issued by the main controller to the first actuator group in response to a braking request issued by the driving assistance system;

[0114] In response to a power supply instruction, the second actuator group is started;

[0115] Based on the fault notification of the first actuator group and in response to the braking request sent by the driving assistance system, a second braking instruction is sent to the second actuator group, so that the second actuator group executes the second braking instruction to control the vehicle.

[0116] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0117] receiving a fault notification and a power supply instruction for the first actuator group issued by the main controller; wherein the fault notification and the power supply instruction are issued by the main controller after detecting that the first actuator group has failed to successfully execute a first braking instruction, and the first braking instruction is issued by the main controller to the first actuator group in response to a braking request issued by the driving assistance system;

[0118] In response to a power supply instruction, the second actuator group is started;

[0119] Based on the fault notification of the first actuator group and in response to the braking request sent by the driving assistance system, a second braking instruction is sent to the second actuator group, so that the second actuator group executes the second braking instruction to control the vehicle.

[0120] In one embodiment, a vehicle redundant braking system is provided, comprising: a main controller, a redundant controller, a first actuator group controlled by the main controller, and a second actuator group controlled by the redundant controller, wherein the main controller has a higher safety level than the redundant controller; the main controller is configured to send a first actuator to the first actuator group in response to a braking request sent by a driving assistance system, and upon detecting that the first actuator group has failed to successfully execute the first braking instruction, send a fault notification and a power supply instruction of the first actuator group to the redundant controller; the redundant controller is configured to receive the fault notification and the power supply instruction of the first actuator group sent by the main controller, and in response to the power supply instruction, start the second actuator group, and based on the fault notification of the first actuator group, send a second braking instruction to the second actuator group in response to the braking request sent by the driving assistance system, so that the second actuator group executes the second braking instruction to control the vehicle.

[0121] In one embodiment, the main controller includes: a first brake control module, a first communication module and a first power control module, and the redundant controller includes: a second brake control module, a second communication module and a second power control module; and the safety level of the first brake control module is higher than that of the first communication module, the first power control module, the second brake control module, the second communication module and the second power control module.

[0122] Specifically, when the first communication module of the main controller receives a braking request from the driver assistance system, it sends the braking request to the first brake control module of the main controller. In response to the braking request, the first brake control module sends a first braking command to the first actuator group. The first actuator group controls the vehicle in response to the first braking command. However, if the first brake control module detects that the first actuator group has failed to execute the first braking command, it sends a fault notification for the first actuator group to the second communication module of the redundant controller via the first communication module. Simultaneously, it sends a power supply command to the second power supply control module of the redundant controller via the first power supply control module. After receiving the fault notification for the first actuator group, the second communication module forwards the notification to the second brake control module of the redundant controller. If the second power supply control module activates the second actuator group in response to the power supply command, the second brake control module, based on the fault notification for the first actuator group and in response to the braking request from the driver assistance system, sends a second braking command to the second actuator group, causing the second actuator group to execute the second braking command and control the vehicle. In addition, the second brake control module will also detect the execution result of the second brake instruction and feed back the execution result to the first brake control module of the main controller. If the first brake control module receives the execution result that the second actuator group failed to successfully execute the second brake instruction, or the first brake control module does not receive the execution result, the first brake control module sends a power-off command to the second power control module through the first power control module, thereby stopping the operation of the second actuator group.

[0123] It should be noted that the vehicle information (including but not limited to information on the vehicle's redundant braking system and information contained in the redundant controller, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0124] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, database or other media used in the embodiments provided in this application may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory may include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, distributed databases based on blockchains. The processor involved in the various embodiments provided herein may be, but are not limited to, a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic unit, a data processing logic unit based on quantum computing, and the like.

[0125] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0126] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A vehicle control method based on a vehicle redundant braking system, characterized in that: The vehicle redundant braking system includes a main controller, a redundant controller, a first actuator group controlled by the main controller, and a second actuator group controlled by the redundant controller, and the safety level of the main controller is higher than that of the redundant controller; The method is performed by a redundant controller, and the method includes: receiving a fault notification and a power supply instruction for the first actuator group issued by the main controller; wherein the fault notification and the power supply instruction are issued by the main controller after detecting that the first actuator group has failed to successfully execute a first braking instruction, and the first braking instruction is issued by the main controller to the first actuator group in response to a braking request issued by a driving assistance system; In response to the power supply instruction, starting the second actuator group; Based on the fault notification of the first actuator group and in response to the braking request sent by the driving assistance system, a second braking instruction is sent to the second actuator group, so that the second actuator group executes the second braking instruction to control the vehicle.

