Vehicle redundancy safety control method and system

Abstract

The invention provides a vehicle redundancy safety control method and system.The method comprises the steps that whether a drive-by-wire chassis meets the drive-by-wire brake condition or not is judged; if the drive-by-wire chassis does not meet the drive-by-wire brake condition, a first brake level signal is sent to a redundancy control unit; wherein the redundancy control unit is used for sending a first pneumatic braking instruction to the drive-by-wire chassis based on a first braking level signal; the drive-by-wire chassis is used for executing pneumatic braking operation according to the first pneumatic braking instruction; if the drive-by-wire chassis meets the drive-by-wire brake condition, whether all non-brake modules on the drive-by-wire chassis report errors or not is judged; if the non-brake module reports an error, a first drive-by-wire brake instruction is sent to the drive-by-wire chassis; the drive-by-wire chassis is further used for executing the drive-by-wire brake operation according to the first drive-by-wire brake instruction. Through the method, the stability of vehicle brake-by-wire is improved.

Description

Technical Field

[0001] The present application relates to the field of intelligent driving technology, and in particular to a vehicle redundant safety control method and system. Background Art

[0002] In the application scenario of truck autonomous driving, the wire-controlled truck is an important application of autonomous driving technology in the field of commercial vehicles. It adopts wire-controlled technology to connect the control unit and the actuator through electrical signals, replacing the traditional mechanical or hydraulic drive. The wire-controlled chassis is the basis of autonomous driving applications. It integrates wire-controlled functions such as wire-controlled steering, wire-controlled braking, wire-controlled driving, and wire-controlled BCM (wire-controlled body control module).

[0003] Among them, the brake-by-wire control is to send the brake-by-wire control command to the brake-by-wire chassis through an electrical signal, and the brake-by-wire chassis performs the corresponding brake-by-wire control operation according to the received brake-by-wire control command. However, when the brake-by-wire chassis responds to the brake-by-wire control command, some brake-by-wire control-related modules in the brake-by-wire chassis need to meet certain conditions. If these modules do not meet the brake-by-wire control conditions, the brake-by-wire chassis will not respond to the brake-by-wire control command and will not be able to perform the braking operation. It can be seen that the braking stability of the current brake-by-wire chassis needs to be strengthened. Summary of the invention

[0004] In view of this, the purpose of the present application is to provide a vehicle redundant safety control method and system to improve the stability of the vehicle's wire control braking, thereby improving the vehicle's driving safety.

[0005] In a first aspect, an embodiment of the present application provides a vehicle redundant safety control method, which is applied to a domain controller in a vehicle redundant safety control system; the vehicle redundant safety control system further includes: a wire-controlled chassis and a redundant control unit; the method includes:

[0006] Determining whether the wire-controlled chassis meets the wire-controlled braking condition;

[0007] If the wire-controlled chassis does not meet the wire-controlled braking condition, a first brake level signal is sent to the redundant control unit; wherein the redundant control unit is used to send a first pneumatic braking instruction to the wire-controlled chassis based on the first brake level signal; and the wire-controlled chassis is used to perform a pneumatic braking operation according to the first pneumatic braking instruction;

[0008] If the wire-controlled chassis meets the wire-controlled braking condition, determining whether each non-braking module on the wire-controlled chassis reports an error;

[0009] If the non-braking module reports an error, a first brake-by-wire instruction is sent to the brake-by-wire chassis; wherein the brake-by-wire chassis is further configured to perform a brake-by-wire operation according to the first brake-by-wire instruction.

[0010] In combination with the first aspect, the embodiment of the present application provides a first possible implementation of the first aspect, wherein the domain controller further includes a redundant bumper unit; and the method further includes:

[0011] Detecting whether the redundant bumper unit is triggered; wherein the redundant bumper unit is triggered when a vehicle collides;

[0012] If the redundant bumper unit is triggered, a second braking level signal is sent to the redundant control unit; wherein the redundant control unit is used to send a second pneumatic braking instruction to the wire-controlled chassis based on the second braking level signal; the wire-controlled chassis is used to perform pneumatic braking operations according to the second pneumatic braking instruction.

