Redundant design system, redundant control method and vehicle

Abstract

The present invention relates to a redundant design system, a redundant control method, and a vehicle, and relates to the field of vehicle braking technology. The redundant design system includes a brake system, which includes a first brake, a second brake, a third brake, and a fourth brake; a power supply system, which includes a first power supply and a second power supply; when the first power supply fails, the second power supply is used to provide power; a brake pedal, which integrates a pedal sensor, which includes a first sensor and a second sensor; an electronic parking brake system, which is communicatively connected to at least two brakes; and a central controller, which is communicatively connected to the brake system, the power supply system, the brake pedal, and the electronic parking brake system. By setting up a redundant module solution and designing a failure operation strategy, the safety and reliability of the entire vehicle braking process are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of vehicle braking, and in particular to a redundant design system, a redundant control method and a vehicle. Background Art

[0002] In recent years, new energy vehicles have become increasingly popular. Braking performance is a key performance indicator and directly impacts traffic safety. The electronic mechanical brake (EMB) system is a hot topic in the field of drive-by-wire chassis. Using an electronic controller and mechanical actuator to directly apply braking force to the wheel, this significantly reduces system components while offering faster response times and greater wheel-end actuation flexibility, making it a highly integrated braking system solution. The EMB system is a hot topic in the field of intelligent vehicles. It completely replaces traditional hydraulic circuits with electronic control, achieving complete decoupling of the braking system and streamlining its structure. This improves response speed and execution efficiency, facilitating the development of chassis-domain control and intelligent driving technologies. However, due to the elimination of the existing hydraulic backup redundancy and the increasing demands for functional safety in vehicle hardware and software, the safety and reliability of EMB systems are also becoming increasingly demanding. Therefore, it is imperative to develop solutions with safety redundancy, determine an EMB system control architecture that meets safety objectives, and design a fail-safe operation strategy based on this architecture.

[0003] Therefore, it is expected to provide a redundant design system, redundant control method and vehicle to improve the safety of the EMB system, ensure basic braking functions under conditions such as signal detection, power failure, controller failure, and actuator failure, and improve the safety and reliability of the vehicle's braking process by setting redundant functional modules and failure operation strategies. Summary of the Invention

[0004] According to a first aspect of some embodiments of the present invention, a redundant design system is provided, which may include a brake system, the brake system including a first brake, a second brake, a third brake, and a fourth brake; a power supply system, the power supply system including a first power supply and a second power supply; when the first power supply fails, the second power supply is used to provide power; a brake pedal, the brake pedal integrated with a pedal sensor, the pedal sensor including a first sensor and a second sensor; an electronic parking brake system, the electronic parking brake system being communicatively connected to at least two brakes; and a central controller, the central controller being communicatively connected to the brake system, the power supply system, the brake pedal, and the electronic parking brake system.

[0005] In some embodiments, the system further includes a CAN bus, the CAN bus includes a first CAN line and a second CAN line, the first brake, the second brake, and the third brake are connected through the first CAN line, and the first brake, the second brake, and the fourth brake are connected through the second CAN line.

[0006] In some embodiments, the first brake and the second brake are connected in two lines via the first CAN line and the second CAN line. When one CAN line fails, the other CAN line is used to connect at least three brakes for braking.

[0007] In some embodiments, the first power supply is connected to the first brake and the third brake for power supply, and the second power supply is connected to the second brake and the fourth brake for power supply; when one power supply fails, the other power supply is used to connect at least two brakes for power supply.

[0008] In some embodiments, the first power supply is connected to the second sensor for power supply, and the second power supply is connected to the first sensor for power supply. When one power supply fails, the other power supply is used to power the corresponding sensor, and the corresponding sensor is used to output a signal.

[0009] According to a second aspect of some embodiments of the present invention, a redundant control method is provided, which may include obtaining a brake signal from a brake pedal through a central controller; the brake pedal integrates a pedal sensor, including a first sensor and a second sensor; based on the brake signal, the central controller sends a braking request to the brake; the brake includes a first brake, a second brake, a third brake, and a fourth brake, the first brake, the second brake, and the third brake are connected through a first CAN line, and the first brake, the second brake, and the fourth brake are connected through a second CAN line; the first brake and the second brake are connected in two lines through the first CAN line and the second CAN line; judging whether the power supply fails, the power supply includes a first power supply and a second power supply; the first power supply supplies power to the first brake and the third brake, and the second power supply supplies power to the second brake and the fourth brake; if the power supply is valid, the brake executes the braking request; if one power supply fails, the other power supply supplies power to at least two brakes, and the brake executes the braking request.

