An electronic parking brake system

Abstract

This invention belongs to the field of vehicle parking brake control technology, specifically relating to an electronic parking brake system, including: a control module, a drive module, and a motor; the control module includes a serial communication interface and a first hardware interface, and the serial communication interface and the first hardware interface of the control module are respectively connected to the drive module, and the drive module is connected to the motor; wherein, the control module is used to verify the caliper control command and the parking administrator's confirmation command, and when the verification fails, it outputs a control command to the drive module through its serial communication interface, and outputs a high-level signal to the drive module through its first hardware interface; the drive module is used to control the motor to stop working according to the control command and / or the high-level signal. This invention has high fault tolerance and high robustness, ensuring that the software will not erroneously drive the caliper motor to operate even without a request or with an erroneous request, thereby improving vehicle driving safety.

Description

Technical Field

[0001] This invention belongs to the field of vehicle parking brake control technology, and specifically relates to an electronic parking brake system. Background Technology

[0002] The electronic parking brake (EPB) system receives parking brake switch signals (lock / release) and then drives the brake caliper motor to rotate forward / reverse to achieve the parking brake clamping / releasing function. However, if the caliper motor is unexpectedly triggered to rotate forward while the vehicle is in motion, causing the vehicle to unexpectedly clamp itself, it is highly likely to cause an accident.

[0003] Therefore, the functional safety objective ASILD (Automotive Safety Integrity Level D) is defined to address the unexpected or excessive braking torque generated by the parking brake during vehicle operation. It requires the identification of all possible random hardware failures and system failures in the parking brake caliper control and drive link, in order to design reasonable safety measures or safety mechanisms to diagnose failures, and to generate the correct response after a failure is diagnosed, so that the EPB enters a safe state.

[0004] However, current design solutions for EPB are incomplete and inadequate, and achieving high-safety-level EPB drive control requirements poses significant challenges to both software and hardware design. Summary of the Invention

[0005] In view of the shortcomings of the prior art described above, the purpose of this invention is to provide an electronic parking brake system with high fault tolerance and high robustness to ensure its safe, reliable and stable operation.

[0006] To achieve the above and other related objectives, the present invention provides an electronic parking brake system, comprising: a control module, a drive module, and a motor; the control module includes a serial communication interface and a first hardware interface, and the serial communication interface and the first hardware interface of the control module are respectively connected to the drive module, and the drive module is connected to the motor; wherein, the control module is used to verify caliper control commands and parking administrator confirmation commands, and when the verification fails, outputs control commands to the drive module through its serial communication interface, and outputs a high-level signal to the drive module through its first hardware interface; the drive module is used to control the motor to stop working according to the control commands and / or the high-level signal.

[0007] According to a specific embodiment of the present invention, the control module is further configured to output a high-level signal through its first hardware interface when it is unable to receive a vehicle speed status command.

[0008] According to a specific embodiment of the present invention, the control module is further configured to monitor the electrical signal output by its first hardware interface, so as to trigger an alarm response when the high-level signal supplied to the drive module is abnormal.

[0009] According to a specific embodiment of the present invention, it further includes: a conversion circuit for converting a low-level signal into a high-level signal; the control module further includes a second hardware interface, and the second hardware interface of the control module is connected to the drive module through the conversion circuit; wherein, the control module is also used for self-diagnosis, and outputs a low-level signal through its second hardware interface when a fault occurs.

[0010] According to a specific embodiment of the present invention, it further includes: a battery management module, used to diagnose faults in the control module and reset the control module when a fault occurs.

[0011] According to a specific embodiment of the present invention, the battery management module includes a third hardware interface, and the third hardware interface of the battery management module is connected to the drive module through the conversion circuit; wherein, the battery management module is also used to perform self-diagnosis and output a low-level signal through its third hardware interface when a fault occurs.

[0012] According to a specific embodiment of the present invention, when the driving module adopts a full-bridge driving chip, the driving module is used to turn off four of the switching transistors according to the control instruction, and the driving module is also used to turn off two of the low-side switching transistors according to the high-level signal.

