Redundant control system diagnostic information control method, system, and electronic parking brake system

Abstract

The application discloses a redundancy control system diagnostic information control method and system and an electronic parking brake system, wherein the redundancy control system diagnostic information control method is applied to a redundancy control system with a completely equivalent main control unit and an auxiliary control unit, a main control main chip is arranged in the main control unit, and an auxiliary control main chip is arranged in the auxiliary control unit. According to the scheme, the diagnostic instruction receiving and response work of two main chips in the control system can be performed by using one diagnostic ID, the takeover and response time is shortened, the preset replacement period is shortened, and the maintenance and replacement frequency is reduced.

Description

Technical Field

[0001] This invention relates to the field of automotive control systems, and more particularly to a method, system, and electronic parking brake system for controlling diagnostic information in redundant control systems. Background Technology

[0002] The global automotive industry is transforming and upgrading towards a deep integration of electrification, intelligence, connectivity, and sharing. Technologies such as intelligent driving, intelligent cockpits, and domain control are booming. Cars are transforming from traditional mechanical products into intelligent mobile terminals, with increasingly diversified driving experiences and functionalities. Simultaneously, safety requirements are becoming increasingly stringent, especially for Level 3 and above autonomous vehicles, where the driving entity shifts from the driver to the vehicle system itself. Therefore, to ensure safety and meet increasingly stringent regulations, redundancy technology is becoming increasingly essential. Redundancy technology, as the name suggests, refers to adding a backup working element or system component that performs the same function to the critical parts of the system. This ensures that if the main working unit fails, the backup unit can immediately take over and ensure the system continues to operate within acceptable limits, thereby improving the overall reliability and safety of the system.

[0003] Currently, redundancy in high-level autonomous driving mainly includes redundancy for monitoring the environment, actuators, communication, power supply, and control systems. The control system can be considered the "brain" of all functional components in a vehicle, and the main chip can be considered the "brain" of the control system itself; therefore, redundancy design for it is of paramount importance. A common redundancy scheme involves a control unit comprising two main chips, MCU_A and MCU_B, with completely equivalent circuitry. These chips operate in master control and auxiliary control modes. Under normal circumstances, the control unit is in master control mode, where MCU_A is active and MCU_B is in a monitoring and waiting state. When MCU_A fails, MCU_B immediately takes over, operating in auxiliary control mode. In both modes, the control unit can control the corresponding system and meet functional requirements.

[0004] However, this solution faces diagnostic challenges due to the two main chips. The system uses two identical main chips as backups for each other, with each chip having its own independent monitoring and diagnostic logic. Therefore, theoretically, two diagnostic IDs are required, which would necessitate two operations during diagnosis and increase the difficulty of developing peripheral diagnostic equipment. However, for an electronic control unit, although two main chips are used, it still functions as a single unit externally. Therefore, only one diagnostic ID is needed for actual diagnosis, and the external response during each diagnosis should meet the ISO 14229 standard, consistent with non-redundant systems.

[0005] In existing safety redundancy systems, only one main chip typically communicates with the external diagnostic tool during normal operation. When this main chip fails, the response process for the other main chip to take over control and communicate with the external diagnostic tool is lengthy. This is especially problematic in control systems related to driving safety, such as electronic parking brake systems, where the fault takeover process needs to be completed within a short timeframe. Summary of the Invention

[0006] Therefore, to solve the above problems, the present invention provides a redundant control system diagnostic information control method, system, and electronic parking brake system.

[0007] This invention is achieved through the following technical solution: A diagnostic information control method for redundant control systems, applied to redundant control systems with fully equivalent master control units and auxiliary control units, wherein the master control unit contains a master control chip and the auxiliary control unit contains an auxiliary control chip, comprising the following steps: Both the main control chip and the auxiliary control chip simultaneously receive diagnostic commands from an external diagnostic instrument. Both the main control chip and the auxiliary control chip simultaneously determine whether they have malfunctioned. When both the main control chip and the auxiliary control chip are fault-free, the main control chip responds to the external diagnostic instrument through external communication, and at the same time transmits the corresponding fault status bit information to the auxiliary control chip through internal communication. The auxiliary control chip sets the corresponding fault status bit. When the main control chip fails, the auxiliary control chip takes over control and responds to the external diagnostic tool through external communication. The auxiliary control chip generates fault information of the main control chip based on the fault status of the main control chip. When the auxiliary control chip malfunctions, the main control chip still responds to the external diagnostic tool through external communication, and generates auxiliary control chip fault information based on the fault status of the auxiliary control chip.