[0010] In some embodiments, if one power supply fails, the other power supply supplies power to at least two brakes, specifically including: if the first power supply fails, the second brake and the fourth brake utilize the power of the second power supply, the second brake and the fourth brake are connected to the first brake through the second CAN line to execute the braking request; or, if the second power supply fails, the first brake and the third brake utilize the power of the first power supply, the first brake and the third brake are connected to the second brake through the first CAN line to execute the braking request.

[0011] In some embodiments, the first power supply powers the second sensor, and the second power supply powers the first sensor. Specifically, if the first power supply fails, the first sensor uses the power of the second power supply to send the braking signal to the central controller; or, if the second power supply fails, the second sensor uses the power of the first power supply to send the braking signal to the central controller, the first brake, and the second brake.

[0012] In some embodiments, the method further includes the first brake and the second brake determining whether the braking signal is consistent with the braking request; if they are consistent, the brake executes the braking request; if they are inconsistent, the brake executes safety braking, and the safety braking includes first executing the braking request and then performing fault detection.

[0013] According to a vehicle provided by the present invention, the redundant design system of the present application is applied to execute the redundant control method of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] To better understand and illustrate some embodiments of the present invention, the following description of the embodiments will be made with reference to the accompanying drawings, in which like reference numerals indicate corresponding parts throughout the drawings.

[0015] Figure 1 is an exemplary schematic diagram of a redundant design system provided according to some embodiments of the present invention.

[0016] Figure 2 is an exemplary schematic diagram of a redundantly designed CAN bus provided according to some embodiments of the present invention.

[0017] Figure 3 is an exemplary flow chart of a redundancy control method provided according to some embodiments of the present invention. DETAILED DESCRIPTION

[0018] The following description with reference to the accompanying drawings is provided to facilitate a comprehensive understanding of various embodiments of the present invention as defined by the claims and their equivalents. These embodiments include various specific details to facilitate understanding, but these are to be considered as illustrative only. Therefore, those skilled in the art will appreciate that various changes and modifications can be made to the various embodiments described herein without departing from the scope and spirit of the present invention. Furthermore, for the sake of brevity and clarity, descriptions of well-known functions and structures will be omitted.

[0019] The terms and phrases used in the following specification and claims are not limited to their literal meanings, but are intended only to enable a clear and consistent understanding of the present invention. Therefore, it will be understood by those skilled in the art that the description of the various embodiments of the present invention is provided for illustrative purposes only and is not intended to limit the present invention as defined in the appended claims and their equivalents.

[0020] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings of some embodiments of the present invention. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0021] It should be noted that the terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The singular forms of "one", "an", "a", "said" and "the" used in the embodiments of the present invention and the appended claims are also intended to include plural forms, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used in the present invention refers to and includes any or all possible combinations of one or more bound listed items. The expressions "first", "second", "the first" and "the second" are used to modify the corresponding elements without regard to order or importance, and are only used to distinguish one element from another, without limiting the corresponding elements.

[0022] The embodiments of the present invention provide a redundant design system, a redundant control method, and a vehicle. To facilitate understanding of the embodiments of the present invention, the embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0023] Figure 1 FIG. 1 is an exemplary schematic diagram of a redundant design system according to some embodiments of the present invention. Figure 1As shown, the redundant design system may include a brake system, comprising a first brake, a second brake, a third brake, and a fourth brake; a power supply system, comprising a first power supply and a second power supply; when the first power supply fails, the second power supply is used to provide power; a brake pedal, comprising an integrated pedal sensor, comprising a first sensor and a second sensor; an electronic parking brake system, wherein the electronic parking brake system is communicatively connected to at least two brakes; and a central controller, wherein the central controller is communicatively connected to the brake system, the power supply system, the brake pedal, and the electronic parking brake system. In some embodiments, the electronic parking brake system includes an EPB button, which can be connected to the central controller, the RL brake, the RR brake, etc., and sends a parking signal to the central controller, the RL brake, and the RR brake to implement electronic parking control.

[0024] According to some embodiments of the present application, the system further includes a CAN bus, the CAN bus including a first CAN line and a second CAN line. The first brake, the second brake, and the third brake are connected via the first CAN line, and the first brake, the second brake, and the fourth brake are connected via the second CAN line. The first brake and the second brake are connected in a two-wire manner via the first and second CAN lines. When one CAN line fails, the other CAN line is used to connect at least three brakes for braking. As an example, when the first CAN line fails, the second CAN line can be connected to the FL brake, FR brake, and RR brake for braking. For another example, when the second CAN line fails, the first CAN line can be connected to the FL brake, FR brake, and RL brake for braking.