[0013] According to a specific embodiment of the present invention, the control module is configured to partition its memory according to a preset address range so that the software components therein can be isolated from each other.

[0014] According to a specific embodiment of the present invention, the control module is configured to perform program flow monitoring on the task scheduling, processing, and execution of the software layer therein, so as to detect the over-execution, under-execution, or omission of software tasks.

[0015] According to a specific embodiment of the present invention, the control module adopts a control chip configured with a watchdog function and at least a vehicle safety integrity level of D; the drive module adopts a drive chip configured with a self-diagnostic function and at least a vehicle safety integrity level of D.

[0016] This invention provides an electronic parking brake system that can cope with MCU failure and achieve redundant drive of the caliper motor to meet the high safety requirements of EPB. By verifying the clamping / release commands of the parking brake control and the parking attendant's permission for clamping / release, it determines whether a conflict has occurred and correctly controls the forward / reverse rotation of the caliper motor to achieve parking braking and parking release. Furthermore, through multiple redundant executions, it ensures that the caliper motor can be stopped when the MCU fails, or when the SPI communication is abnormal, or when the battery management module fails, so as to avoid the caliper motor from operating unexpectedly, thereby greatly improving the reliability and safety of EPB.

[0017] This invention features high fault tolerance and robustness, ensuring that the software will not erroneously drive the caliper motor even without a request or with an erroneous request, thereby improving vehicle driving safety. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of a specific embodiment of an electronic parking brake system provided by the present invention. Detailed Implementation

[0019] To facilitate understanding of this application, a more complete description will be provided below with reference to the accompanying drawings, which illustrate embodiments of the present application. However, the present application can be implemented in many different forms and is not limited to the embodiments described herein. Rather, these embodiments are provided so that the disclosure of this application will be thorough and complete.

[0020] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application.

[0021] It is understood that the terms "first," "second," etc., used herein may be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish one element from another. For example, without departing from the scope of this application, a first resistor may be referred to as a second resistor, and similarly, a second resistor may be referred to as a first resistor. Both the first resistor and the second resistor are resistors, but they are not the same resistor.

[0022] It is understood that the term "connection" in the following embodiments should be understood as "electrical connection," "communication connection," etc., if the connected circuits, modules, units, etc., have electrical signal or data transmission with each other.

[0023] It is understandable that "at least one" refers to one or more, and "multiple" refers to two or more. "At least a part of an element" refers to part or all of an element.

[0024] When used herein, the singular forms of “a,” “an,” and “the” may also include the plural forms unless the context clearly indicates otherwise. It should also be understood that the terms “comprising / including” or “having,” etc., specify the presence of the stated features, wholes, steps, operations, components, parts, or combinations thereof, but do not preclude the possibility of the presence or addition of one or more other features, wholes, steps, operations, components, parts, or combinations thereof. Meanwhile, the term “and / or” as used in this specification includes any and all combinations of the associated listed items.

[0025] Please see Figure 1 As shown, an electronic parking brake system includes: a control module 10, a drive module 20, and a motor 30. The drive module 20 drives the motor 30 to rotate forward / reverse according to the control commands or control signals from the control module 10, thereby realizing the parking brake clamping / release function. Therefore, the control module 10 and the drive module 20 are communicatively connected to transmit control commands or control signals. The output terminal of the drive module 20 is connected to the positive / negative terminals of the motor 30, and the forward / reverse rotation of the motor 30 is achieved by controlling the current flow.

[0026] In this embodiment, the control module 10 includes a serial communication interface, a first hardware interface, and a second hardware interface for connecting to the drive module. Specifically, the control module is used to verify the clamping / releasing commands (i.e., caliper control commands) of the Parking Brake Control (PBC) and the confirmation commands (i.e., the parking manager's) commands regarding whether clamping / releasing is permitted.

