Electronic parking redundant system

Abstract

The invention discloses an electronic parking redundant system. The system comprises a first microcontroller unit, a second microcontroller unit, a first power management chip and a second power management chip. The first power management chip generates a change-over switch enable signal by determining a fault state of a watchdog of the first microcontroller unit, so as to change the on-off state of the first change-over switch and the second change-over switch according to the change-over switch enable signal. The second power management chip is used for determining the fault state of a watchdog of the second microcontroller unit. The first microcontroller unit controls the on-off state of the first pre-driving integrated circuit according to the on-off state of the first change-over switch so as to drive the electronic parking brake system. The second microcontroller unit is used for controlling the on-off state of the second pre-driving integrated circuit according to the take-over function starting state of the second microcontroller unit and the on-off state of the second change-over switch so as to drive the electronic parking brake system. The reliability and the stability of the electronic parking system are improved.

Description

Technical Field

[0001] The present application relates to the technical field of automotive electronics, and in particular to an electronic parking redundancy system. Background Art

[0002] The Electronic Parking Brake (EPB) system is a common system on modern vehicles, used to replace the traditional mechanical handbrake.

[0003] The independent electronic parking brake systems or the electronic parking brake systems integrated into the electronic stability control system (ESC) currently on the market do not have redundancy. Since the independent electronic parking brake systems or the electronic parking brake systems integrated into the electronic stability control system lack redundancy, when the key components of the independent electronic parking brake systems or the electronic parking brake systems integrated into the electronic stability control system fail, the entire electronic parking brake system may fail completely. This single point failure risk will increase the instability of the vehicle's braking system, which may result in the inability to stop the vehicle or release the brakes, making the electronic parking brake system unreliable.

[0004] Therefore, how to improve the stability and reliability of the electronic parking brake system is a technical problem that technicians in this field need to solve urgently. Summary of the invention

[0005] Based on the above problems, the present application provides an electronic parking redundancy system, which can improve the stability and reliability of the electronic parking brake system.

[0006] To solve the above problems, the technical solutions provided in the embodiments of the present application are as follows:

[0007] An electronic parking redundancy system, the system comprising: a first microcontroller unit, a second microcontroller unit, a first power management chip and a second power management chip;

[0008] The first microcontroller unit is connected to the second microcontroller unit and the first power management chip; the second microcontroller unit is connected to the first power management chip and the second power management chip respectively; the first microcontroller unit is also connected to the first pre-driver integrated circuit through a first switching switch; the second microcontroller unit is also connected to the second pre-driver integrated circuit through a second switching switch;

[0009] The first power management chip is used to determine the fault state of the watchdog of the first microcontroller unit, generate a switch enable signal according to the fault state of the watchdog of the first microcontroller unit, and change the on / off state of the first switch and the second switch according to the switch enable signal;

[0010] The second power management chip is used to determine the fault state of the watchdog of the second microcontroller unit;

[0011] The first microcontroller unit is used to control the on / off state of the first pre-driver integrated circuit according to the on / off state of the first switch to drive the left motor of the electronic parking brake system; when the first switch is on, the first pre-driver integrated circuit is on, and when the first switch is off, the first pre-driver integrated circuit is off;

[0012] The second microcontroller unit is used to control the on and off of the second pre-driver integrated circuit according to the start-up state of the takeover function of the second microcontroller unit and the on-off state of the second switching switch, so as to drive the right motor of the electronic parking brake system; the start-up state of the takeover function of the second microcontroller unit and the on-off state of the second switching switch are controlled by the switching switch enable signal; when the second switching switch is turned on and the takeover function of the second microcontroller unit is started, the second pre-driver integrated circuit is connected, and when the second switching switch is turned off and / or the takeover function of the second microcontroller unit is not started, the second pre-driver integrated circuit is disconnected.