[0025] In some embodiments, the first power source (e.g. Figure 1 The first brake and the third brake are connected to the first brake for power supply, and the second power supply (as shown in the solid line) is connected to the first brake and the third brake for power supply. Figure 1 The second and fourth brakes are connected (shown by dashed lines) to provide power. If one power source fails, the other power source is used to connect at least two brakes for power. For example, if power source 1 fails, power source 2 can provide power to the FL and RR brakes. For another example, if power source 2 fails, power source 1 can provide power to the FR and RL brakes.

[0026] In some embodiments, the first power source (e.g. Figure 1 The second sensor is connected to the second power supply (shown as a solid line) for power supply. Figure 1The first sensor is connected to the power supply (shown by the dotted line) for power supply. When one power supply fails, the other power supply is used to power the corresponding sensor, and the corresponding sensor is used to output a signal. As an example, when power supply 1 fails, power supply 2 can provide power to the first sensor PTS1, and the first sensor PTS1 can perform signal output normally. For another example, when power supply 2 fails, power supply 1 can provide power to the second sensor PTS2, and the second sensor PTS2 can perform signal output normally. In some embodiments, the second sensor PTS2 can output a signal to a central controller, a FL brake, a FR brake, etc.

[0027] Figure 2 FIG. 1 is an exemplary schematic diagram of a redundant CAN bus according to some embodiments of the present invention. Figure 2 As shown, the redundant CAN bus may include a first CAN line, a second CAN line, and a first brake, a second brake, and a third brake via the first CAN line (e.g. Figure 2 The first brake, the second brake and the fourth brake are connected via the second CAN line (shown as a solid line). Figure 2 The first and second brakes are connected via a two-wire CAN line (shown by a dashed line). For example, the first CAN line is CAN A (solid line), which can connect to the FL brake, FR brake, and RL brake; the second CAN line is CAN B (dashed line), which can connect to the FL brake, FR brake, and RR brake. The FL brake and FR brake are connected via a two-wire CAN line (solid line) and CAN B (dashed line).

[0028] Figure 3 FIG. 1 is an exemplary flow chart of a redundancy control method according to some embodiments of the present invention. Figure 3 As shown, the process 100 of the redundancy control method may include:

[0029] S101, obtaining a brake signal from a brake pedal through a central controller; the brake pedal is integrated with a pedal sensor, including a first sensor and a second sensor. In some embodiments, a redundant design system can obtain the brake signal through the vehicle's brake pedal. The pedal sensor may include a brake pedal feel simulator, a pedal displacement sensor, etc. The pedal sensor generates a brake signal based on the first sensor and / or the second sensor, and transmits the signal to the central controller. It should be noted that obtaining the brake signal described in S101 may be receiving the brake signal from the first sensor and the second sensor.

[0030] S102: Based on the braking signal, the central controller sends a braking request to the brakes; the brakes include a first brake, a second brake, a third brake, and a fourth brake. In some embodiments, the first brake, the second brake, and the third brake are connected via a first CAN line, and the first brake, the second brake, and the fourth brake are connected via a second CAN line; the first brake and the second brake are connected in a dual-wire manner via the first and second CAN lines.

[0031] S103: Determine whether a power supply fails. The power supply includes a first power supply and a second power supply. The first power supply provides power to the first and third brakes, and the second power supply provides power to the second and fourth brakes. In some embodiments, if the first power supply fails, the second power supply provides power. In some embodiments, if the second power supply fails, the first power supply provides power. For another example, if both the first and second power supplies are valid, the initial setting may be to provide power through the first power supply.

[0032] In some embodiments, the first power supply supplies power to the second sensor, and the second power supply supplies power to the first sensor. For example, if the first power supply fails, the first sensor utilizes power from the second power supply to send the braking signal to the central controller. For another example, if the second power supply fails, the second sensor utilizes power from the first power supply to send the braking signal to the central controller, the first brake, and the second brake.

[0033] S104: If the power supply is valid, the brake executes the braking request. In some embodiments, when the power supply is valid, the brake performs braking according to the braking request.