[0013] In combination with the first possible implementation manner of the first aspect, the embodiment of the present application provides a second possible implementation manner of the first aspect, wherein the domain controller includes a high-side interface and an AD interface; the redundant control unit includes a normally open relay and a normally closed relay; the wire-controlled chassis includes an IO interface; the normally open relay includes a first normally open input terminal, a second normally open input terminal, a first normally open output terminal, and a second normally open output terminal; the normally closed relay includes a first normally closed input terminal, a second normally closed input terminal, a first normally closed output terminal, and a second normally closed output terminal; wherein the second normally open input terminal is grounded, the second normally closed input terminal is grounded, and the first normally closed output terminal is connected to VCC;

[0014] If the control-by-wire chassis does not meet the control-by-wire braking condition, sending a first braking level signal to the redundant control unit includes:

[0015] Receiving a level signal indicating whether the redundant bumper unit is triggered from the redundant bumper unit through the AD interface;

[0016] If the wire-controlled chassis does not meet the wire-controlled braking condition and the redundant bumper unit is not triggered, a first high-impedance state level signal is sent to the first normally open output terminal through the high-side interface; wherein the redundant bumper unit is used to send a first high-level signal to the first normally open input terminal when the redundant bumper unit is not triggered;

[0017] The redundant control unit, when used to send a first pneumatic braking instruction to the wire-controlled chassis based on the first braking level signal, includes:

[0018] The first normally open input terminal is used to conduct with the second normally open input terminal when receiving the first high level signal; wherein, when the first normally open input terminal receives the first high level signal, the first normally open output terminal is conducted with the second normally open output terminal;

[0019] The first normally open output end is used to send the first high-impedance state level signal received from the high-side interface to the first normally closed input end through the second normally open output end after the first normally open output end and the second normally open output end are connected;

[0020] The first normally closed input terminal is used to be connected to the second normally closed input terminal when receiving the first high-impedance state level signal; wherein, when the first normally closed input terminal receives the first high-impedance state level signal, the first normally closed output terminal is connected to the second normally closed output terminal; when the first normally closed output terminal is connected to the second normally closed output terminal, the second high level signal representing the first pneumatic braking instruction is output to the IO interface through the VCC connected to the first normally closed output terminal, the first normally closed output terminal, the second normally closed output terminal in sequence.

[0021] In combination with the second possible implementation manner of the first aspect, the embodiment of the present application provides a third possible implementation manner of the first aspect, wherein the redundant bumper unit comprises: a first normally closed travel switch and a second normally closed travel switch connected in series; one end of the first normally closed travel switch away from the second normally closed travel switch is connected to VCC; one end of the second normally closed travel switch away from the first normally closed travel switch is connected to the first normally open input end; when the redundant bumper unit is triggered, the first normally closed travel switch and / or the second normally closed travel switch are disconnected; when the redundant bumper unit is not triggered, the first normally closed travel switch and the second normally closed travel switch are closed;

[0022] The redundant bumper unit, when used to send a first high level signal to the first normally open input terminal when the redundant bumper unit is not triggered, comprises:

[0023] The VCC connected to the first normally closed travel switch is used to output a first high level signal to the first normally open input terminal through the closed first normally closed travel switch and the second normally closed travel switch in sequence when the redundant bumper unit is not triggered.

[0024] In combination with the third possible implementation manner of the first aspect, the embodiment of the present application provides a fourth possible implementation manner of the first aspect, wherein if the redundant bumper unit is triggered, sending a second brake level signal to the redundant control unit includes:

[0025] receiving a first floating state level signal indicating that the redundant bumper unit is triggered from the redundant bumper unit through the AD interface; wherein, when the redundant bumper unit is triggered, the redundant bumper unit sends the first floating state level signal to the first normally open input terminal;

[0026] If the redundant bumper unit is triggered, a second high-impedance state level signal is sent to the first normally open output terminal through the high-side interface;

[0027] Among them, when the first normally open input terminal receives the first floating state level signal, the first normally open output terminal and the second normally open output terminal are not connected, so that the first normally closed input terminal receives the second floating state level signal; when the first normally closed input terminal receives the second floating state level signal, the first normally closed output terminal and the second normally closed output terminal are connected, so that the VCC connected to the first normally closed output terminal outputs the third high level signal used to characterize the second brake level signal to the IO interface in sequence through the first normally closed output terminal and the second normally closed output terminal.