[0013] In one possible implementation,

[0014] When the first microcontroller unit fails and the first power management chip determines that the fault state of the watchdog of the first microcontroller unit is a fault, the switch enable signal is 0;

[0015] The first power management chip is used to switch the on / off state of the first switch to off and switch the on / off state of the second switch to on according to the switch enable signal.

[0016] In one possible implementation,

[0017] When the first microcontroller unit fails and the first power management chip determines that the fault state of the watchdog of the first microcontroller unit is a fault, the switch enable signal is 0;

[0018] The second microcontroller unit is used to start its takeover function according to the switch enable signal.

[0019] In one possible implementation,

[0020] When the first microcontroller unit fails and the first power management chip determines that the fault state of the watchdog of the first microcontroller unit is not faulty, the first microcontroller unit controls the on / off state of the first switching switch to be switched to closed, and controls the on / off state of the second switching switch to be switched to open.

[0021] In one possible implementation,

[0022] When the first microcontroller unit fails and the first power management chip determines that the failure state of the watchdog of the first microcontroller unit is not failed, the first microcontroller unit generates a takeover communication message and sends it to the second microcontroller unit;

[0023] When the second microcontroller unit receives the takeover communication message, the second microcontroller unit is used to start its takeover function.

[0024] In one possible implementation,

[0025] When the first microcontroller unit is normal and the second microcontroller unit fails, the second power management chip is used to detect whether the watchdog of the second microcontroller unit fails;

[0026] When the second power management chip determines that the fault state of the watchdog of the second microcontroller unit is a fault, the second power management chip is used to generate a reset signal and send the reset signal to the first microcontroller unit;

[0027] When the first microcontroller unit receives the reset signal, the first microcontroller unit is used to disable the takeover function of the second microcontroller unit.

[0028] In one possible implementation,

[0029] When the second power management chip determines that the fault state of the watchdog of the second microcontroller unit is a fault, the first microcontroller unit is further used to calculate the disconnection time with the second microcontroller unit;

[0030] When the disconnection duration is greater than or equal to a preset duration, the first microcontroller unit is used to disable a takeover function of the second microcontroller unit.

[0031] In one possible implementation,

[0032] When the second power management chip determines that the fault state of the watchdog of the second microcontroller unit is not faulty, the second microcontroller unit is used to generate a fault signal and send the fault signal to the first microcontroller unit;

[0033] When the first microcontroller unit receives the fault signal, the first microcontroller unit is used to disable the takeover function of the second microcontroller unit.

[0034] In one possible implementation,

[0035] When neither the first microcontroller unit nor the second microcontroller unit fails, the first microcontroller unit is used to control a caliper of an electronic parking brake system.

[0036] In one possible implementation,

[0037] When neither the first microcontroller unit nor the second microcontroller unit fails, the switch enable signal is 1;

[0038] The first power management chip is used to switch the on / off state of the first switch to open and switch the on / off state of the second switch to close according to the switch enable signal.

[0039] Compared with the prior art, this application has the following beneficial effects:

