Method for fail-safe degradation of internal communication in a fully redundant electric power steering system

Abstract

The application discloses a kind of full redundancy electric power steering system internal communication fail-safe degradation method, the full redundancy electric power steering system includes main road system, auxiliary road system and 6-phase motor, and 3-phase of 6-phase motor is controlled by main road system and auxiliary road system respectively;The main road system and auxiliary road system carry out real-time information interaction by six communication channels, and communication channel includes UART serial communication channel, private CAN communication channel and PWM communication channel, and UART serial communication channel, private CAN communication channel and PWM communication channel are divided into TX channel and RX channel respectively, TX channel is transmission channel, and RX channel is receiving channel;The full redundancy electric power steering system changes the working mode of full redundancy electric power steering system according to the fault of six different communication channels;The level of the working mode includes mode 0, mode 1, mode 2, mode 3, mode 4 and mode 5 in turn from high to low.

Description

Methods for Degrading the Safety of Internal Communication Failures in Fully Redundant Electric Power Steering Systems Technical Field

[0001] This invention relates to the field of automotive electric power steering system control technology, and in particular to a method for safety degradation in the internal communication failure of a fully redundant electric power steering system. Background Technology

[0002] Lateral movement of a vehicle is achieved by the driver turning the steering wheel or by the host computer system requesting the steering system to actively control the steering wheels, enabling the vehicle to move laterally easily and responsively along a predetermined trajectory. The vehicle's steering system is fundamental to achieving lateral stability control and ensuring safe driving, and is also a key technology for enabling assisted driving or autonomous driving functions. Traditional electric power steering systems can only support driver-in-the-loop manual driving or low-level assisted intelligent driving in terms of functional safety. With the increasing market demand for higher-level autonomous driving, the steering system must both reduce the driver's workload and ensure safe vehicle operation to prevent traffic accidents. Therefore, higher-level autonomous driving poses a greater challenge to the functional safety of the steering system, and a fully redundant electric power steering system is the most effective way to improve functional safety. As the name suggests, a fully redundant electric power steering system refers to an automotive electric steering system that employs a completely redundant hardware architecture and maintains independent calculation and collaborative control in its software control strategy. Even in fully autonomous driving scenarios, if a single point of failure occurs in the steering system, the entire steering system will enter backup system control, preventing the loss of steering assistance and ensuring the safe operation of the vehicle, thus guaranteeing that the vehicle is always in a safe operating state.

[0003] For a fully redundant electric power steering system, maintaining coordinated control between the primary and auxiliary systems to ensure steering performance relies on their mutual communication. Currently, the internal communication between the primary and auxiliary systems employs various communication methods based on the characteristics of the interaction signals. However, from a hardware architecture perspective, this internal communication is still non-redundant. Therefore, the internal communication of the primary and auxiliary systems serves as both the bridge for collaborative control between the two systems and a weak point in the entire redundant steering system. The internal communication between the primary and auxiliary systems includes fast, slow, and synchronous channels. Each system performs fault diagnosis on the received information and designs different safety degradation strategies for different failure modes based on the diagnosed fault type and the potential impact of the failure. If a communication failure occurs within the primary and auxiliary systems, the entire steering system needs to be able to quickly and reasonably degrade to a safer state while maintaining the availability of the steering system and preserving electric power steering functionality as much as possible.

[0004] In redundant steering systems, safety degradation can be divided into two main categories: minor faults, where the entire steering system still provides maximum steering assistance; and severe faults, where the entire steering system only provides half of its maximum steering assistance. The internal communication between the primary and auxiliary systems utilizes multiple communication channels designed according to different signal characteristics. After an internal communication failure occurs, analyzing the potential failure risks arising from different communication failures determines the safety degradation strategy, ensuring the best balance between the safety and availability of the redundant steering system. Therefore, developing a reasonable and correct communication scheme for the primary and auxiliary systems and a fault diagnosis degradation strategy is crucial. Summary of the Invention

[0005] The purpose of this invention is to establish an internal communication scheme for the main and auxiliary control systems of a fully redundant electric power steering system, and to design a safety degradation strategy after the failure of the internal communication between the main and auxiliary systems based on the system characteristics. This ensures that the fully redundant electric power steering system can enter a safe operating state and maintain the availability of the steering system as much as possible after the failure of the internal communication between the main and auxiliary systems, thereby ensuring the driving safety of the vehicle.