[0028] In combination with the third possible implementation of the first aspect, the embodiment of the present application provides a fifth possible implementation of the first aspect, wherein the redundant bumper unit further includes a bypass normally open switch; one end of the bypass normally open switch is connected to VCC, and the other end is respectively connected to the first normally open input end, the AD interface, and an end of the second normally closed travel switch away from the first normally closed travel switch; if the redundant bumper unit is triggered, after sending a second brake level signal to the redundant control unit, the method further includes:

[0029] When the vehicle collides and is braked, if it is necessary to restart the vehicle, and at least one of the first normally closed travel switch, the second normally closed travel switch, and the line between the VCC connected to the first normally closed travel switch and the first normally open input terminal is disconnected, the bypass normally open switch is controlled to be closed, and when the bypass normally open switch is closed, a fourth high level signal transmitted from the VCC connected to the bypass normally open switch is received through the AD interface; wherein, when the bypass normally open switch is closed, the first normally open input terminal receives the fourth high level signal transmitted from the VCC connected to the bypass normally open switch;

[0030] sending a fifth high level signal to the first normally open output terminal through the high-side interface; wherein, when the first normally open input terminal receives the fourth high level signal, the first normally open output terminal and the second normally open output terminal are connected, so as to transmit the fifth high level signal to the first normally closed input terminal through the connected first normally open output terminal and the second normally open output terminal;

[0031] When the first normally closed input terminal receives the fifth high level signal, the first normally closed output terminal and the second normally closed output terminal are disconnected, so that the IO interface receives the fifth floating state level signal for indicating a vehicle start command.

[0032] In combination with the first aspect, the embodiment of the present application provides a sixth possible implementation of the first aspect, wherein if the control-by-wire chassis meets the control-by-wire braking condition, after determining whether each non-braking module on the control-by-wire chassis reports an error, the method further includes:

[0033] If the non-brake module does not report an error, it is determined whether there is a wire-controlled emergency brake command at present; wherein the brake control amount of the wire-controlled brake contained in the wire-controlled emergency brake command is greater than the preset control amount;

[0034] If there is a wire-controlled emergency brake command currently, a second wire-controlled brake command is sent to the wire-controlled chassis; the wire-controlled chassis is used to perform a wire-controlled brake operation according to the second wire-controlled brake command;

[0035] During the process in which the brake-by-wire chassis performs a brake-by-wire operation according to the second brake-by-wire instruction, determining whether the actual deceleration of the vehicle reaches a first threshold within a target time period;

[0036] If the actual deceleration of the vehicle does not reach the first threshold, a third braking level signal is sent to the redundant control unit; wherein the redundant control unit is used to send a third pneumatic braking instruction to the wire-controlled chassis based on the third braking level signal; and the wire-controlled chassis is used to perform pneumatic braking operations according to the third pneumatic braking instruction.

[0037] In combination with the sixth possible implementation of the first aspect, the embodiment of the present application provides a seventh possible implementation of the first aspect, wherein the method further includes:

[0038] If the actual deceleration of the vehicle reaches the first threshold, it is determined whether the change value of the air pressure of the gas delivered to the brake execution end of the brake module reaches the second threshold; wherein the brake execution end of the brake module is an end of the wire-controlled chassis for performing a braking operation; when the brake execution end of the brake module performs a braking operation, it is performed by the air pressure provided by the gas delivered to the brake execution end;

[0039] If the change in air pressure provided by the gas delivered to the brake actuator end does not reach the second threshold, a fourth brake level signal is sent to the redundant control unit; wherein the redundant control unit is used to send a fourth pneumatic braking instruction to the wire-controlled chassis based on the fourth brake level signal; the wire-controlled chassis is used to perform a pneumatic braking operation according to the fourth pneumatic braking instruction to transmit gas to the brake switch end of the brake module; wherein the brake switch end of the brake module controls the brake actuator end to perform a braking operation according to the received gas.

[0040] In combination with the first possible implementation manner of the first aspect, the embodiment of the present application provides an eighth possible implementation manner of the first aspect, wherein, after detecting whether the redundant bumper unit is triggered, the method further includes:

[0041] If the redundant bumper unit is not triggered, determining whether the current driving mode of the vehicle is an automatic driving mode;

[0042] The determining whether the wire-controlled chassis meets the wire-controlled braking condition includes:

[0043] If the current driving mode of the vehicle is the automatic driving mode, it is determined whether the wire-controlled chassis meets the conditions for wire-controlled braking.