2. The method according to claim 1, characterized in that The main controller includes: a first brake control module, a first communication module and a first power control module; the redundant controller includes: a second brake control module, a second communication module and a second power control module; and the safety level of the first brake control module is higher than that of the first communication module, the first power control module, the second brake control module, the second communication module and the second power control module.

3. The method according to claim 2, characterized in that The receiving of the fault notification and power supply instruction of the first actuator group issued by the main controller includes: receiving, through the second communication module, a fault notification of the first actuator group sent by the first communication module of the main controller; wherein the fault notification of the first actuator group is generated and sent to the first communication module after the first brake control module of the main controller detects that the first actuator group fails to execute the first brake command; The power supply instruction issued by the first power supply control module of the main controller is received through the second power supply control module; wherein, the power supply instruction is generated and sent to the first power supply control module after the first brake control module of the main controller detects that the first actuator group fails to successfully execute the first brake instruction.

4. The method according to claim 2, characterized in that The step of responding to the power supply instruction and starting the second actuator group includes: The second power control module responds to the power supply instruction to supply power to the second actuator group to start the second actuator group.

5. The method according to claim 2, characterized in that The sending a second braking instruction to the second actuator group in response to a braking request sent by a driving assistance system based on the fault notification of the first actuator group includes: When the second communication module receives the first actuator failure notification, the second brake control module generates a second braking instruction in response to the braking request sent by the driving assistance system, and sends the second braking instruction to the second actuator group.

6. The method according to any one of claims 1 to 5, characterized in that After sending a second braking instruction to the second actuator group in response to a braking request sent by a driving assistance system based on the fault notification of the first actuator group, the method further includes: detecting an execution result of the second braking instruction and feeding it back to the main controller; the execution result is used by the main controller to determine whether to issue a power-off instruction to the redundant controller; If a power-off instruction is received from the main controller, the second actuator group is stopped.

7. The method according to claim 6, characterized in that The power-off instruction is sent to the redundant controller when the main controller receives an execution result indicating that the second actuator group fails to execute the second braking instruction, or when the main controller does not receive the execution result.

8. A redundant controller based on a vehicle redundant braking system, characterized in that: The vehicle redundant braking system includes a main controller, the redundant controller, a first actuator group controlled by the main controller, and a second actuator group controlled by the redundant controller, and the safety level of the main controller is higher than that of the redundant controller; The redundant controller comprises: a second communication module, configured to receive a fault notification of the first actuator group sent by the main controller; a second power control module, configured to receive a power supply instruction issued by the main controller and, in response to the power supply instruction, activate the second actuator group; wherein the fault notification and the power supply instruction are sent by the main controller after detecting that the first actuator group has failed to successfully execute a first braking instruction, wherein the first braking instruction is sent by the main controller to the first actuator group in response to a braking request sent by a driving assistance system; The second brake control module is configured to send a second brake instruction to the second actuator group based on the fault notification of the first actuator group and in response to the brake request sent by the driving assistance system, so that the second actuator group executes the second brake instruction to control the vehicle.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A vehicle redundant braking system comprising: a main controller, a redundant controller, a first actuator group controlled by the main controller, and a second actuator group controlled by the redundant controller, wherein the main controller has a higher safety level than the redundant controller; the main controller is configured to send a first braking instruction to the first actuator group in response to a braking request sent by a driving assistance system, and upon detecting that the first actuator group fails to execute the first braking instruction, send a fault notification and a power supply instruction for the first actuator group to the redundant controller; The redundant controller is used to receive a fault notification and a power supply instruction of the first actuator group issued by the main controller, and in response to the power supply instruction, start the second actuator group, and based on the fault notification of the first actuator group, respond to the braking request sent by the driving assistance system, send a second braking instruction to the second actuator group, so that the second actuator group executes the second braking instruction to control the vehicle.

Images