[0006] To solve the above technical problems, the present invention provides a method for safe degradation of internal communication failure in a fully redundant electric power steering system. The fully redundant electric power steering system includes a main road system, an auxiliary road system, and a 6-phase motor. The main road system and the auxiliary road system control 3 phases of the 6-phase motor, respectively.

[0007] The main road system and the auxiliary road system exchange information in real time through six communication channels, including UART serial communication channel, private CAN communication channel and PWM communication channel. Each of the UART serial communication channel, private CAN communication channel and PWM communication channel is divided into TX channel and RX channel. The TX channel is the transmitting channel and the RX channel is the receiving channel.

[0008] The fully redundant electric power steering system changes its operating mode based on the fault control of six different communication channels.

[0009] The working modes are ranked from highest to lowest as follows: Mode 0, Mode 1, Mode 2, Mode 3, Mode 4, and Mode 5.

[0010] Preferably, mode 0 indicates that there is no fault in the main road system and the auxiliary road system; mode 1 indicates that there is no fault in the main road system, but the computing power of the auxiliary road system is lost; mode 2 indicates that the computing power of the main road system is lost, but the auxiliary road system is not faulty; mode 3 indicates that the execution and computing power of the auxiliary road system is lost, but the main road system is not faulty; mode 4 indicates that the execution and computing power of the main road system is lost, but the auxiliary road system is not faulty; and mode 5 indicates that the execution and computing power of both the main road system and the auxiliary road system are lost.

[0011] Preferably, when the operating mode is mode 0, if the UART serial communication TX channel or the PWM communication TX channel fails, the control operating mode is changed to mode 2; if the private CAN communication TX channel, the UART serial communication TX channel, and the PWM communication TX channel all fail, the control operating mode is changed to mode 4; if the private CAN communication RX channel, the UART serial communication RX channel, and the PWM communication RX channel all fail, the control operating mode is changed to mode 3.

[0012] Preferably, when the working mode is mode 1, if the UART serial communication TX channel or the PWM communication TX channel fails, the control working mode is changed to mode 3; if the private CAN communication TX channel, the UART serial communication TX channel and the PWM communication TX channel all fail, the control working mode is changed to mode 5; if the private CAN communication RX channel, the UART serial communication RX channel and the PWM communication RX channel all fail, the control working mode is changed to mode 3.

[0013] Preferably, when the working mode is mode 2, if the UART serial communication RX channel or the PWM communication RX channel fails, the control working mode is changed to mode 4; if the private CAN communication TX channel, the UART serial communication TX channel and the PWM communication TX channel all fail, the control working mode is changed to mode 4; if the private CAN communication RX channel, the UART serial communication RX channel and the PWM communication RX channel all fail, the control working mode is changed to mode 5.

[0014] Preferably, the failure modes of the communication channel include at least one of information reception timeout, consistency corruption, length mismatch, or value out of range.

[0015] Preferably, the UART serial communication channel is used to transmit torque signals, angle signals, system operating status signals, power assist request signals, or steering assist torque distribution signals.

[0016] Preferably, the private CAN communication channel is used to transmit vehicle speed, wheel speed, or host computer commands.

[0017] Preferably, the PWM communication channel is used to transmit synchronization control signals between the main system and the auxiliary system.