[0044] In a second aspect, an embodiment of the present application further provides a vehicle redundant safety control system, the vehicle redundant safety control system comprising: a domain controller, a wire-controlled chassis, and a redundant control unit;

[0045] The domain controller is configured to determine whether the control-by-wire chassis meets the control-by-wire brake condition; and if the control-by-wire chassis does not meet the control-by-wire brake condition, send a first brake level signal to the redundant control unit;

[0046] The redundant control unit is configured to send a first pneumatic braking instruction to the control-by-wire chassis based on the first braking level signal;

[0047] The wire-controlled chassis is used to perform a pneumatic braking operation according to the first pneumatic braking instruction;

[0048] The domain controller is further configured to determine whether each non-braking module on the control-by-wire chassis reports an error if the control-by-wire chassis meets the control-by-wire braking condition; and send a first control-by-wire braking instruction to the control-by-wire chassis if the non-braking module reports an error;

[0049] The wire-controlled chassis is further configured to perform a wire-controlled braking operation according to the first wire-controlled braking instruction.

[0050] The embodiment of the present application provides a vehicle redundant safety control method and system, wherein, considering that the vehicle redundant safety control system in the prior art only includes a domain controller and a wire-controlled chassis, the domain controller can only realize vehicle braking by sending a wire-controlled brake command to the wire-controlled chassis, and the wire-controlled chassis responds to the wire-controlled brake command. However, when the wire-controlled chassis does not meet the wire-controlled brake condition, that is, when the wire-controlled chassis cannot respond to the wire-controlled brake command, the vehicle braking cannot be realized. Based on this, in this embodiment, a redundant control mechanism is added to the vehicle control system. When the wire-controlled chassis does not meet the wire-controlled brake condition, that is, when the wire-controlled chassis cannot respond to the wire-controlled brake command, a pneumatic braking request is directly sent to the wire-controlled chassis through the newly added redundant control mechanism, and the wire-controlled chassis performs a pneumatic braking operation according to the pneumatic braking command to realize the braking of the vehicle. When the wire-controlled chassis meets the wire-controlled brake condition, but the non-braking module on the wire-controlled chassis reports an error, it may be dangerous for the vehicle to continue to drive. Therefore, in this embodiment, a wire-controlled brake command is sent to the wire-controlled chassis, so that the wire-controlled chassis performs a wire-controlled brake operation according to the wire-controlled brake command, thereby realizing the braking of the vehicle. It can be seen that in this embodiment, whether the wire-controlled chassis meets the wire-controlled braking conditions or not, the vehicle can be braked, which is beneficial to improving the braking stability of the vehicle. At the same time, when the wire-controlled chassis meets the wire-controlled braking conditions but the non-braking module reports an error, the wire-controlled chassis is controlled to perform the wire-controlled braking operation, which is beneficial to ensuring vehicle safety.

[0051] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0053] Figure 1 A schematic diagram of the structure of a vehicle redundant safety control system provided by an embodiment of the present application is shown;

[0054] Figure 2 A flow chart of a vehicle redundant safety control method provided by an embodiment of the present application is shown;

[0055] Figure 3 A schematic diagram showing the structure of a second vehicle redundant safety control system provided in an embodiment of the present application is shown;

[0056] Figure 4A schematic diagram showing the structure of a third vehicle redundant safety control system provided in an embodiment of the present application is shown;

[0057] Figure 5 A flow chart of another vehicle redundant safety control method provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0058] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0059] Considering that the braking stability of the current wire-controlled chassis is not high enough, based on this, the embodiment of the present application provides a vehicle redundant safety control method and system to improve the stability of vehicle braking, thereby ensuring the driving safety of the vehicle, which is described below through an embodiment.

[0060] To facilitate understanding of this embodiment, a vehicle control method disclosed in an embodiment of this application is first described in detail. The vehicle control method is applied to a domain controller in a vehicle control system; Figure 1 As shown, the vehicle redundant safety control system also includes: a wire-controlled chassis and a redundant control unit.