[0040] The present application provides an electronic parking redundant system, which includes: a first microcontroller unit, a second microcontroller unit, a first power management chip and a second power management chip. The first microcontroller unit is connected to the second microcontroller unit and the first power management chip. The second microcontroller unit is connected to the first power management chip and the second power management chip respectively. The first microcontroller unit is also connected to the first pre-driver integrated circuit through a first switching switch. The second microcontroller unit is also connected to the second pre-driver integrated circuit through a second switching switch. The first power management chip can determine the fault state of the watchdog of the first microcontroller unit, and generate a switching switch enable signal according to this state, thereby changing the on-off state of the first switching switch and the second switching switch according to the signal. The second power management chip can also determine the fault state of the watchdog of the second microcontroller unit. The first microcontroller unit is used to control the on-off of the first pre-driver integrated circuit according to the on-off state of the first switching switch. The on-off of the first pre-driver integrated circuit will directly affect the driving condition of the left motor of the electronic parking brake system. When the first switching switch is turned on, the first pre-driver integrated circuit is turned on, and when the first switching switch is turned off, the first pre-driver integrated circuit is turned off. The second microcontroller unit can also be used to control the on and off of the second pre-driver integrated circuit according to the start-up state of the takeover function of the second microcontroller unit and the on and off state of the second switch. The on and off of the second pre-driver integrated circuit will directly affect the driving condition of the right motor of the electronic parking brake system. The start-up state of the takeover function of the second microcontroller unit and the on and off state of the second switch are both controlled by the switch enable signal, and the second pre-driver integrated circuit is turned on when the second switch is turned on and the takeover function of the second microcontroller unit is started, and the second pre-driver integrated circuit is disconnected when the second switch is turned off and / or the takeover function of the second microcontroller unit is not started. The present application includes two microcontroller units and two power management chips, and redundancy is achieved through dual design. Once one unit or chip fails, the other can take over the work, thereby improving the reliability and stability of the system. At the same time, the first power management chip and the second power management chip are respectively used to determine whether the watchdog of the corresponding microcontroller unit is faulty, realizing independent error judgment and processing, and preventing a single fault from affecting the entire system. In addition, a switch enable signal is generated according to the watchdog fault state, thereby changing the state of the switch, ensuring that the electronic parking brake system can be switched to a normal working state in time, and ensuring the safety of the vehicle. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0042] Figure 1 A structural diagram of an electronic parking redundancy system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0043] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0044] Redundancy refers to the use of multiple spare components or systems in critical systems to ensure system safety and reliability.

[0045] Standalone EPB is an independent electronic parking brake system, usually controlled by a dedicated module. This EPB system can work independently of other vehicle systems and has relatively high flexibility and reliability. It is relatively simple in operation and maintenance, but requires additional space to install the system.

[0046] EPB integrated in ESC: ESC (Electronic Stability Control) is an electronic stability control system. Some vehicles integrate EPB into ESC and implement EPB functions through ESC modules. This integration method can reduce system complexity and cost, while improving the integration and performance of the vehicle system.

[0047] The current stand-alone EPB or EPB integrated in ESC on the market lacks redundancy. Due to the lack of redundancy in these systems, when a key component fails, the entire electronic parking brake system may fail completely, causing the vehicle's braking system to be unstable, or even unable to stop or release the brake, making the electronic parking brake system unreliable.

[0048] In order to solve this problem, an electronic parking redundant system is provided in an embodiment of the present application. The electronic parking redundant system includes a first microcontroller unit, a second microcontroller unit, a first power management chip and a second power management chip. The first microcontroller unit is connected to the second microcontroller unit and the first power management chip, the second microcontroller unit is connected to the first power management chip and the second power management chip respectively, the first microcontroller unit is connected to the first pre-driver integrated circuit through the first switch, and the second microcontroller unit is connected to the second pre-driver integrated circuit through the second switch. The first power management chip is used to determine the fault state of the watchdog of the first microcontroller unit, generate a switch enable signal according to the fault state of the watchdog of the first microcontroller unit, and change the on-off state of the first switch and the second switch according to the switch enable signal. The second power management chip is used to determine the fault state of the watchdog of the second microcontroller unit. The first microcontroller unit is used to control the on-off of the first pre-driver integrated circuit according to the on-off state of the first switch to drive the electronic parking brake system. When the first switch is turned on, the first pre-driver integrated circuit is a circuit, and when the first switch is turned off, the first pre-driver integrated circuit is a circuit break. The second microcontroller unit is used to control the on and off of the second pre-driver integrated circuit according to the start state of the takeover function of the second microcontroller unit and the on and off state of the second switch to drive the electronic parking brake system. The start state of the takeover function of the second microcontroller unit and the on and off state of the second switch are controlled by the switch enable signal. When the second switch is turned on and the takeover function of the second microcontroller unit is started, the second pre-driver integrated circuit is a passage. When the second switch is turned off and / or the takeover function of the second microcontroller unit is not started, the second pre-driver integrated circuit is an open circuit. The present application includes two microcontroller units and two power management chips, and redundancy is achieved through a dual design. Once one unit or chip fails, the other can take over the work, thereby improving the reliability and stability of the system. At the same time, the first power management chip and the second power management chip are respectively used to determine whether the watchdog of the corresponding microcontroller unit is faulty, realizing independent error judgment and processing, and preventing a single fault from affecting the entire system. In addition, a switch enable signal is generated according to the watchdog fault state, thereby changing the state of the switch to ensure that the electronic parking brake system can be switched to a normal working state in time to ensure the safety of the vehicle.