[0018] The technical advantages of this invention are: it proposes a safety degradation method for internal communication failures in a fully redundant electric power steering system. This scheme utilizes a combination of three internal communication technologies—UART / SPI, private CAN, and PWM—based on the characteristics of information exchange between the main and auxiliary systems. Furthermore, it comprehensively determines the safety degradation strategy for communication failures in the fully redundant steering system based on different operating modes of the redundant steering system and the communication diagnostic results of both the main and auxiliary systems. Through this strategy, after an internal communication failure occurs in the main and auxiliary systems, the redundant steering system can quickly enter a safe state, ensuring safe vehicle operation, while simultaneously maximizing its availability to continue supporting vehicle steering control. This ensures a balance between the safety, robustness, and maximum availability of the fully redundant power steering system. Attached Figure Description

[0019] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments:

[0020] Figure 1 is a simplified structural diagram of a dual pinion / parallel shaft electric power steering system;

[0021] Figure 2 is a schematic diagram of the working principle of a master-slave fully redundant electric power steering system that supports high-level autonomous driving.

[0022] Figure 3 is a schematic diagram of the working mode of the fully redundant electric power steering system of the present invention;

[0023] Figure 4 is a schematic diagram of the fully redundant electric power steering system architecture of the present invention.

[0024] Figure 5 is a schematic diagram of the internal communication channels of the main road system and the auxiliary road system of the present invention;

[0025] Figure 6 is a schematic diagram of the failure modes and diagnostic measures of internal communication faults in the main road system and auxiliary road system of the present invention.

[0026] Figure 7 is a schematic diagram illustrating an example of the internal communication diagnostic process of the main road system and auxiliary road system of the present invention.

[0027] Figure 8 is a matrix diagram of communication failure points and security degradation within the main road system and auxiliary road system of the present invention. Detailed Implementation

[0028] The following specific embodiments illustrate the implementation of the present invention. Those skilled in the art can fully understand other advantages and technical effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through different specific embodiments, and the details in this specification can also be applied based on different viewpoints, with various modifications or changes made without departing from the overall design concept of the invention. It should be noted that, unless otherwise specified, the following embodiments and features can be combined with each other. The following exemplary embodiments of the present invention can be implemented in many different forms and should not be construed as being limited to the specific embodiments set forth herein. It should be understood that these embodiments are provided to make the disclosure of the present invention thorough and complete, and to fully convey the technical solutions of these exemplary embodiments to those skilled in the art.

[0029] The primary function of a vehicle's steering system is to assist the driver or a host computer in controlling the vehicle's lateral movement, changing or maintaining the intended direction of travel. Electric power steering (EPS), as the name suggests, is a steering system that directly relies on a steering motor to provide auxiliary steering torque, improving steering agility and driving safety. Automotive EPS systems can be categorized into column-type steering systems, dual pinion steering systems, and parallel-axis steering systems based on the different locations of the power steering motor. The steering assistance provided by these three types of EPS systems increases progressively from lowest to highest, catering to the varying steering assistance requirements of different vehicles.

[0030] Figure 1 is a simplified structural diagram of a dual pinion / parallel shaft electric power steering system. The main components include a steering wheel 1, an upper column 2, an intermediate connecting shaft 3, a torque sensor 4, a pinion 5, a steering electronic control unit 6, a power steering motor 7, a reduction mechanism 8, a steering rack 9, a tie rod 10, and a tire 11.

[0031] The dual pinion / parallel shaft electric power steering system changes the vehicle's direction of travel by combining mechanical steering and electric power steering, as shown in the diagram for turning right. The mechanical steering path involves the driver turning the steering wheel 1 to the right. The applied torque is transmitted through the upper column 2 and intermediate shaft 3 to the torque sensor 4, where it is reduced in speed by the pinion 5 and directly drives the rack 9 to move to the right. The electric power steering path involves the torque sensor 4 detecting the steering torque applied by the driver. This target hand force signal is transmitted electrically to the electronic control unit 6, converted into target electric power steering assistance, and drives the motor 7. The motor's torque is then transmitted to the rack 9 to move to the right via the reduction structure 8. The electric power steering assistance and mechanical steering torque acting on the rack 9 are superimposed and combined, causing the steering rack 9 and tie rod 10 to move to the right, controlling the steering angle of the tires 11 and thus achieving a right turn. The control principle of the column-type electric power steering system is similar.