[0061] In this embodiment, the vehicle may be a truck, the vehicle control system may be a truck redundant safety control system, and the vehicle redundant safety control method may be a truck redundant safety control method.

[0062] like Figure 2 As shown, the vehicle redundant safety control method includes the following steps S101-S104:

[0063] S101: Determine whether the control-by-wire chassis meets the control-by-wire braking condition.

[0064] In this embodiment, if Figure 1 As shown, the domain controller includes a first CAN (Controller Area Network) interface, the wire-controlled chassis includes a second CAN interface, and the first CAN interface (attached Figure 1 The first CAN) and the second CAN interface (attached Figure 1CAN communication can be carried out between the second CAN in the

[0065] In this embodiment, the wire-controlled chassis includes a brake module, and the brake module includes a brake execution end and a brake switch end. The brake execution end is used to execute a brake operation according to the gas at the brake execution end to brake the vehicle; the brake switch end is used as a switch of the brake execution end to control the start time of the brake execution end to execute the brake operation. In the prior art, the brake switch end is connected to the electronic brake unit through CAN communication, and the brake execution end is connected to the gas tank through a gas pipeline.

[0066] Braking by wire means that the domain controller sends a brake-by-wire command to the second CAN interface on the control-by-wire chassis through the first CAN interface. After the control-by-wire chassis receives the brake-by-wire command, the electronic brake unit sends a brake-by-wire instruction to the brake switch end of the brake module through CAN communication to indicate the start of braking. After the brake switch end of the brake module receives the brake-by-wire instruction sent by the electronic brake unit to indicate the start of braking, the brake execution end of the brake module uses the voltage provided by the gas output from the gas tank through the gas pipeline to perform the braking operation.

[0067] However, when the wire-controlled chassis responds to the wire-controlled brake command to perform the wire-controlled brake operation, some modules related to the wire-controlled brake in the wire-controlled chassis need to meet certain conditions. If these modules do not meet the wire-controlled brake conditions, the wire-controlled chassis will not respond to the wire-controlled brake command and will not be able to perform the braking operation.

[0068] Based on this, in order to ensure that the vehicle's brake-by-wire control can be executed stably, it is necessary to timely determine whether the brake-by-wire control chassis meets the conditions for brake-by-wire control based on the vehicle status feedback information.

[0069] S102: If the control-by-wire chassis does not meet the control-by-wire braking conditions, a first brake level signal is sent to a redundant control unit; wherein the redundant control unit is used to send a first pneumatic braking instruction to the control-by-wire chassis based on the first brake level signal; and the control-by-wire chassis is used to perform a pneumatic braking operation according to the first pneumatic braking instruction.

[0070] In this embodiment, when the wire-controlled chassis does not meet the wire-controlled braking conditions, the vehicle is directly braked by another braking method (i.e., the newly added pneumatic braking method). That is to say, when the wire-controlled chassis does not meet the wire-controlled braking conditions, the vehicle is not allowed to continue driving.

[0071] Among them, the newly added pneumatic braking method refers to adding a new air pipeline between the brake switch end of the brake module and the air tank. Pneumatic braking refers to the domain controller sending a first pneumatic braking command to the wire-controlled chassis. After receiving the first pneumatic braking command, the wire-controlled chassis transmits the gas in the air tank to the brake switch end of the brake module through the newly added air pipeline. The brake switch end of the brake module uses the voltage provided by the transmitted gas as a pneumatic command to indicate the start of braking. After the brake switch end of the brake module receives the pneumatic command transmitted from the newly added air pipeline to indicate the start of braking, the brake execution end of the brake module begins to use the voltage provided by the gas output from the air tank through the original air pipeline to perform braking operations.

[0072] S103: If the control-by-wire chassis meets the control-by-wire braking condition, it is determined whether each non-braking module on the control-by-wire chassis reports an error.

[0073] In this embodiment, the control-by-wire chassis also includes other modules that are irrelevant or less relevant to the control-by-wire brake. When the control-by-wire chassis meets the control-by-wire brake conditions, it is determined whether the modules that are irrelevant or less relevant to the control-by-wire brake on the control-by-wire chassis report an error.