[0049] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0050] See also Figure 1 , Figure 1 This is a structural diagram of an electronic parking redundancy system provided in an embodiment of the present application. Figure 1 The electronic parking redundancy system shown includes: two microcontroller units (MCU) and two power management chips (System Basis Chip, SBC), specifically including: a first microcontroller unit 101, a second microcontroller unit 102, a first power management chip 103 and a second power management chip 104.

[0051] The first microcontroller unit 101 is connected to the second microcontroller unit 102 and the first power management chip 103. The second microcontroller unit 102 is connected to the first power management chip 103 and the second power management chip 104 respectively. The first microcontroller unit 101 is also connected to the first pre-driver integrated circuit 107 through the first switch 105. The second microcontroller unit 102 is also connected to the second pre-driver integrated circuit 108 through the second switch 106.

[0052] The first power management chip 103 is used to determine the fault state of the watchdog of the first microcontroller unit, generate a switch enable signal according to the fault state of the watchdog of the first microcontroller unit, and change the opening and closing states of the first switch and the second switch according to the switch enable signal.

[0053] Among them, the watchdog is usually a timer or monitor used to monitor the operating status of the microcontroller, and will be reset periodically when the system is running normally.

[0054] When the watchdog fails, it usually causes the following:

[0055] The system stops responding or does not work properly;

[0056] The watchdog timer times out and is not reset in time;

[0057] Expected timing or acknowledgement signal from the microcontroller is missing.

[0058] In a possible implementation, in order to detect a failure of the watchdog, the system may adopt, but is not limited to, the following methods:

[0059] Monitor the status of the watchdog timer: Check the count status of the watchdog timer regularly. If the timer is not reset or times out, it may indicate that the watchdog is faulty.

[0060] Detect the running status of the microcontroller: Monitor the running status and response of the microcontroller. If there is an abnormality or it stops responding, it may be a manifestation of a watchdog failure.

[0061] Introduce hardware monitoring circuit: By introducing hardware monitoring circuit or dedicated watchdog monitoring chip, real-time monitoring and fault detection of watchdog status can be achieved to ensure the reliability and stability of the system.

[0062] Through the above method, the fault status of the watchdog can be detected and identified in time.

[0063] The second power management chip 104 is used to determine the fault status of the watchdog of the second microcontroller unit 102 .

[0064] It should be noted that the situation in which the watchdog of the second microcontroller unit 102 fails is similar to the situation in which the watchdog of the first microcontroller unit 101 fails, so the same method can be used to detect the failure of the watchdog.

[0065] The first microcontroller unit 101 is used to control the on / off state of the first pre-driver integrated circuit 107 according to the on / off state of the first switch 105 to drive the left motor of the electronic parking brake system.

[0066] When the first switch 105 is turned on, the first pre-driver integrated circuit 107 is connected, and when the first switch 105 is turned off, the first pre-driver integrated circuit 107 is disconnected.

[0067] The electronic parking brake system usually consists of an electric actuator (motor), a control unit and a sensor, and is used to replace the traditional handbrake system. The left motor refers to the electric actuator located on the left side of the electronic parking brake system, which receives signals through the control unit and performs corresponding braking operations. This electric actuator can release or apply braking force according to the control signal, thereby realizing the electronic parking brake function. The left motor usually works in coordination with the right motor to ensure that the vehicle stops safely.