[0008] Preferably, the phrase "when the main control chip malfunctions, the auxiliary control chip takes over control and responds to the external diagnostic instrument via external communication; the auxiliary control chip generates main control chip fault information based on the main control chip's fault status" includes: When the main control chip fails but communication is still possible, the main control chip sends the control enable signal and the main control chip fault signal to the auxiliary control chip through internal communication. The auxiliary control chip directly takes over the system and responds to the external diagnostic instrument through external communication, while generating the main control chip fault information. When the main control chip is completely paralyzed, the auxiliary control chip monitors the main control heartbeat signal through internal communication and, after it stops, automatically enables the control signal and takes over the system. It then responds to the external diagnostic instrument through external communication and generates fault information for the main control chip.

[0009] Preferably, the statement that "when the auxiliary control chip malfunctions, the main control chip still responds to the external diagnostic instrument via external communication, and the main control chip generates auxiliary control chip fault information based on the auxiliary control chip's fault status" includes: When the auxiliary control chip can still communicate, the main control chip responds to the external diagnostic instrument through external communication. At the same time, the auxiliary control chip feeds back the auxiliary control chip fault signal to the main control chip through internal communication. The main control chip generates auxiliary control chip fault information based on the received auxiliary control chip fault signal. When the auxiliary control chip is completely paralyzed, the main control chip responds to the external diagnostic instrument through external communication. At the same time, the main control chip monitors the auxiliary control chip's heartbeat signal through internal communication and automatically generates auxiliary control chip fault information.

[0010] Preferably, the "diagnostic instructions issued by the external diagnostic instrument" further includes special diagnostic instructions, which include secure access instructions. If both the main control chip and the auxiliary control chip are fault-free, when the external diagnostic instrument issues a secure access instruction, it includes the following steps: Both the main control chip and the auxiliary control chip received the request seed command sent by the external diagnostic instrument; The auxiliary control chip remains silent, while the main control chip generates a seed and then responds to the external diagnostic instrument via external communication. After receiving the seed, the external diagnostic instrument calculates the key and sends the key to the main control chip via external communication. The main control chip verifies the key. If the verification is successful, it responds positively to the external diagnostic instrument through external communication and transmits the positive status to the auxiliary control chip through internal communication. If the main control chip fails to verify the key, it responds negatively to the diagnostic instrument through external communication and transmits the negative status to the auxiliary control chip through internal communication. The auxiliary control chip sets the security verification flag based on the status transmitted through the internal communication of the main control chip. If it is in an active state, it is set to 1 to indicate that the security verification has passed; if it is in a passive state, it is set to 0 to indicate that the security verification has failed. The initial value is 0.

[0011] Preferably, the "diagnostic instructions issued by the external diagnostic instrument" further includes special diagnostic instructions, which include routine control instructions. If both the main control chip and the auxiliary control chip are fault-free, when the external diagnostic instrument issues routine control instructions, it includes the following steps: Both the main control chip and the auxiliary control chip received routine control requests sent by the external diagnostic instrument; The main control chip independently outputs control commands to the peripheral circuits; The peripheral circuits receive control commands and respond to them, while the main control chip monitors the response status and whether the routine control is completed. After receiving the external control results, the main control chip responds to the external diagnostic instrument.

[0012] Preferably, the "diagnostic instructions issued by the external diagnostic instrument" further includes special diagnostic instructions, which include instructions to write information to the control unit. If both the main control chip and the auxiliary control chip are fault-free, when the external diagnostic instrument issues the instructions to write information to the control unit, it includes the following steps: Both the main control chip and the auxiliary control chip received a request from the external diagnostic instrument to write information to the control unit; Both the main control chip and the auxiliary control chip are written with data sent by the diagnostic instrument; After the write is completed, the auxiliary control chip will feed back the write status to the main control chip through internal communication. The main control chip will verify the status based on its own status. If both the main control chip and the auxiliary control chip have successfully written, the chip will actively respond to the external diagnostic instrument through external communication; otherwise, it will respond passively.