[0032] Figure 2 is a schematic diagram of the working principle of a master-slave fully redundant electric power steering system supporting high-level autonomous driving. The master-slave fully redundant electric power steering system is divided into master and auxiliary paths. Both paths are completely redundant in hardware and software, yet can support independent calculation and cooperative control. For the sake of simplicity, the term "redundant system" will be used in the following text instead of "fully redundant electric power steering system," and both have the same meaning.

[0033] This steering system supports lateral control in various scenarios, including driver operation, low-level assisted driving, and fully automated driving. In normal operating mode, the main road system calculates the target steering torque command based on the driver's target hand force or instructions from the host computer. After calculation, the target motor torque is coordinated and distributed to the torque execution components of the main and auxiliary road systems. Both systems output motor torque synchronously, ensuring 100% power steering assistance. The target steering torque calculation module of the auxiliary road system is in hot standby mode. It also calculates the target steering torque command in real time based on the target hand force collected from the auxiliary road system and transmits key information from the auxiliary road system to the main road system in real time via internal communication. When the main road system loses control, the auxiliary road system in hot standby mode takes over and continues to collaboratively control the torque execution components of both systems, ensuring the entire redundant steering system continues to complete the steering task. In the event of a serious failure of the redundant system, the main road and auxiliary road systems can independently control their respective torque execution components, continuing to provide partial steering assistance to control the vehicle's steering.

[0034] The master-slave redundant steering system can operate in multiple modes for safety degradation based on different system control characteristics and failure modes. The summarized operating modes are shown in Figure 3. Mode 0 represents a normal operating mode with no faults in the redundant system. The main system takes the lead in control, while the auxiliary system provides hot backup. The entire system can provide a maximum of 100% steering assistance. Mode 1 represents the auxiliary system losing its computing power. The redundant system has no hot backup, but the main system controls the execution parts of both the main and auxiliary systems to work collaboratively. The entire system can still provide a maximum of 100% steering assistance. Mode 2 represents the main system losing its computing power. The auxiliary system takes over and controls the execution parts of both the main and auxiliary systems to work collaboratively. The redundant system has no hot backup, but the system can still provide a maximum of 100% steering assistance. Mode 3 represents the auxiliary system losing both its execution and computing power. The main system controls only the execution parts of the main system, and the system can provide a maximum of 50% steering assistance. Mode 4 represents the main system losing both its execution and computing power. The auxiliary system controls only the execution parts of the auxiliary system, and the system can provide a maximum of 50% steering assistance. Mode 5 represents the failure of both the computing and execution parts of the main and auxiliary systems, resulting in the complete loss of steering capability.

[0035] Figure 4 is a schematic diagram of the fully redundant electric power steering system architecture. The master-slave fully redundant electric power steering system consists of two systems, a master system and an auxiliary system, each controlling three phases of the motor, which work together to control a six-phase motor. The main control components include two vehicle power supplies (1 and 2), two vehicle communication circuits (1 and 2), two torque sensors (1 and 2), two microcontroller units (1 and 2), two power management chips (1 and 2), two pre-drive controllers (1 and 2), two sets of three-phase bridges (1 and 2), two sets of phase separators (1 and 2), communication connection between the master and auxiliary systems, a motor rotor position sensor, and protection circuits such as filtering circuits not shown in the figure.

[0036] In normal operating mode, the master-slave fully redundant electric power steering system operates simultaneously in both the main and auxiliary paths. Each controller in the master and auxiliary systems operates normally within its respective system. The vehicle power supply 1, after filtering, provides 12V DC power to the three-phase bridge drive control 1. After processing by the power management chip 1, the vehicle power supply 1 provides different operating voltages to various electronic components. The microcontroller unit 1, after acquiring the driver's target hand force through sensor 1, calculates the required target steering torque. This target torque, after coordinated allocation, is transmitted to the microcontroller unit 2 via internal communication between the master and auxiliary systems. Microcontroller 1, through the pre-drive controller 1, amplifies the power and drives the three-phase bridge 1, providing 50% of the steering assistance required by the steering system. Microcontroller 2, receiving the target command from microcontroller 1, amplifies the power through the pre-drive controller 2 and drives the three-phase bridge 2, providing the remaining 50% of the steering assistance required by the steering system. In normal operating mode, the combined 50% steering assistance from each of the master and auxiliary systems provides 100% steering assistance to meet the needs of high-level autonomous driving in various scenarios. In the event of a system failure in the normal mode of the redundant system, the auxiliary road system computing unit will immediately take over the control of the redundant system, ensuring that the entire system can enter a safe degrade mode and guarantee vehicle driving safety. Phase separation 1 and 2 can activate separately in the event of a serious failure in the main and auxiliary systems, cutting off the power steering output of the main and auxiliary systems to ensure the safety of the steering system.