[0027] It is understandable that the clamping / release command for parking brake control can be either autonomously controlled by the vehicle or actively controlled by the driver. For example, the vehicle controller may determine whether parking brake or parking brake release is necessary based on factors such as the current vehicle or road conditions, and output a control command accordingly to control the caliper action. Alternatively, the driver may actively trigger the vehicle's parking brake or parking brake release function to generate a control command. The parking attendant's command to grant or deny clamping / release permission may be based on further identification and judgment by the vehicle controller based on factors such as the current vehicle or road conditions to confirm whether parking brake or parking brake release is permitted. For example, parking brake cannot be applied when the vehicle speed is too high, or parking brake release cannot be applied when the vehicle is on a downhill section of road and the road is congested.

[0028] Therefore, it is necessary to verify the clamping / release command of the parking brake control and the command of the parking administrator to allow clamping / release, in order to confirm whether there is a conflict, and to stop the motor 30 from working when there is a conflict, so as to prevent the drive module 20 from receiving the wrong command and driving the motor 30 forward / reverse in the wrong direction, which would cause the caliper to make incorrect movements, resulting in the vehicle being clamped unexpectedly and causing a safety accident.

[0029] Accordingly, after the control module 10 verifies the clamping / releasing command of the parking brake control and the parking attendant's command of whether clamping / releasing is permitted, it determines whether the commands conflict. If so, the control module 10 outputs the corresponding control command to the drive module 20 through its serial communication interface and outputs a high-level signal to the drive module 20 through its first hardware interface, so that the drive module 20 can control the motor 30 to stop working according to the corresponding control command and / or the high-level signal. If not, the control module 10 outputs the corresponding control command to the drive module 20 through its serial communication interface, so that the drive module 20 can drive the motor 30 to rotate forward or reverse according to the control command, thereby realizing parking brake or parking release.

[0030] Therefore, when there is no command conflict, the control module 10 only issues the corresponding control command through its serial communication interface to control the drive module 20 to work. However, when there is a command conflict, the control module 10 not only issues the corresponding control command through its serial communication interface, but also issues a high-level signal through the first hardware interface to control the drive module 20, thereby ensuring that the motor 30 can stop working. This is to avoid communication failure between the control module 10 and the drive module 20 due to serial communication interface failure or interference, and to achieve redundant execution of stopping the motor.

[0031] In one specific embodiment, the drive module 20 preferably employs a full-bridge drive chip. When the control module 10 verifies a conflict in the command, it sends a control command to the drive module 20 via its serial communication interface (SPI, Serial Peripheral interface) to stop the operation of the motor 30, and sets its first hardware interface high so that the drive module 20 can receive a high-level signal. Accordingly, based on the control command received by its SPI interface, the drive module 20 turns off the four switches of its bridge drive circuit, thereby stopping its operation and stopping the power output to the motor 30, thus stopping the parking brake or parking release triggered by the forward / reverse rotation of the motor. Simultaneously, setting the first hardware interface of the control module 10 high enables the drive module 20 to execute its function, causing it to turn off the two low-side switches of its bridge drive circuit to stop the operation of the motor 30.

[0032] It is understood that the low-side switching transistors in the bridge drive circuit are the two lower transistors, and the motor 30 cannot be driven normally when both lower transistors are turned off, thus stopping the motor 30. Alternatively, a high-level signal can enable the two upper transistors in the bridge drive circuit to turn off, similarly stopping the drive module 20 and consequently stopping the motor 30. No further restrictions are placed on this approach. Modifications and refinements made by those skilled in the art to the embodiments of this invention without departing from the spirit of this invention still fall within the scope of this invention's patent application.

[0033] Therefore, the dual redundancy shutdown setting can ensure that the motor 30 stops working. Even if the SPI communication of the control module 10 is abnormal or the first hardware interface fails, it can at least prevent the drive module 20 from unexpectedly driving the motor 30 to drive the caliper action, thereby improving the safety and reliability of vehicle driving.