[0013] Preferably, the "diagnostic instructions issued by the external diagnostic instrument" further includes special diagnostic instructions, which include control unit software download instructions. If both the main control chip and the auxiliary control chip are fault-free, when the external diagnostic instrument issues the control unit software download instructions, it includes the following steps: Both the main control chip and the auxiliary control chip received the control unit software download request sent by the external diagnostic instrument; Both the main control chip and the auxiliary control chip download the program transmitted by the diagnostic instrument; After the download is complete, the auxiliary control chip feeds back the status to the main control chip through internal communication. The main control chip verifies its own status. If both the main control chip and the auxiliary control chip have successfully downloaded the data, they will actively respond to the external diagnostic instrument through external communication; otherwise, they will respond passively.

[0014] Preferably, the "diagnostic instructions issued by the external diagnostic instrument" further includes special diagnostic instructions, which include instructions to read fault codes. If both the main control chip and the auxiliary control chip are fault-free, when the external diagnostic instrument issues an instruction to read fault codes, it includes the following steps: Both the main control chip and the auxiliary control chip received a request from the external diagnostic instrument to read fault codes; The auxiliary control chip sends its fault codes and auxiliary control unit fault status information to the main control chip through internal communication. The main control chip receives fault codes and fault status information of auxiliary control units from the auxiliary control chip, and compares the fault status information of auxiliary control units with that of the main control unit. If there is no overlap in faults, all fault information is reported to the external diagnostic instrument through external communication. If there is overlap in faults, the number of occurrences of the faults is accumulated and then reported to the external diagnostic instrument through external communication.

[0015] The redundant control system applies the redundant control system diagnostic information control method described above.

[0016] The electronic parking brake system utilizes the redundant control system diagnostic information control method described above.

[0017] The beneficial effects of the technical solution of this invention are mainly reflected in: 1. For redundant control systems with dual master chips, a single diagnostic ID can be used to receive and respond to diagnostic commands from both master chips in the control system. This avoids the operational complexity and difficulty in developing external diagnostic equipment caused by using two separate diagnostic IDs to control the two master chips. It also reduces the development workload of other systems in the vehicle and the development workload of the diagnostic module.

[0018] 2. This invention addresses the redundant control system with dual main chips, requiring the external response of each diagnostic test to meet the ISO14229 standard, consistent with the requirements of non-redundant systems. For certain special diagnostic commands input from external diagnostic instruments to the two internal main chips, different internal processing methods are proposed to ensure that the external diagnostic response of the control unit can meet the standard requirements.

[0019] 3. Both main chips simultaneously receive diagnostic commands from an external diagnostic instrument. When one main chip malfunctions, the other main chip can immediately take over control and receive the fault information from the malfunctioning main chip, shortening the takeover and response time. This is especially beneficial for electronic parking brake systems that involve driving safety, improving safety and preventing traffic accidents caused by untimely responses. Attached Figure Description

[0020] Figure 1 This is a schematic diagram of the control status of diagnostic information when both the main control chip and the auxiliary control chip are fault-free in a redundant control system. Figure 2 This is a schematic diagram of the information control status under a secure access command in a redundant control system; Figure 3 This is a schematic diagram of information control status under routine control commands in a redundant control system; Figure 4 This is a schematic diagram of the information control state under the instruction to write information to the control unit in a redundant control system; Figure 5 This is a schematic diagram of the information control status under the software download command of the control unit in a redundant control system; Figure 6 This is a schematic diagram of the information control status under diagnostic command 19 in a redundant control system. Figure 7 This is a flowchart illustrating the handling method of the redundancy control system diagnostic information control method when the main control fails. Figure 8 This is a flowchart illustrating the handling method of auxiliary control system failure in the diagnostic information control method of redundant control systems. Detailed Implementation

[0021] To make the objectives, advantages, and features of the present invention clearer and more detailed, the following non-limiting description of preferred embodiments will be illustrated and explained. These embodiments are merely typical examples of applying the technical solutions of the present invention; all technical solutions formed by equivalent substitutions or equivalent transformations fall within the scope of protection claimed by the present invention.

[0022] It should also be noted that in the description of the solution, the terms "center", "upper", "lower", "left", "right", "front", "rear", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of description and simplification, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the present invention.