[0037] Figure 5 illustrates the internal communication between the main and auxiliary systems of a fully redundant electric power steering system. The main and auxiliary systems can use communication methods including, but not limited to, UART, SPI, CAN, and PWM for real-time information exchange. Signals with low time requirements, such as vehicle CAN signals (vehicle speed, wheel speed, and host computer commands), are exchanged via the internal private CAN. Signals with high real-time requirements, such as torque or angle signals, system operating status signals, power assist request signals, and steering torque distribution signals, require high-speed UART / SPI communication for exchange. Synchronous control signals between the main and auxiliary systems use PWM for exchange. The internal communication strategy of the fully redundant electric power steering system is as follows: In normal mode, key information between the main and auxiliary systems is exchanged through internal communication. The upper-level target torque calculation unit prioritizes using the input signal from the main circuit to calculate the requested target torque. The calculation and distribution are then performed based on the respective system states of the main and auxiliary systems. The lower-level torque execution unit responds based on the allocated target torque command received from the UART channel, ensuring accurate output of the 6-phase motor power assist. When key information is lost in either the main or auxiliary system, the backup information can be transmitted to each other through internal communication to continue controlling the steering system.

[0038] Figure 6 shows the main failure modes, diagnostic mechanisms, and handling measures for each type of internal communication. A Time Out monitoring mechanism can detect communication reception timeout faults. During the debounce process to confirm the fault, the valid value from the previous moment is used. After fault confirmation, the signal value is set to SNA. For faults involving compromised transmission information consistency, a CRC check mechanism can be used for monitoring. During the debounce process to confirm the fault, the valid value from the previous moment is used. After fault confirmation, the signal value is set to SNA. For errors in the length of transmitted signals, a DLC check mechanism can be used for monitoring. During the debounce process to confirm the fault, the valid value from the previous moment is used. After fault confirmation, the signal value is set to SNA. The primary and secondary systems need to perform rationalization checks on their respective received signals. If an unreasonable data range is detected, the signal should be set to SNA.

[0039] Figure 7 shows an example of a flowchart illustrating the internal communication diagnostic process of the fully redundant electric power steering system's main and auxiliary systems. This flowchart starts with the normal mode as the initial state for the internal communication diagnostic process of the main and auxiliary systems. In normal mode, the main system is responsible for calculating the target motor torque and coordinates the execution of the main and auxiliary systems, while the auxiliary system's calculation part serves as a hot backup. In mode 0, the main system acts as the dominant control, paying particular attention to the TX channel of the three communication methods. If the calculated target torque command and synchronization command can be sent to the auxiliary system through the TX channel, the redundant system remains in mode 0. If the calculated target torque command and torque synchronization command cannot be sent to the auxiliary system through the TX channel, the auxiliary system needs to switch to dominant control, and the redundant system switches to mode 2, coordinating the execution of the main and auxiliary systems to continue providing 100% maximum steering assistance. In mode 2, the auxiliary system, as the main control system, pays attention to the RX channel of the three communication methods. If the calculated target torque command and torque synchronization command cannot be sent to the main system through the RX channel, the redundant system switches to mode 4, and the auxiliary system independently controls the execution part of the auxiliary system, continuing to provide 50% maximum steering assistance.

[0040] Combining the three different internal communication types of the master-slave redundant steering system, the six different failure points of communication failure, and the six working modes of the master-slave redundant steering system, different safety degradation strategies are designed for each communication failure point to ensure that the system can enter a safe state and make the most of the capabilities of the redundant system to maintain a large steering assist. Figure 8 shows the safety degradation strategy matrix for communication failure of the master-slave system.