[0068] The second microcontroller unit 102 is used to control the on-off of the second pre-driver integrated circuit 108 according to the start-up state of the takeover function of the second microcontroller unit 104 and the on-off state of the second switch 106 to drive the right motor of the electronic parking brake system.

[0069] The start state of the takeover function of the second microcontroller unit 102 and the on / off state of the second switch 104 are controlled by the switch enable signal. When the second switch 106 is turned on and the takeover function of the second microcontroller unit 102 is started, the second pre-driver integrated circuit 108 is a circuit, and when the second switch 106 is turned off and / or the takeover function of the second microcontroller unit 102 is not started, the second pre-driver integrated circuit 108 is an open circuit.

[0070] Specifically, the second microcontroller unit 102 determines whether to transmit current to the second pre-driver integrated circuit 108 by monitoring the start-up state of the takeover function of the second microcontroller unit 104 and the state of the second switch 106. When the second switch 106 is turned on and the takeover function of the second microcontroller unit 102 is started, it means that the pre-driver integrated circuit 108 forms a path with the circuit and can provide current to the right motor of the electronic parking brake system, thereby driving the right motor of the electronic parking brake system. When the second switch 106 is turned off or the takeover function of the second microcontroller unit 102 is not started, the circuit of the pre-driver integrated circuit 108 is disconnected and stops providing current to the right motor of the electronic parking brake system. When the second switch 106 is turned off and the takeover function of the second microcontroller unit 102 is not started, the circuit of the pre-driver integrated circuit 108 is also disconnected and stops providing current to the right motor of the electronic parking brake system.

[0071] In a possible implementation, when the first microcontroller unit 101 fails and the first power management chip 103 determines that the failure state of the watchdog of the first microcontroller unit 101 is failure, the switch enable signal is switched to 0.

[0072] The first power management chip 103 is used to switch the on / off state of the first switch 105 to off and the on / off state of the second switch 106 to on according to the switch enable signal (the switch enable signal is 0).

[0073] When the first microcontroller unit 101 fails and the first power management chip 103 determines that the fault state of the watchdog of the first microcontroller unit 101 is a fault, it means that the main control unit in the EPB system has encountered a fault, and the fault state has been confirmed by the first power management chip 103. This means that the EPB system needs to enable a backup plan or take other measures to ensure the normal operation and stability of the system. At this time, the first power management chip 103 will generate a switch enable signal, and the value of the signal is 0. In this case, the first power management chip 103 controls the state of the first switch 105 to switch from open to closed according to the switch enable signal (i.e., 0), and switches the state of the second switch 106 from closed to open.

[0074] In a possible implementation, when the first microcontroller unit 101 fails and the first power management chip 103 determines that the failure state of the watchdog of the first microcontroller unit 101 is failure, the switch enable signal is switched to 0.

[0075] The second microcontroller unit 102 is used to start its takeover function according to the switch enable signal (the switch enable signal is 0).

[0076] When the first microcontroller unit 101 fails and the first power management chip 103 determines that the fault state of the watchdog of the first microcontroller unit 101 is a fault, a switch enable signal will be generated, and the value of the signal is 0. In this case, the second microcontroller unit 102 will start its takeover function according to the switch enable signal (i.e., 0). In other words, the second microcontroller unit 102 will take over the function of the first microcontroller unit 101 to ensure that the EPB system can continue to operate normally even if the first microcontroller unit 101 fails. This design helps to improve the robustness and reliability of the system and ensure that the EPB system can continue to work even if a fault occurs.

[0077] In a possible implementation, when the first microcontroller unit 101 fails and the first power management chip 103 determines that the fault state of the watchdog of the first microcontroller unit 101 is not a fault, the EPB system can remain stable and continue to perform tasks, so the EPB system can continue to rely on the first microcontroller unit 101 to maintain normal operation. At this time, it is not necessary to use the first power management chip 103 to control the opening and closing states of the first switch 105 and the second switch 106 through the enable signal control, and the opening and closing states of the first switch 105 can be directly controlled by the first microcontroller unit 101 to switch to closed, and the opening and closing states of the second switch 106 can be controlled to switch to open.