[0023] Furthermore, the terms "first" and "second" in this invention are used for descriptive purposes only and should not be construed as indicating or implying a ranking of importance, or implicitly specifying the number of technical features shown. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0024] This invention discloses a diagnostic information control method for redundant control systems, such as... Figure 1 , Figure 7 , Figure 8 As shown, this is applied to a redundant control system with fully equivalent main control unit and auxiliary control unit, wherein the main control unit contains a main control chip and the auxiliary control unit contains an auxiliary control chip, and includes the following steps: Both the main control chip and the auxiliary control chip simultaneously receive diagnostic commands from an external diagnostic instrument. Both the main control chip and the auxiliary control chip simultaneously determine whether they have malfunctioned. When both the main control chip and the auxiliary control chip are fault-free, the main control chip responds to the external diagnostic instrument through external communication, and at the same time transmits the corresponding fault status bit information to the auxiliary control chip through internal communication. The auxiliary control chip sets the corresponding fault status bit. When the main control chip fails, the auxiliary control chip takes over control and responds to the external diagnostic tool through external communication. The auxiliary control chip generates fault information of the main control chip based on the fault status of the main control chip. When the auxiliary control chip malfunctions, the main control chip still responds to the external diagnostic tool through external communication, and generates auxiliary control chip fault information based on the fault status of the auxiliary control chip.

[0025] The external communication between the external diagnostic instrument and the main / auxiliary control chip, as well as the internal communication between the main and auxiliary control chips within the control system, all use the CAN communication protocol. In some embodiments, the CAN communication protocol may include, but is not limited to, CAN2.0A, CAN2.0B, and CAN-FD (CAN flexible data rate). For control units with higher transmission rate requirements, other communication networks may also be used, including but not limited to FlexRay, Ethernet, radio access technology (RAN), and wireless local area networks (WLAN). It should be noted that regardless of the communication protocol, it is all a communication carrier for implementing the dual-chip diagnostic mechanism of this invention and does not affect the core content of the diagnostic mechanism. Therefore, anyone skilled in this art can adopt different communication protocols to implement the functions described in this invention without departing from the spirit and scope of this application, but this should still be covered by the claims of this application. As for the principles and formats of different communication protocols, they belong to the standardization content of the automotive industry and will not be elaborated upon in this invention.

[0026] In some embodiments, the phrase "when the main control chip malfunctions, the auxiliary control chip takes over control and responds to the external diagnostic tool via external communication, and the auxiliary control chip generates main control chip fault information based on the main control chip's fault status" includes: When the main control chip fails but communication is still possible, the main control chip sends the control enable signal and the main control chip fault signal to the auxiliary control chip through internal communication. The auxiliary control chip directly takes over the system and responds to the external diagnostic instrument through external communication, while generating the main control chip fault information. When the main control chip is completely paralyzed, the auxiliary control chip monitors the main control heartbeat signal through internal communication and, after it stops, automatically enables the control signal and takes over the system. It then responds to the external diagnostic instrument through external communication and generates fault information for the main control chip.

[0027] In some embodiments, the statement that "when the auxiliary control chip malfunctions, the main control chip still responds to the external diagnostic tool via external communication, and the main control chip generates auxiliary control chip fault information based on the auxiliary control chip's fault status" includes: When the auxiliary control chip can still communicate, the main control chip responds to the external diagnostic instrument through external communication. At the same time, the auxiliary control chip feeds back the auxiliary control chip fault signal to the main control chip through internal communication. The main control chip generates auxiliary control chip fault information based on the received auxiliary control chip fault signal. When the auxiliary control chip is completely paralyzed, the main control chip responds to the external diagnostic instrument through external communication. At the same time, the main control chip monitors the auxiliary control chip's heartbeat signal through internal communication and automatically generates auxiliary control chip fault information.

[0028] In some embodiments, the "diagnostic instructions issued by the external diagnostic instrument" further includes special diagnostic instructions, which include the following embodiments: Example 1: like Figure 2 As shown, the special diagnostic instructions include secure access instructions. If both the main control chip and the auxiliary control chip are fault-free, when the external diagnostic instrument issues a secure access instruction, it includes the following steps: Both the main control chip and the auxiliary control chip received the request seed command sent by the external diagnostic instrument; The auxiliary control chip remains silent, while the main control chip generates a seed and then responds to the external diagnostic instrument via external communication. After receiving the seed, the external diagnostic instrument calculates the key and sends the key to the main control chip via external communication. The main control chip verifies the key. If the verification is successful, it responds positively to the external diagnostic instrument through external communication and transmits the positive status to the auxiliary control chip through internal communication. If the main control chip fails to verify the key, it responds negatively to the diagnostic instrument through external communication and transmits the negative status to the auxiliary control chip through internal communication. The auxiliary control chip sets the security verification flag based on the status transmitted through the internal communication of the main control chip. If it is in an active state, it is set to 1 to indicate that the security verification has passed; if it is in a passive state, it is set to 0 to indicate that the security verification has failed. The initial value is 0.