[0041] Failure points ① to ⑥ are consistent with those shown in Figure 7, primarily considering single failures in the internal communication between the primary and secondary systems. Points ⑦ to ⑧ mainly address failures involving interruptions in all internal communication within the primary and secondary systems. Failures in the TX and RX signals for internal communication transmission and reception are considered separately for safety degradation. The current mode refers to the operating mode of the redundant system just before the primary-secondary system communication failure; modes 0 to 5 may all be in operating modes. This design comprehensively considers the possibility of secondary failures in the redundant switching system, meaning the redundant system may already be operating in a safety degradation mode when another internal communication failure occurs, fully considering the robustness and safety of the redundant system.

[0042] If the redundant system is currently operating in mode 0 (normal mode), failure point ① is the failure of the main system's CAN transmission channel. However, the calculated target torque can still be sent to the auxiliary microcontroller via the UART channel, and the system remains in mode 0, with the main and auxiliary systems cooperating normally to provide 100% steering assistance. Failure point ② is the failure of the main system's CAN reception channel. This does not affect the interaction between the main and auxiliary systems regarding target torque or system status. The system remains in mode 0, and the main and auxiliary systems can cooperate normally to provide 100% steering assistance. Failure point ③ is the failure of the main system's UART transmission channel, which affects the interaction between the main system's target torque and system status. The signal cannot be transmitted to the auxiliary system. After diagnosing the communication failure, the auxiliary system sends the result back to the main system via the UART channel. The redundant system safely degrades to mode 2 operation, and the auxiliary system independently controls the execution part of the main and auxiliary systems, providing up to 100% steering assistance. Failure ④ is that the main UART receiving channel fails, but the transmitting channel is intact. The target torque calculated by the main system can still be sent to the auxiliary system, and the main and auxiliary systems can cooperate to provide 100% steering assistance. However, at this time, the state of the main system towards the auxiliary system is unknown. Failure ⑤ is that the main PWM transmitting channel fails. Failure 6 occurs when the main road system cannot synchronize with the auxiliary road system. Although the target torque signal can be sent to the auxiliary road system, the main and auxiliary systems cannot coordinate and output synchronously. The redundant system safely degrades to mode 2 operation. The auxiliary road system controls the execution part of the main and auxiliary systems and can provide up to 100% steering assistance. Failure 7 occurs when the PWM receiving channel of the main road fails. The target torque calculated by the main road can be sent to the auxiliary road system normally. However, in normal control mode, the main road system synchronizes with the auxiliary road system. Therefore, under this failure, the main and auxiliary systems can still coordinate and provide 100% steering assistance synchronously. Failure 8 occurs when the CAN, UART and PWM receiving channels of the main road fail simultaneously. This means that the auxiliary road system monitors that it cannot receive any communication information from the main road and will determine that the main road microcontroller has crashed. The auxiliary road system actively takes over the system and enters mode 4, independently controlling the torque execution part and providing up to 50% steering assistance. Failure 9 occurs when the CAN, UART and PWM receiving channels of the main road fail simultaneously. This means that the main road system monitors that it cannot receive any information from the auxiliary road system and will determine that the auxiliary road microcontroller has crashed. The main road system takes over the system and enters mode 3, independently controlling the torque execution part and providing up to 50% steering assistance. If the current system is in another degradation mode, the security degradation strategy after the failure of communication between the main and auxiliary systems has been designed in detail, as shown in Figure 8.

[0043] In summary, the method proposed in this invention combines the multi-operating-mode characteristics of redundant steering systems and designs various communication methods for information exchange to meet the different requirements of information interaction between the primary and secondary systems. Based on the different failure modes of internal communication between the primary and secondary systems and the impact of different failures on the redundant steering system, multiple safety degradation strategies are designed. These strategies ensure that the system can enter a safe state when internal communication fails, while maximizing the performance of the redundant system, thus achieving a high degree of balance between system security and availability.