[0074] S104: If the non-brake module reports an error, a first brake-by-wire instruction is sent to the brake-by-wire chassis; wherein the brake-by-wire chassis is further configured to perform a brake-by-wire operation according to the first brake-by-wire instruction.

[0075] In this embodiment, if an error is reported in a module on the drive-by-wire chassis that is not related to or less related to the drive-by-wire braking, a first drive-by-wire braking instruction is sent to the second CAN interface via the first CAN interface, so that the drive-by-wire chassis performs a drive-by-wire braking operation according to the first drive-by-wire braking instruction to brake the vehicle by wire.

[0076] In a possible implementation, Figure 3 As shown, the domain controller also includes a redundant bumper unit; the vehicle redundant safety control method can also be performed according to the following steps S1001-S1002:

[0077] S1001: Detect whether the redundant bumper unit is triggered; wherein, when a vehicle collides, the redundant bumper unit is triggered.

[0078] Usually, the redundant bumper unit is arranged near the bumper of the vehicle. When the vehicle does not collide (the bumper does not collide), the redundant bumper unit is not triggered. When the vehicle collides (the bumper collides), the redundant bumper unit is triggered.

[0079] S1002: If the redundant bumper unit is triggered, a second braking level signal is sent to the redundant control unit; wherein the redundant control unit is used to send a second pneumatic braking instruction to the drive-by-wire chassis based on the second braking level signal; and the drive-by-wire chassis is used to perform a pneumatic braking operation according to the second pneumatic braking instruction.

[0080] In this embodiment, when a vehicle collides (a bumper collides), the vehicle is braked by pneumatic braking.

[0081] In a possible implementation, Figure 4 As shown, the domain controller includes a high-side interface and an AD interface (analog signal to digital signal interface, such as Figure 3 The redundant control unit includes a normally open relay and a normally closed relay; the wire-controlled chassis includes an IO interface (input and output interface, such as Figure 3 IO in the figure); the normally open relay includes a first normally open input terminal K1, a second normally open input terminal K2, a first normally open output terminal K3, and a second normally open output terminal K4; the normally closed relay includes a first normally closed input terminal B1, a second normally closed input terminal B2, a first normally closed output terminal B3, and a second normally closed output terminal B4; wherein the second normally open input terminal K2 is grounded, the second normally closed input terminal B2 is grounded, and the first normally closed output terminal B3 is connected to VCC (circuit power supply voltage).

[0082] When executing step S102, if the control-by-wire chassis does not meet the control-by-wire brake condition, sending the first brake level signal to the redundant control unit may be performed in accordance with the following steps S1021-S1022:

[0083] S1021: receiving a level signal indicating whether the redundant bumper unit is triggered from the redundant bumper unit through the AD interface;

[0084] S1022: If the control-by-wire chassis does not meet the conditions for control-by-wire braking and the redundant bumper unit is not triggered, a first high-impedance state level signal is sent to the first normally open output terminal through the high-side interface; wherein the redundant bumper unit is used to send a first high-level signal to the first normally open input terminal when the redundant bumper unit is not triggered.

[0085] In step S102, the redundant control unit, when used to send a first pneumatic braking instruction to the wire-controlled chassis based on the first braking level signal, includes:

[0086] The first normally open input terminal K1 is used to conduct with the second normally open input terminal K2 when receiving the first high level signal; wherein, when the first normally open input terminal K1 receives the first high level signal, the first normally open output terminal K3 is conducted with the second normally open output terminal K4;

[0087] The first normally open output terminal K3 is used to send the first high-impedance state level signal received from the high-side interface to the first normally closed input terminal B1 through the second normally open output terminal K4 after the first normally open output terminal K3 and the second normally open output terminal K4 are connected;

[0088] The first normally closed input terminal B1 is used to be connected to the second normally closed input terminal B2 when receiving the first high-impedance state level signal; wherein, when the first normally closed input terminal B1 receives the first high-impedance state level signal, the first normally closed output terminal B3 is connected to the second normally closed output terminal B4; when the first normally closed output terminal B3 is connected to the second normally closed output terminal B4, the second high level signal representing the first pneumatic braking command is output to the IO interface through the VCC connected to the first normally closed output terminal B3, the first normally closed output terminal B3, and the second normally closed output terminal B4 in sequence.