[0078] In one possible implementation, when the first microcontroller unit 101 fails and the first power management chip 103 determines that the fault state of the watchdog of the first microcontroller unit 101 is not faulty, the first microcontroller unit 101 generates a takeover communication message and sends it to the second microcontroller unit 102, so that the second microcontroller unit 102 starts its takeover function.

[0079] When the second microcontroller unit 102 receives the takeover communication message sent by the first microcontroller unit 101 , the second microcontroller unit 102 activates its takeover function.

[0080] In a possible implementation, when the first microcontroller unit 101 is normal and the second microcontroller unit 102 is faulty, the second power management chip 104 detects whether the watchdog of the second microcontroller unit 102 is faulty.

[0081] When the second power management chip 104 determines that the fault state of the watchdog of the second microcontroller unit 102 is a fault, it means that the second microcontroller unit 102 in the EPB system has a fault, and the watchdog function of the microcontroller cannot work properly. In this case, the EPB system cannot perform its designed functions through the second microcontroller unit 102, and the watchdog function cannot provide a monitoring and recovery mechanism for the state of the second microcontroller unit 102. At this time, the second power management chip 104 will generate a reset signal and send the reset signal to the first microcontroller unit 101.

[0082] When the first microcontroller unit 101 receives the reset signal generated by the second power management chip 104 , the first microcontroller unit 101 will immediately disable the takeover function of the second microcontroller unit.

[0083] In a possible implementation, when the second power management chip 104 determines that the fault state of the watchdog of the second microcontroller unit 102 is a fault, the first microcontroller unit 101 calculates the disconnection time length with the second microcontroller unit 102 .

[0084] When the disconnection time between the first microcontroller unit 101 and the second microcontroller unit 102 is greater than or equal to the preset time, it indicates that there may be a serious problem with the second microcontroller unit 102. At this time, the first microcontroller unit 101 will actively disable the takeover function of the second microcontroller unit 102 to avoid situations that may cause abnormal operation or failure of the system.

[0085] Optionally, the specific value of the preset duration depends on the design requirements of the EPB system and the tolerance for the loss of connection time. In general, the preset duration should be long enough to avoid too many false alarms, but short enough to ensure that timely measures can be taken when the second microcontroller unit 102 fails. The preset duration may vary according to specific system requirements and can be adjusted according to the actual situation and performance requirements of the system. Typically, the preset duration can be set to between a few seconds and a few minutes to ensure that timely switching or other necessary measures can be taken when the second microcontroller unit 102 fails.

[0086] In one possible implementation, when the second power management chip 104 determines that the fault state of the watchdog of the second microcontroller unit 102 is not faulty but the second microcontroller unit 102 itself has a fault, the second microcontroller unit 102 itself will generate a fault signal and send the fault signal to the first microcontroller unit 101.

[0087] Once the first microcontroller unit 101 receives the fault signal, the first microcontroller unit 101 will disable the takeover function of the second microcontroller unit 102 .

[0088] In other words, even if the watchdog function of the second microcontroller unit 102 is working properly, if the second microcontroller unit 102 itself fails, it will send a fault signal to the first microcontroller unit 101. Once the first microcontroller unit 101 receives this fault signal, it will take measures to disable the takeover function of the second microcontroller unit 102 to avoid situations that may cause abnormal operation or failure of the system.

[0089] In a possible implementation, when neither the first microcontroller unit 101 nor the second microcontroller unit 102 fails, the first microcontroller unit 101 is used to control the caliper of the electronic parking brake system, so as to implement the EPB parking function.

[0090] When the EPB system operates normally and both microcontroller units are working properly, the first microcontroller unit 101 is responsible for controlling the caliper in the electronic parking brake system. The electronic parking brake system is a braking system that operates the vehicle through electronic control, and the caliper is a key component in it, which is responsible for applying braking force to control the parking state of the vehicle. Therefore, under normal circumstances, the first microcontroller unit 101 will be responsible for managing and controlling this part of the function to ensure the normal operation and safety of the electronic parking brake system.