[0034] Furthermore, based on the aforementioned drive module 20 employing a full-bridge drive chip, when the control module 10 verifies that no conflict occurs (i.e., the parking attendant's command to allow parking brake control clamping), the drive motor 30 needs to rotate forward to clamp the caliper. Therefore, the control module 10 outputs a control command to the drive module via SPI communication to close the corresponding switch, and the drive module 20 closes two diagonal switches in the bridge drive circuit according to the control command, achieving forward motor rotation. Alternatively, the parking attendant's command to allow parking brake control release requires the drive motor 30 to reverse, releasing the caliper. Therefore, the control module 10 outputs a control command to the drive module via SPI communication to close the corresponding switch, and the drive module 20 closes two other diagonal switches in the bridge drive circuit according to the control command, achieving reverse motor rotation. It can be understood that when the parking brake control does not generate the corresponding clamping / release command, i.e., the wheels are allowed to move freely, the control module 10 can output a control command to the drive module via SPI communication to turn off all switches, thus stopping the drive module 20 from operating. Furthermore, when the drive module 20 has turned off the diagonal switch on the bridge drive circuit according to the corresponding control command of the control module 10 and drives the motor forward / reverse, if the parking brake control generates a corresponding stop command, or if a stop command is transmitted from another module unit to the control module to request the current parking brake to be stopped or the parking brake to be released, then the control module 10 issues a corresponding control command to make the drive module 20 turn off the two low-side switches on the bridge drive circuit and stop the drive motor 30.

[0035] It should be noted that the above is only a preferred embodiment of electronic parking brake in practical application. The specific implementation can be adjusted according to the actual situation. For example, if other drive chips are used, the closing and opening of the corresponding switching transistors can be configured according to the actual control logic. No restrictions are imposed on this. Modifications and refinements made by those skilled in the art to the embodiments of the present invention without departing from the spirit of the present invention still fall within the scope of the invention application patent of the present invention.

[0036] Furthermore, to ensure vehicle driving safety in this embodiment, the control module 10 is also used to output a high-level signal through its first hardware interface when it cannot receive a vehicle speed status command, so that the drive module 20 can turn off the two low-side switches in the bridge drive circuit and stop the drive motor 30. It is understood that when the control module 10 cannot identify the vehicle speed, or when communication with the functional module unit that identifies the vehicle speed is abnormal, a hasty application of parking brake without knowing the current vehicle speed could easily lead to a vehicle accident. Therefore, even if the current verification command does not conflict, and the SPI communication between the control module 10 and the drive module 20 can proceed normally, it may control the corresponding switch in the drive module 20 to close with the goal of parking brake or parking release; however, at the same time, the control module 10 outputs a high-level signal through its first hardware interface to turn off the two low-side switches in the bridge drive circuit of the drive module 20. Even if the two upper switches in the bridge drive circuit are normally conducting, the motor 30 cannot be driven, thus ensuring vehicle driving safety.

[0037] It should also be noted that in practical applications, several electronic components, such as resistors and capacitors, may be installed between the control module 10 and the drive module 20. If any of these components fails, the drive module 20 may fail to receive the high-level signal output from the first hardware interface of the control module 10. Therefore, the control module 10 also monitors the electrical signals on the connection line between its first hardware interface and the drive module 20 to ensure that the drive module 20 receives a high-level signal to turn off the two low-side switches in the bridge drive circuit, and to trigger an alarm response when the drive module 20 does not receive a high-level signal, thus enabling fault diagnosis of the connection line.

[0038] Furthermore, the control module 10 is connected to the drive module 20 via its second hardware interface, and a conversion circuit is configured between its second hardware interface and the drive module 20 to convert low-level signals into high-level signals. Specifically, the control module 10 is also used for self-diagnosis, and in the event of a fault, it outputs a low-level signal through its second hardware interface, which is then converted into a high-level signal by the conversion circuit and sent to the drive module 20. This allows the drive module 20 to turn off the two low-side switches in its bridge drive circuit based on the high-level signal, thereby stopping the drive motor.