[0029] In some embodiments, when the main control chip malfunctions, the diagnosis of the secure access command includes the following steps: When the main control chip fails but communication is still possible: Both the main control chip and the auxiliary control chip simultaneously receive the request seed command sent by the external diagnostic instrument; The main control chip sends the control enable signal and the main control chip fault signal to the auxiliary control chip through internal communication. The auxiliary control chip receives the control enable signal and the main control chip fault signal, takes over the control, and generates the main control chip fault information. The auxiliary control chip generates a seed and then responds to the external diagnostic instrument via external communication. After receiving the seed, the external diagnostic instrument calculates the key and sends the key to the auxiliary control chip via external communication. The auxiliary control chip verifies the key. If the verification is successful, it responds positively to the external diagnostic instrument through external communication and transmits the positive status to the main control chip through internal communication. If the auxiliary control chip fails to verify the key, it responds negatively to the diagnostic instrument through external communication and transmits the negative status to the main control chip through internal communication. The auxiliary control chip sets the security verification flag based on the status transmitted through the internal communication of the main control chip. If it is in an active state, it is set to 1 to indicate that the security verification has passed; if it is in a passive state, it is set to 0 to indicate that the security verification has failed. The initial value is 0.

[0030] When the main control chip is completely disabled: The auxiliary control chip receives a request seed command sent by an external diagnostic instrument; When the auxiliary control chip detects that the main control heartbeat signal has stopped, the auxiliary control chip automatically enables the control signal, takes over the system, and generates fault information for the main control chip. The auxiliary control chip generates a seed and then responds to the external diagnostic instrument via external communication. After receiving the seed, the external diagnostic instrument calculates the key and sends the key to the auxiliary control chip via external communication. The auxiliary control chip verifies the key. If the verification is successful, it actively responds to the external diagnostic instrument through external communication. If the verification fails, it passively responds to the diagnostic instrument through external communication.

[0031] In some embodiments, when the secondary control chip malfunctions, the diagnosis of the secure access command includes the following steps: When the auxiliary control main chip fails but communication is still possible: The steps are the same as in Example 1 above.

[0032] When the auxiliary control main chip is completely disabled: The main control chip receives a request seed command sent by an external diagnostic instrument; The main control chip detected that the heartbeat signal of the auxiliary control chip had stopped. The main control chip generates a seed and then responds to the external diagnostic instrument via external communication. After receiving the seed, the external diagnostic instrument calculates the key and sends the key to the main control chip via external communication. The main control chip verifies the key. If the verification is successful, it actively responds to the external diagnostic instrument through external communication. If the main control chip fails to verify the key, it passively responds to the diagnostic instrument through external communication.

[0033] Example 2: like Figure 3 As shown, the special diagnostic instructions include routine control instructions. If both the main control chip and the auxiliary control chip are fault-free, when the external diagnostic instrument issues a routine control instruction, it includes the following steps: Both the main control chip and the auxiliary control chip received routine control requests sent by the external diagnostic instrument; The main control chip independently outputs control commands to the peripheral circuits; The peripheral circuits receive control commands and respond to them, while the main control chip monitors the response status and whether the routine control is completed. After receiving the external control results, the main control chip responds to the external diagnostic instrument.

[0034] In some embodiments, when the main control chip malfunctions, the diagnosis of the routine control instructions includes the following steps: When the main control chip fails but communication is still possible: Both the main control chip and the auxiliary control chip received routine control requests sent by the external diagnostic instrument; The main control chip feeds back the control enable signal and the main control chip fault signal to the auxiliary control chip through internal communication. After receiving the control enable signal and the main control chip fault signal, the auxiliary control chip takes over the control and generates the main control chip fault information. The auxiliary control chip independently outputs control commands to the peripheral circuits; The peripheral circuit receives control commands and responds, while the auxiliary control chip monitors the response status and whether the routine control is completed. After receiving the external control results, the auxiliary control main chip responds to the external diagnostic instrument.