[0034] S105: If one power supply fails, another power supply supplies power to at least two brakes, and the brakes execute the braking request. In some embodiments, if the first power supply fails, the second and fourth brakes utilize power from the second power supply, and the second and fourth brakes are connected to the first brake via the second CAN line to execute the braking request. In some embodiments, if the second power supply fails, the first and third brakes utilize power from the first power supply, and the first and third brakes are connected to the second brake via the first CAN line to execute the braking request.

[0035] In some embodiments, the first sensor is connected to the central controller for obtaining a braking signal and sending it to the central controller; the second sensor is connected to the central controller, the first brake, and the second brake for obtaining a braking signal and sending it to the central controller, the first brake, and the second brake.

[0036] According to some embodiments of the present application, the first brake and the second brake can determine whether the braking signal of the second sensor is consistent with the braking request of the central controller; if they are consistent, the brake executes the braking request; if they are inconsistent, the brake executes safety braking, and the safety braking includes first executing the braking request and then performing fault detection. As an example, the safety braking specifically includes, when the braking signal corresponds to braking and the braking request corresponds to no braking, the brake first executes braking according to the braking and then performs fault detection. For another example, when the braking signal corresponds to a first braking force and the braking request corresponds to a second braking force, and the first braking force is inconsistent with the second braking force, the brake first executes a larger braking force and then performs fault detection. The fault detection specifically includes determining that the central controller has failed, etc.

[0037] According to some embodiments of the present application, the vehicle of the present application may include a redundant design system applying the present application and execute the above-mentioned redundant control method. In some embodiments, the redundant design system includes a brake system, the brake system including a first brake, a second brake, a third brake, and a fourth brake; a power supply system, the power supply system including a first power supply and a second power supply; when the first power supply fails, the second power supply is used to provide power; a brake pedal, the brake pedal having an integrated pedal sensor, the pedal sensor including a first sensor and a second sensor; an electronic parking brake system, the electronic parking brake system being communicatively connected to at least two brakes; and a central controller, the central controller being communicatively connected to the brake system, the power supply system, the brake pedal, and the electronic parking brake system. In some embodiments, the redundant control method includes obtaining a braking signal from a brake pedal through a central controller; the brake pedal integrates a pedal sensor, including a first sensor and a second sensor; based on the braking signal, the central controller sends a braking request to the brake; the brake includes a first brake, a second brake, a third brake, and a fourth brake; determining whether the power supply fails, the power supply includes a first power supply and a second power supply; the first power supply supplies power to the first brake and the third brake, and the second power supply supplies power to the second brake and the fourth brake; if the power supply is valid, the brake executes the braking request; if one power supply fails, the other power supply supplies power to at least two brakes, and the brake executes the braking request.

[0038] It should be noted that the above description of the braking system and redundant control method is for convenience only and does not limit the present invention to the scope of the illustrated embodiments. It is understood that those skilled in the art, based on the principles of this device, may arbitrarily combine the various structures, or combine the substructures with other structures, without departing from such principles, and make various modifications and changes in form and detail to the functions of implementing the above-mentioned devices and operations. For example, the redundant control method may further include functions such as performing safety braking. Such variations are within the scope of protection of the present invention.

[0039] In summary, the redundant control method and vehicle of the present invention, the redundant design system includes a brake system, the brake system includes a first brake, a second brake, a third brake, and a fourth brake; a power supply system, the power supply system includes a first power supply and a second power supply; when the first power supply fails, the second power supply is used to provide power; a brake pedal, the brake pedal has an integrated pedal sensor, the pedal sensor includes a first sensor and a second sensor; an electronic parking brake system, the electronic parking brake system is communicatively connected to at least two brakes; a central controller, the central controller is communicatively connected to the brake system, the power supply system, the brake pedal, and the electronic parking brake system. By setting up a redundant module scheme and designing a failure operation strategy, the safety and reliability of the vehicle's braking process are improved.

[0040] It should be noted that the above-mentioned embodiments are merely examples, and the present invention is not limited to such examples but can be variously modified.

[0041] It should be noted that, in this specification, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or apparatus comprising the element.

[0042] The above disclosures are only some preferred embodiments of the present invention and are not intended to limit the scope of the present invention. A person skilled in the art will understand that all or part of the structures of the above embodiments and equivalent changes made in accordance with the claims of the present invention are still within the scope of the present invention.