[0039] It is understandable that some interface pins of the chip are fixed low when a fault occurs. This characteristic can be used to stop the motor from working when the control module 10 fails, thus ensuring the driving safety of the vehicle.

[0040] Furthermore, the electronic parking brake system is also equipped with a battery management module 40, which supplies power to the control module 10, drive module 20, and other functional modules. In this embodiment, the battery management module 40 is also used to diagnose faults in the control module 10 and reset it when a fault occurs. In addition, the battery management module is also used for self-diagnosis. Similarly, its third hardware interface is connected to the drive module 20 through a conversion circuit. When a fault occurs, it outputs a low-level signal through the third hardware interface, which is then converted into a high-level signal by the conversion circuit and sent to the drive module 20. This allows the drive module 20 to turn off the two low-side switches in its bridge drive circuit based on the high-level signal, thus stopping the drive motor.

[0041] It is understandable that the conversion circuit connected to the control module 10 through its second hardware interface and the conversion circuit connected to the battery management module 40 through its third hardware interface can be the same conversion circuit or different conversion circuits. There are no restrictions on this. Of course, from a cost perspective, it is preferable to share a conversion circuit.

[0042] Therefore, regardless of whether the control module 10 and / or the battery management module 40 malfunction, the drive module 20 can be controlled to stop the drive motor 30 to avoid unexpected activation of the parking brake or release of the parking brake, thus greatly improving vehicle driving safety through multiple redundant controls.

[0043] The software control strategy implemented based on the aforementioned functional modules can significantly improve the safe and reliable stable operation of the electronic parking brake system. Furthermore, all these functional modules operate within the ASILD software security environment, enabling the diagnosis and identification of various hardware failures, thus ensuring the system's safety and reliability. For example, on the hardware side, the control module can utilize an ASILD MCU (Microcontroller Unit) chip equipped with an intelligent watchdog function, implementing a safety mechanism to cover random hardware failures. This ensures that when an MCU malfunctions, causing abnormal software operation, it can be diagnosed promptly and its PIN pins can enable the low-side switch of the H-bridge in the full-bridge driver chip, preventing unexpected caliper motor movements and ensuring the entire system enters a safe state. Alternatively, on the software side, the control module can partition its memory according to preset address ranges to isolate the software components. Additionally, it can monitor the program flow of task scheduling, processing, and execution at the software layer to detect over-execution, under-execution, or missed execution of software tasks.

[0044] Correspondingly, the driver module can also use an ASILD driver chip and implement a safety mechanism to cover random hardware failures. This ensures that when the driver chip malfunctions, it can be diagnosed promptly, and the corresponding switch in the H-bridge can be turned off according to the MCU chip's SPI control instructions or the enable signal of the PIN pin (i.e., a high-level signal), preventing the caliper motor from moving unexpectedly and ensuring the entire system enters a safe state. Furthermore, for some faults, the driver chip can actively shut down the H-bridge drive, putting the system into a safe state; this can be configured according to actual needs. Of course, there are no excessive restrictions on the driver module. For example, the driver module can consist of a pre-driver chip and a driver chip. Modifications and refinements made by those skilled in the art to the embodiments of this invention without departing from the spirit of this invention still fall within the scope of this invention's patent application.

[0045] In addition, the control module can monitor the voltage and current of the bridge drive circuit in the drive module to achieve open circuit fault diagnosis, short circuit fault diagnosis, etc. When diagnosing a fault, it can issue corresponding control commands through SPI communication or output an enable signal through the PIN pin to prevent the caliper motor from moving unexpectedly and ensure that the entire system enters a safe state.

[0046] In summary, this invention provides an electronic parking brake system that can cope with MCU failure and achieve redundant drive of the caliper motor to meet the high safety requirements of EPB. By verifying the clamping / release commands of the parking brake control and the parking attendant's permission for clamping / release, it determines whether a conflict has occurred and correctly controls the forward / reverse rotation of the caliper motor to achieve parking braking and parking release. Furthermore, through multiple redundant executions, it ensures that the caliper motor can be stopped when the MCU fails, the SPI communication is abnormal, or the battery management module fails, so as to avoid the caliper motor from operating unexpectedly, thereby greatly improving the reliability and safety of EPB.