[0035] When the main control chip is completely disabled: Both the auxiliary control main chip and the auxiliary control main chip receive routine control requests sent by the external diagnostic instrument; When the auxiliary control chip detects that the main control heartbeat signal has stopped, the auxiliary control chip automatically enables the control signal and takes over the system, while generating fault information for the main control chip. The auxiliary control chip independently outputs control commands to the peripheral circuits; The peripheral circuit receives control commands and responds, while the auxiliary control chip monitors the response status and whether the routine control is completed. After receiving the external control results, the auxiliary control main chip responds to the external diagnostic instrument.

[0036] In other embodiments, when the auxiliary control chip malfunctions, the diagnostic steps of the routine control instructions are the same as in Embodiment 2 above.

[0037] Example 3: like Figure 4As shown, the special diagnostic instructions include control unit write information instructions, which are written data services via data identifiers (DIDs). If both the main control chip and the auxiliary control chip are fault-free, when the external diagnostic instrument issues a control unit write information instruction, it includes the following steps: Both the main control chip and the auxiliary control chip received a request from the external diagnostic instrument to write information to the control unit; Both the main control chip and the auxiliary control chip are written with data sent by the diagnostic instrument; After the write is completed, the auxiliary control chip will feed back the write status to the main control chip through internal communication. The main control chip will verify the status based on its own status. If both the main control chip and the auxiliary control chip have successfully written, the chip will actively respond to the external diagnostic instrument through external communication; otherwise, it will respond passively.

[0038] In other embodiments, when the main control chip / auxiliary control chip fails, a negative response is made if one of the main chips fails to write successfully.

[0039] Example 4: like Figure 5 As shown, the special diagnostic command includes a control unit software download command. If both the main control chip and the auxiliary control chip are fault-free, when the external diagnostic instrument issues the control unit software download command, it includes the following steps: Both the main control chip and the auxiliary control chip received the control unit software download request sent by the external diagnostic instrument; Both the main control chip and the auxiliary control chip download the program transmitted by the diagnostic instrument; After the download is complete, the auxiliary control chip feeds back the status to the main control chip through internal communication. The main control chip verifies its own status. If both the main control chip and the auxiliary control chip have successfully downloaded the data, they will actively respond to the external diagnostic instrument through external communication; otherwise, they will respond passively.

[0040] In other embodiments, when the main control chip / auxiliary control chip fails, a passive response is performed if one of the main chips fails to download successfully.

[0041] Example 5: like Figure 6 As shown, the special diagnostic instructions include fault code reading instructions. If both the main control chip and the auxiliary control chip are fault-free, when the external diagnostic instrument issues a fault code reading instruction, it includes the following steps: Both the main control chip and the auxiliary control chip received a request from the external diagnostic instrument to read fault codes; The auxiliary control main chip sends the auxiliary control unit fault code and auxiliary control unit fault status information to the main control main chip through internal communication. The main control chip receives the auxiliary control unit fault codes and auxiliary control unit fault status information sent by the auxiliary control chip, and compares the auxiliary control unit fault status information with the main control unit fault status information. If there is no overlap in the faults, all fault information is reported to the external diagnostic instrument through external communication. If there is overlap in the faults, the number of occurrences of the faults is accumulated and then reported to the external diagnostic instrument through external communication.

[0042] In some embodiments, when the main control chip fails, the following steps are included: When the main control chip can still communicate: Both the main control chip and the auxiliary control chip received a request from the external diagnostic instrument to read fault codes; The main control chip sends the main control unit fault code, control enable signal, main control chip fault signal and main control unit fault status information to the auxiliary control chip through internal communication. The auxiliary control chip takes over the system, receives the main control unit fault code and main control unit fault status information and generates main control chip fault information. The auxiliary control chip compares the fault status information of the main control unit with that of the auxiliary control unit. If there is no overlap in the faults, all fault information is reported to the external diagnostic instrument through external communication. If there is overlap in the faults, the number of occurrences of the faults is accumulated and then reported to the external diagnostic instrument through external communication.

[0043] When the main control chip is completely disabled: The auxiliary control chip receives a request from an external diagnostic instrument to read fault codes; When the auxiliary control chip detects that the main control heartbeat signal has stopped, the auxiliary control chip automatically enables the control signal and takes over the system, while generating fault information for the main control chip. The auxiliary control chip directly reports the auxiliary control unit fault status information and the generated main control chip fault information to the external diagnostic instrument through external communication, and reads the main control unit fault status information sent by the external diagnostic instrument through external communication.