[0089] In step S103, after receiving the second high level signal indicating the first pneumatic braking instruction, the IO interface in the drive-by-wire chassis performs a pneumatic braking operation according to the first pneumatic braking instruction.

[0090] In a possible implementation, Figure 4 As shown, the redundant bumper unit includes: a first normally closed travel switch SQ1 and a second normally closed travel switch SQ2 connected in series; one end of the first normally closed travel switch SQ1 away from the second normally closed travel switch SQ2 is connected to VCC; one end of the second normally closed travel switch SQ2 away from the first normally closed travel switch SQ1 is connected to the first normally open input terminal K1; when the redundant bumper unit is triggered, the first normally closed travel switch SQ1 and / or the second normally closed travel switch SQ2 are disconnected; when the redundant bumper unit is not triggered, the first normally closed travel switch SQ1 and the second normally closed travel switch SQ2 are closed;

[0091] In step S1022, if Figure 4 As shown, the redundant control unit, when used to send a first pneumatic braking command to the wire-controlled chassis based on the first braking level signal, includes:

[0092] The VCC connected to the first normally closed travel switch SQ1 is used to output a first high level signal to the first normally open input terminal K1 through the closed first normally closed travel switch SQ1 and the second normally closed travel switch SQ2 in sequence when the redundant bumper unit is not triggered.

[0093] In a possible implementation, Figure 4 As shown, when executing step S1002, if the redundant bumper unit is triggered, sending the second brake level signal to the redundant control unit, the following steps may be specifically performed:

[0094] Receiving a first floating state level signal indicating that the redundant bumper unit is triggered from the redundant bumper unit through the AD interface; wherein, when the redundant bumper unit is triggered, the redundant bumper unit sends the first floating state level signal to the first normally open input terminal K1;

[0095] If the redundant bumper unit is triggered, a second high-impedance state level signal is sent to the first normally open output terminal K3 through the high-side interface;

[0096] Among them, when the first normally open input terminal K1 receives the first floating state level signal, the first normally open output terminal K3 and the second normally open output terminal K4 are not conductive, so that the first normally closed input terminal B1 receives the second floating state level signal; when the first normally closed input terminal B1 receives the second floating state level signal, the first normally closed output terminal B3 and the second normally closed output terminal B4 are conductive, so that the VCC connected to the first normally closed output terminal B3 outputs the third high level signal used to characterize the second brake level signal to the IO interface in sequence through the first normally closed output terminal B3 and the second normally closed output terminal B4.

[0097] In this embodiment, the first normally closed travel switch SQ1 and the second normally closed travel switch SQ2 are respectively located on both sides of the bumper. As long as a collision occurs on either side of the bumper, the normally closed travel switch (the first normally closed travel switch SQ1 or the second normally closed travel switch SQ2) corresponding to the collision side will be disconnected. At this time, the AD interface and the first normally open input terminal K1 can receive the second high-impedance state level signal from the redundant bumper unit, which is used to indicate that the redundant bumper unit is triggered.

[0098] In a possible implementation, Figure 4 As shown, the redundant bumper unit also includes a bypass normally open switch S1; one end of the bypass normally open switch S1 is connected to VCC, and the other end is respectively connected to the first normally open input terminal K1, the AD interface, and the end of the second normally closed travel switch SQ2 away from the first normally closed travel switch SQ1; after executing step S1002, if the redundant bumper unit is triggered, the second brake level signal is sent to the redundant control unit, and the vehicle control method can also be executed according to the following steps S10023-S10025:

[0099] S10023: When the vehicle collides and is braked, if it is necessary to restart the vehicle, and at least one of the first normally closed travel switch, the second normally closed travel switch, and the line between the VCC connected to the first normally closed travel switch and the first normally open input terminal is disconnected, the bypass normally open switch S1 is controlled to be closed. When the bypass normally open switch S1 is closed, the fourth high level signal transmitted from the VCC connected to the bypass normally open switch S1 is received through the AD interface; wherein, when the bypass normally open switch S1 is closed, the first normally open input terminal K1 receives the fourth high level signal transmitted from the VCC connected to the bypass normally open switch S1.