Claims

1. A redundant design system, characterized in that: include: a brake system, the brake system comprising a first brake, a second brake, a third brake, and a fourth brake; A power supply system, comprising a first power supply and a second power supply; when the first power supply fails, the second power supply is used to provide power; A brake pedal, wherein the brake pedal is integrated with a pedal sensor, and the pedal sensor includes a first sensor and a second sensor; an electronic parking brake system in communication with at least two brakes; a central controller, the central controller being communicatively connected with the brake system, the power supply system, the brake pedal, and the electronic parking brake system; The first power supply is connected to the second sensor for power supply, and the second power supply is connected to the first sensor for power supply. When one power supply fails, the other power supply is used to power the corresponding sensor, and the corresponding sensor is used to output a signal; The second sensor is connected to the central controller, the first brake, and the second brake; The first power supply supplies power to the second sensor, and the second power supply supplies power to the first sensor, specifically including: If the first power supply fails, the first sensor uses the power of the second power supply to send a braking signal to the central controller; or If the second power supply fails, the second sensor uses the power supplied by the first power supply to send the braking signal to the central controller, the first brake, and the second brake; According to the braking signal, the central controller sends a braking request to the brake; The first brake and the second brake determine whether the braking signal is consistent with the braking request; If they are consistent, the brake executes the braking request; If they are inconsistent, the brake performs safety braking, which includes first executing a braking request and then performing fault detection, specifically including: When the braking signal corresponds to braking and the braking request corresponds to no braking, the brake first performs braking according to the braking signal and then performs fault detection; or, when the braking signal corresponds to a first braking force and the braking request corresponds to a second braking force, and the first braking force is inconsistent with the second braking force, the brake first performs the larger braking force between the first braking force and the second braking force and then performs fault detection.

2. The system according to claim 1, wherein: The system further includes a CAN bus, which includes a first CAN line and a second CAN line. The first brake, the second brake, and the third brake are connected via the first CAN line, and the first brake, the second brake, and the fourth brake are connected via the second CAN line.

3. The system according to claim 2, characterized in that The first brake and the second brake are connected in two lines via the first CAN line and the second CAN line. When one CAN line fails, the other CAN line is used to connect at least three brakes for braking.

4. The system according to claim 2, wherein: The first power supply is connected to the first brake and the third brake for power supply, and the second power supply is connected to the second brake and the fourth brake for power supply; when one power supply fails, the other power supply is used to connect at least two brakes for power supply.

5. A redundancy control method, characterized in that: Specifically include: A brake signal of a brake pedal is obtained through a central controller; the brake pedal is integrated with a pedal sensor, including a first sensor and a second sensor; According to the braking signal, the central controller sends a braking request to the brake; the brake includes a first brake, a second brake, a third brake, and a fourth brake, the first brake, the second brake, and the third brake are connected via a first CAN line, and the first brake, the second brake, and the fourth brake are connected via a second CAN line; the first brake and the second brake are connected in two lines via the first CAN line and the second CAN line, and the second sensor is connected to the central controller, the first brake, and the second brake; Determining whether a power supply fails, the power supply including a first power supply and a second power supply; the first power supply supplies power to the first brake and the third brake, and the second power supply supplies power to the second brake and the fourth brake; If the power supply is valid, the brake executes the braking request; If one power supply fails, the other power supply supplies power to at least two brakes, and the brakes execute the braking request; The first power supply supplies power to the second sensor, and the second power supply supplies power to the first sensor, specifically including: If the first power supply fails, the first sensor uses the power of the second power supply to send the braking signal to the central controller; or, If the second power supply fails, the second sensor uses the power supplied by the first power supply to send the braking signal to the central controller, the first brake, and the second brake; The first brake and the second brake determine whether the braking signal is consistent with the braking request; If they are consistent, the brake executes the braking request; If they are inconsistent, the brake performs safety braking, which includes first executing a braking request and then performing fault detection, specifically including: When the braking signal corresponds to braking and the braking request corresponds to no braking, the brake first performs braking according to the braking signal and then performs fault detection; or, when the braking signal corresponds to a first braking force and the braking request corresponds to a second braking force, and the first braking force is inconsistent with the second braking force, the brake first performs the larger braking force between the first braking force and the second braking force and then performs fault detection.

6. The method according to claim 5, characterized in that If one power supply fails, the other power supply supplies power to at least two brakes, specifically including: If the first power supply fails, the second brake and the fourth brake are powered by the second power supply, and the second brake and the fourth brake are connected to the first brake via the second CAN line to execute the braking request; or If the second power supply fails, the first brake and the third brake are powered by the first power supply. The first brake and the third brake are connected to the second brake via the first CAN line to execute the braking request.

7. A vehicle, characterized in that: Apply the redundant design system described in any one of claims 1 to 4 to execute the redundant control method described in any one of claims 5 to 6.

Images