[0044] In other embodiments, when the auxiliary control fails, the following steps are included: When the auxiliary control main chip can still communicate: The steps are the same as in Example 1 above.

[0045] When the auxiliary control main chip is completely disabled: The main control chip receives a request from an external diagnostic tool to read fault codes; The main control chip detects that the heartbeat signal of the auxiliary control chip has stopped and automatically generates fault information for the auxiliary control chip. The main control chip automatically generates fault information of the auxiliary control chip and fault status information of the main control unit, and reports them to the external diagnostic instrument through external communication. It also reads the fault status information of the auxiliary control unit sent by the external diagnostic instrument through external communication.

[0046] This invention also discloses a redundant control system, and a diagnostic information control method for the redundant control system as described above.

[0047] This invention also discloses an electronic parking brake system that uses the redundant control system diagnostic information control method described above.

[0048] In some embodiments, the electronic parking brake system includes a first control unit and a fully equivalent second control unit. The first control unit includes a main control chip, and the second control unit includes an auxiliary control chip. The first control unit is electrically connected to a first parking actuator to achieve parking. The second control unit is electrically connected to a second parking actuator to achieve parking. The second control unit serves as a backup control unit for the first control unit, and the second parking actuator serves as a backup parking actuator for the first parking actuator. The control system diagnostic information control method of the electronic parking brake system is as described above. In other embodiments, the first control unit and the second control unit may also control multiple parking actuators respectively, and the parking actuators controlled by the two units are not the same, thereby ensuring that when one control unit or the parking actuator connected to that control unit fails, the other control unit and the parking actuator it controls can complete the parking brake.

[0049] This invention has many other embodiments, and all technical solutions formed by equivalent transformation or equivalent transformation fall within the protection scope of this invention.