[0091] In a possible implementation, when neither the first microcontroller unit 101 nor the second microcontroller unit 102 fails, when the switch enable signal is 1, the first power management chip 103 controls the states of the first and second switches according to the enable signal.

[0092] Specifically, when the enable signal is 1, the first power management chip 103 switches the on / off state of the first switch 105 to on, and switches the on / off state of the second switch 106 to off. This means that the first power management chip 103 implements the corresponding power switching operation in the circuit by controlling the states of the two switches. Such a design can ensure that under normal circumstances, the switch can be switched according to the set logic state to provide the power supply and function control required by the system.

[0093] Optionally, the safety level of the first microcontroller unit 101 and the first power management chip 103 is ASIL D. The safety level of the second microcontroller unit 102 and the second power management chip 104 is ASIL B.

[0094] ASIL is the abbreviation of Automotive Safety Integrity Level, which is used to describe the safety requirements of automotive electronic systems. ASIL is divided into four levels: A, B, C and D, among which D level represents the highest safety integrity requirements, while B level is relatively low.

[0095] Specifically: ASIL D (Automotive Safety Integrity Level D) represents the highest level of safety integrity requirements and is applicable to automotive electronic systems that may cause serious injury or life-threatening situations in the event of a failure, such as braking systems, steering systems and other critical safety systems.

[0096] ASIL B (Automotive Safety Integrity Level B) indicates relatively low safety integrity requirements and is applicable to automotive electronic systems whose functions are important but will not cause serious injury or life-threatening in the event of a failure, such as non-critical safety systems such as in-vehicle entertainment systems and air-conditioning systems.

[0097] The present application provides an electronic parking redundant system, which includes a first microcontroller unit, a second microcontroller unit, a first power management chip and a second power management chip. The first microcontroller unit is connected to the second microcontroller unit and the first power management chip, the second microcontroller unit is connected to the first power management chip and the second power management chip respectively, the first microcontroller unit is connected to the first pre-driver integrated circuit through the first switch, and the second microcontroller unit is connected to the second pre-driver integrated circuit through the second switch. The first power management chip is used to determine the fault state of the watchdog of the first microcontroller unit, generate a switch enable signal according to the fault state of the watchdog of the first microcontroller unit, and change the on-off state of the first switch and the second switch according to the switch enable signal. The second power management chip is used to determine the fault state of the watchdog of the second microcontroller unit. The first microcontroller unit is used to control the on-off of the first pre-driver integrated circuit according to the on-off state of the first switch to drive the electronic parking brake system. The second microcontroller unit is used to control the on-off of the second pre-driver integrated circuit according to the start-up state of the takeover function of the second microcontroller unit and the on-off state of the second switch to drive the electronic parking brake system. The present application includes two microcontroller units and two power management chips, and realizes redundancy through dual design. Once one unit or chip fails, the other can take over the work, which improves the reliability and stability of the system. At the same time, the first power management chip and the second power management chip are respectively used to determine whether the watchdog of the corresponding microcontroller unit is faulty, realizing independent error judgment and processing, and preventing a single fault from affecting the entire system.

[0098] It should be noted that each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. Some or all of them can be selected according to actual needs to achieve the purpose of the embodiment scheme. Ordinary technicians in this field can understand and implement it without paying creative work.