[0044] The present invention has been described in detail above through specific embodiments and examples, but these are not intended to limit the invention. Many modifications and improvements can be made by those skilled in the art without departing from the principles of the invention, and these should also be considered within the scope of protection of the present invention.

Claims

1. A method for safety degradation in a fully redundant electric power steering system due to internal communication failure, characterized in that, The fully redundant electric power steering system includes a main system, an auxiliary system, and a 6-phase motor. The main system and the auxiliary system each control 3 phases of the 6-phase motor. The main system and the auxiliary system exchange information in real time through six communication channels, including a UART serial communication channel, a private CAN communication channel, and a PWM communication channel. Each of these channels is further divided into a TX channel and an RX channel, with the TX channel being the transmitting channel and the RX channel being the receiving channel. The fully redundant electric power steering system changes its operating mode based on the failure of the six different communication channels. The operating modes, from highest to lowest, are Mode 0, Mode 1, Mode 2, Mode 3, Mode 4, and Mode 5.

2. The method for safety degradation of internal communication failure in a fully redundant electric power steering system according to claim 1, characterized in that, Mode 0 indicates that neither the main road system nor the auxiliary road system is faulty; Mode 1 indicates that the main road system is faulty, but the auxiliary road system loses its computing power; Mode 2 indicates that the main road system loses its computing power, but the auxiliary road system is not faulty; Mode 3 indicates that the auxiliary road system loses its execution and computing power, but the main road system is not faulty; Mode 4 indicates that the main road system loses its execution and computing power, but the auxiliary road system is not faulty; Mode 5 indicates that both the main road system and the auxiliary road system lose their execution and computing power.

3. The method for safety degradation in the internal communication failure of a fully redundant electric power steering system according to claim 1, characterized in that, When the operating mode is mode 0, if the UART serial communication TX channel or the PWM communication TX channel fails, the control operating mode changes to mode 2; if the private CAN communication TX channel, the UART serial communication TX channel, and the PWM communication TX channel all fail, the control operating mode changes to mode 4; if the private CAN communication RX channel, the UART serial communication RX channel, and the PWM communication RX channel all fail, the control operating mode changes to mode 3.

4. The method for safety degradation in the internal communication failure of a fully redundant electric power steering system according to claim 1, characterized in that, When the operating mode is mode 1, if the UART serial communication TX channel or the PWM communication TX channel fails, the control operating mode will change to mode 3; if the private CAN communication TX channel, the UART serial communication TX channel, and the PWM communication TX channel all fail, the control operating mode will change to mode 5; if the private CAN communication RX channel, the UART serial communication RX channel, and the PWM communication RX channel all fail, the control operating mode will change to mode 3.

5. The method for safety degradation of internal communication failure in a fully redundant electric power steering system according to claim 1, characterized in that, When the working mode is mode 2, if the UART serial communication RX channel or the PWM communication RX channel fails, the control working mode will be changed to mode 4; if the CAN communication TX channel, the UART serial communication TX channel and the PWM communication TX channel all fail, the control working mode will be changed to mode 4. If the private CAN communication RX channel, UART serial communication RX channel, and PWM communication RX channel all fail, the control operating mode will change to mode 5.

6. The method for safety degradation of internal communication failure in a fully redundant electric power steering system according to claim 1, characterized in that, The failure modes of the communication channel include at least one of the following: information reception timeout, inconsistency corruption, length mismatch, or value out of range.

7. The method for safety degradation of internal communication failure in a fully redundant electric power steering system according to claim 1, characterized in that, The UART serial communication channel is used to transmit torque signals, angle signals, system operating status signals, power assist request signals, or steering assist torque distribution signals.

8. The method for safety degradation of internal communication failure in a fully redundant electric power steering system according to claim 1, characterized in that, The private CAN communication channel is used to transmit vehicle speed, wheel speed, or host computer commands.

9. The method for safety degradation of internal communication failure in a fully redundant electric power steering system according to claim 1, characterized in that, The PWM communication channel is used to transmit synchronization control signals between the main system and the auxiliary system.

Images