Claims

1. A diagnostic information control method for redundant control systems, applied to redundant control systems with fully equivalent main control units and auxiliary control units, wherein the main control unit contains a main control chip and the auxiliary control unit contains an auxiliary control chip, characterized in that: Includes the following steps: Both the main control chip and the auxiliary control chip simultaneously receive diagnostic commands from an external diagnostic instrument. Both the main control chip and the auxiliary control chip simultaneously determine whether they have malfunctioned. When both the main control chip and the auxiliary control chip are fault-free, the main control chip responds to the external diagnostic instrument through external communication, and at the same time transmits the corresponding fault status bit information to the auxiliary control chip through internal communication. The auxiliary control chip sets the corresponding fault status bit. When the main control chip fails, the auxiliary control chip takes over control and responds to the external diagnostic tool through external communication. The auxiliary control chip generates fault information of the main control chip based on the fault status of the main control chip. When the auxiliary control chip malfunctions, the main control chip still responds to the external diagnostic tool through external communication, and the main control chip generates auxiliary control chip fault information based on the fault status of the auxiliary control chip. The "diagnostic instructions issued by the external diagnostic instrument" also include special diagnostic instructions, which include secure access instructions. If both the main control chip and the auxiliary control chip are fault-free, when the external diagnostic instrument issues a secure access instruction, it includes the following steps: Both the main control chip and the auxiliary control chip received the request seed command sent by the external diagnostic instrument; The auxiliary control chip remains silent, while the main control chip generates a seed and then responds to the external diagnostic instrument via external communication. After receiving the seed, the external diagnostic instrument calculates the key and sends the key to the main control chip via external communication. The main control chip verifies the key. If the verification is successful, it responds positively to the external diagnostic instrument through external communication and transmits the positive status to the auxiliary control chip through internal communication. If the main control chip fails to verify the key, it responds negatively to the diagnostic instrument through external communication and transmits the negative status to the auxiliary control chip through internal communication. The auxiliary control chip sets the security verification flag based on the status transmitted through internal communication of the main control chip. In an active state, the flag is set to 1 to indicate successful security verification; in a passive state, it is set to 0 to indicate failed security verification. The initial value is 0. The "diagnostic instructions issued by the external diagnostic instrument" also includes special diagnostic instructions, which include routine control instructions. If both the main control chip and the auxiliary control chip are fault-free, when the external diagnostic instrument issues routine control instructions, it includes the following steps: Both the main control chip and the auxiliary control chip received routine control requests sent by the external diagnostic instrument; The main control chip independently outputs control commands to the peripheral circuits; The peripheral circuits receive control commands and respond to them, while the main control chip monitors the response status and whether the routine control is completed. After receiving the external control results, the main control chip responds to the external diagnostic instrument; The "diagnostic instructions issued by the external diagnostic instrument" also include special diagnostic instructions, which include instructions to write information to the control unit. If both the main control chip and the auxiliary control chip are fault-free, when the external diagnostic instrument issues the instruction to write information to the control unit, it includes the following steps: Both the main control chip and the auxiliary control chip received a request from the external diagnostic instrument to write information to the control unit; Both the main control chip and the auxiliary control chip are written with data sent by the diagnostic instrument; After the writing is completed, the auxiliary control chip will feed back the writing status to the main control chip through internal communication. The main control chip will verify the status based on its own status. If both the main control chip and the auxiliary control chip have successfully written, the chip will actively respond to the external diagnostic instrument through external communication; otherwise, it will respond passively. The "diagnostic instructions issued by the external diagnostic instrument" also include special diagnostic instructions, which include control unit software download instructions. If both the main control chip and the auxiliary control chip are fault-free, when the external diagnostic instrument issues the control unit software download instructions, it includes the following steps: Both the main control chip and the auxiliary control chip received the control unit software download request sent by the external diagnostic instrument; Both the main control chip and the auxiliary control chip download the program transmitted by the diagnostic instrument; After the download is complete, the auxiliary control chip feeds back the status to the main control chip through internal communication. The main control chip verifies its own status. If both the main control chip and the auxiliary control chip have successfully downloaded the data, they will actively respond to the external diagnostic instrument through external communication; otherwise, they will respond passively. The "diagnostic instructions issued by the external diagnostic instrument" also include special diagnostic instructions, which include instructions to read fault codes. If both the main control chip and the auxiliary control chip are fault-free, when the external diagnostic instrument issues an instruction to read fault codes, it includes the following steps: Both the main control chip and the auxiliary control chip received a request from the external diagnostic instrument to read fault codes; The auxiliary control chip sends its fault codes and auxiliary control unit fault status information to the main control chip through internal communication. The main control chip receives fault codes and fault status information of auxiliary control units from the auxiliary control chip, and compares the fault status information of auxiliary control units with that of the main control unit. If there is no overlap in faults, all fault information is reported to the external diagnostic instrument through external communication. If there is overlap in faults, the number of occurrences of the faults is accumulated and then reported to the external diagnostic instrument through external communication.

2. The redundant control system diagnostic information control method according to claim 1, characterized in that: The phrase "when the main control chip malfunctions, the auxiliary control chip takes over control and responds to the external diagnostic tool via external communication; the auxiliary control chip generates main control chip fault information based on the main control chip's fault status" includes: When the main control chip fails but communication is still possible, the main control chip sends the control enable signal and the main control chip fault signal to the auxiliary control chip through internal communication. The auxiliary control chip directly takes over the system and responds to the external diagnostic instrument through external communication, while generating the main control chip fault information. When the main control chip is completely paralyzed, the auxiliary control chip monitors the main control heartbeat signal through internal communication and, after it stops, automatically enables the control signal and takes over the system. It then responds to the external diagnostic instrument through external communication and generates fault information for the main control chip.

3. The redundant control system diagnostic information control method according to claim 1, characterized in that: The statement that "when the auxiliary control chip malfunctions, the main control chip still responds to the external diagnostic tool via external communication, and the main control chip generates auxiliary control chip fault information based on the auxiliary control chip's fault status" includes: When the auxiliary control chip can still communicate, the main control chip responds to the external diagnostic instrument through external communication. At the same time, the auxiliary control chip feeds back the auxiliary control chip fault signal to the main control chip through internal communication. The main control chip generates auxiliary control chip fault information based on the received auxiliary control chip fault signal. When the auxiliary control chip is completely paralyzed, the main control chip responds to the external diagnostic instrument through external communication. At the same time, the main control chip monitors the auxiliary control chip's heartbeat signal through internal communication and automatically generates auxiliary control chip fault information.

4. A redundant control system, characterized in that: The redundant control system diagnostic information control method as described in any one of claims 1-3 is applied.

5. An electronic parking brake system, characterized in that: The redundant control system diagnostic information control method as described in any one of claims 1-3 is applied.

Images