[0047] This invention features high fault tolerance and robustness, ensuring that the software will not erroneously drive the caliper motor even without a request or with an erroneous request, thereby improving vehicle driving safety.

[0048] The above embodiments are merely illustrative of the principles and effects of the present invention and are not intended to limit the invention. Any person skilled in the art can modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by those skilled in the art without departing from the spirit and technical concept disclosed in the present invention should still be covered by the claims of the present invention.

[0049] In the description of this specification, references to terms such as "some embodiments," "other embodiments," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative descriptions of the above terms do not necessarily refer to the same embodiments or examples.

[0050] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0051] The above embodiments are merely illustrative of the principles and effects of the present invention and are not intended to limit the invention. Any person skilled in the art can modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by those skilled in the art without departing from the spirit and technical concept disclosed in the present invention should still be covered by the claims of the present invention.

Claims

1. An electronic parking brake system, characterized in that, include: Control module, drive module, and motor; The control module includes a serial communication interface and a first hardware interface, and the serial communication interface and the first hardware interface of the control module are respectively connected to the drive module, and the drive module is connected to the motor. The control module is used to verify the caliper control commands and the parking administrator's confirmation commands. When the verification fails, the control module outputs a corresponding control command to the drive module through its serial communication interface, and outputs a high-level signal to the drive module through its first hardware interface; and the drive module is used to control the motor to stop working according to the control command and / or the high-level signal. When the verification is successful, the control module outputs the corresponding control command to the drive module through its serial communication interface; and the drive module is used to drive the motor to rotate forward or reverse according to the control command, so as to realize parking brake or parking release. The caliper control command is automatically generated by the vehicle controller or actively triggered by the driver. The confirmation instruction from the parking attendant is automatically generated by the vehicle controller through further judgment to confirm whether parking brake or parking release is permitted.

2. The electronic parking brake system according to claim 1, characterized in that, The control module is also used to output a high-level signal through its first hardware interface when it cannot receive vehicle speed status instructions.

3. The electronic parking brake system according to claim 2, characterized in that, The control module is also used to monitor the electrical signals output by its first hardware interface, so as to trigger an alarm response when the high-level signal sent to the drive module is abnormal.

4. The electronic parking brake system according to claim 1, characterized in that, Also includes: A conversion circuit is used to convert a low-level signal into a high-level signal; the control module also includes a second hardware interface, and the second hardware interface of the control module is connected to the drive module through the conversion circuit; The control module is also used for self-diagnosis and outputs a low-level signal through its second hardware interface when a fault occurs.

5. The electronic parking brake system according to claim 4, characterized in that, Also includes: The battery management module is used to diagnose faults in the control module and reset it when a fault occurs.

6. The electronic parking brake system according to claim 5, characterized in that, The battery management module includes a third hardware interface, and the third hardware interface of the battery management module is connected to the drive module through the conversion circuit; The battery management module is also used for self-diagnosis and outputs a low-level signal through its third hardware interface when a fault occurs.

7. The electronic parking brake system according to claim 1, characterized in that, When the driving module uses a full-bridge driving chip The driving module is used to turn off four of the switching transistors according to the control command, and the driving module is also used to turn off two of the low-side switching transistors according to the high-level signal.

8. The electronic parking brake system according to claim 1, characterized in that, The control module is configured to partition its memory according to a preset address range so that the software components within it can be isolated from each other.

9. The electronic parking brake system according to claim 1, characterized in that, The control module is configured to monitor the program flow of task scheduling, processing, and execution in the software layer to detect over-execution, under-execution, or missed execution of software tasks.

10. The electronic parking brake system according to claim 1, characterized in that, The control module uses a control chip with a watchdog function and at least a vehicle safety integrity level of D; the drive module uses a drive chip with a self-diagnostic function and at least a vehicle safety integrity level of D.

Images