[0099] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An electronic parking redundancy system, characterized in that: The system comprises: a first microcontroller unit, a second microcontroller unit, a first power management chip and a second power management chip; The first microcontroller unit is connected to the second microcontroller unit and the first power management chip; the second microcontroller unit is connected to the first power management chip and the second power management chip respectively; the first microcontroller unit is also connected to the first pre-driver integrated circuit through a first switching switch; the second microcontroller unit is also connected to the second pre-driver integrated circuit through a second switching switch; The first power management chip is used to determine the fault state of the watchdog of the first microcontroller unit, generate a switch enable signal according to the fault state of the watchdog of the first microcontroller unit, and change the on / off state of the first switch and the second switch according to the switch enable signal; The second power management chip is used to determine the fault state of the watchdog of the second microcontroller unit; The first microcontroller unit is used to control the on / off state of the first pre-driver integrated circuit according to the on / off state of the first switch to drive the left motor of the electronic parking brake system; when the first switch is on, the first pre-driver integrated circuit is on, and when the first switch is off, the first pre-driver integrated circuit is off; The second microcontroller unit is used to control the on and off of the second pre-driver integrated circuit according to the start-up state of the takeover function of the second microcontroller unit and the on-off state of the second switching switch, so as to drive the right motor of the electronic parking brake system; the start-up state of the takeover function of the second microcontroller unit and the on-off state of the second switching switch are controlled by the switching switch enable signal; when the second switching switch is turned on and the takeover function of the second microcontroller unit is started, the second pre-driver integrated circuit is connected, and when the second switching switch is turned off and / or the takeover function of the second microcontroller unit is not started, the second pre-driver integrated circuit is disconnected.

2. The system according to claim 1, characterized in that When the first microcontroller unit fails and the first power management chip determines that the fault state of the watchdog of the first microcontroller unit is a fault, the switch enable signal is 0; The first power management chip is used to switch the on / off state of the first switch to off and switch the on / off state of the second switch to on according to the switch enable signal.

3. The system according to claim 1, characterized in that When the first microcontroller unit fails and the first power management chip determines that the fault state of the watchdog of the first microcontroller unit is a fault, the switch enable signal is 0; The second microcontroller unit is used to start its takeover function according to the switch enable signal.

4. The system according to claim 1, characterized in that When the first microcontroller unit fails and the first power management chip determines that the fault state of the watchdog of the first microcontroller unit is not faulty, the first microcontroller unit controls the on / off state of the first switching switch to be switched to closed, and controls the on / off state of the second switching switch to be switched to open.

5. The system according to claim 1, characterized in that When the first microcontroller unit fails and the first power management chip determines that the failure state of the watchdog of the first microcontroller unit is not failed, the first microcontroller unit generates a takeover communication message and sends it to the second microcontroller unit; When the second microcontroller unit receives the takeover communication message, the second microcontroller unit is used to start its takeover function.

6. The system according to claim 1, characterized in that When the first microcontroller unit is normal and the second microcontroller unit fails, the second power management chip is used to detect whether the watchdog of the second microcontroller unit fails; When the second power management chip determines that the fault state of the watchdog of the second microcontroller unit is a fault, the second power management chip is used to generate a reset signal and send the reset signal to the first microcontroller unit; When the first microcontroller unit receives the reset signal, the first microcontroller unit is used to disable the takeover function of the second microcontroller unit.

7. The system according to claim 6, characterized in that When the second power management chip determines that the fault state of the watchdog of the second microcontroller unit is a fault, the first microcontroller unit is further used to calculate the disconnection time with the second microcontroller unit; When the disconnection duration is greater than or equal to a preset duration, the first microcontroller unit is used to disable a takeover function of the second microcontroller unit.

8. The system according to claim 6, characterized in that When the second power management chip determines that the fault state of the watchdog of the second microcontroller unit is not faulty, the second microcontroller unit is used to generate a fault signal and send the fault signal to the first microcontroller unit; When the first microcontroller unit receives the fault signal, the first microcontroller unit is used to disable the takeover function of the second microcontroller unit.

9. The system according to claim 1, characterized in that When neither the first microcontroller unit nor the second microcontroller unit fails, the first microcontroller unit is used to control a caliper of an electronic parking brake system.

10. The system according to claim 1, characterized in that When neither the first microcontroller unit nor the second microcontroller unit fails, the switch enable signal is 1; The first power management chip is used to switch the on / off state of the first switch to open and switch the on / off state of the second switch to close according to the switch enable signal.

Images