[0100] In this embodiment, after a vehicle collision causes the vehicle to brake, if the collision accident is resolved and at least one of the first normally closed travel switch SQ1, the second normally closed travel switch SQ2, and the line between VCC connected to the first normally closed travel switch SQ1 and the first normally open input terminal K1 is damaged and disconnected, by closing the bypass normally open switch S1, a fourth high level signal can still be provided to the AD interface and the first normally open input terminal K1.

[0101] S10024: Send a fifth high level signal to the first normally open output terminal K3 through the high-side interface; wherein, when the first normally open input terminal K1 receives the fourth high level signal, the first normally open output terminal K3 and the second normally open output terminal K4 are connected to transmit the fifth high level signal to the first normally closed input terminal B1 through the connected first normally open output terminal K3 and the second normally open output terminal K4.

[0102] S10025: When the first normally closed input terminal B1 receives the fifth high level signal, the first normally closed output terminal B3 and the second normally closed output terminal B4 are disconnected, so that the IO interface receives the fifth floating state level signal for indicating the vehicle start command.

[0103] In this embodiment, after a collision occurs and the vehicle brakes, if the collision accident is resolved and the first normally closed travel switch SQ1 and the second normally closed travel switch SQ2 are damaged, the fourth high level signal is provided to the AD interface and the first normally open input terminal K1 by closing the bypass normally open switch S1. As a result, the IO interface receives the fifth floating state level signal for indicating the vehicle start command. After the IO interface receives the fifth floating state level signal for indicating the vehicle start command, the wire control chassis can restart the vehicle and drive the vehicle to the vehicle maintenance site.

[0104] In a possible implementation manner, after executing step S103, the following steps S1051-S1054 may be further performed:

[0105] S1051: If the non-braking module does not report an error, determine whether there is a wire-controlled emergency brake command; wherein the brake control amount of the wire-controlled brake included in the wire-controlled emergency brake command is greater than a preset control amount.

[0106] S1052: If there is a wire-controlled emergency brake command, a second wire-controlled brake command is sent to the wire-controlled chassis; the wire-controlled chassis is used to perform a wire-controlled brake operation according to the second wire-controlled brake command.

[0107] S1053: When the wire-controlled chassis performs a brake-by-wire operation according to the second brake-by-wire instruction, it is determined whether the actual deceleration of the vehicle reaches a first threshold within a target time period.

[0108] S1054: If the actual deceleration of the vehicle does not reach the first threshold, a third braking level signal is sent to the redundant control unit; wherein the redundant control unit is used to send a third pneumatic braking instruction to the drive-by-wire chassis based on the third braking level signal; and the drive-by-wire chassis is used to perform pneumatic braking operations according to the third pneumatic braking instruction.

[0109] In this embodiment, when the actual deceleration of the vehicle does not reach the first threshold, it means that the wire control brake is not effective. At this time, pneumatic braking needs to be performed by the redundant control unit to stop the vehicle.

[0110] In a possible implementation manner, after executing step S1054, the following steps S1055-S1056 may also be performed:

[0111] S1055: If the actual deceleration of the vehicle reaches the first threshold, determine whether the change in the air pressure of the gas delivered to the brake execution end of the brake module reaches the second threshold; wherein, the brake execution end of the brake module is an end in the wire-controlled chassis used to perform braking operations; when the brake execution end of the brake execution module performs a braking operation, it is performed by the air pressure provided by the gas delivered to the brake execution end.

[0112] S1056: If the change value of the air pressure provided by the gas delivered to the brake actuator end does not reach the second threshold value, a fourth brake level signal is sent to the redundant control unit; wherein the redundant control unit is used to send a fourth pneumatic braking instruction to the wire-controlled chassis based on the fourth brake level signal; the wire-controlled chassis is used to perform a pneumatic braking operation according to the fourth pneumatic braking instruction to transmit gas to the brake switch end of the brake module; wherein the brake switch end of the brake module controls the brake actuator end to perform a braking operation according to the received gas.

[0113] For example, assuming that the air pressure of the gas delivered to the brake actuator end of the brake module when the vehicle is driving is 800KPA, when the wire control braking is normal, when the wire control chassis performs the wire control braking operation according to the second wire control braking instruction, the air pressure of the gas at the brake actuator end of the brake module may drop to 780KPA. The change value at this time is 20KPA, which is greater than the second threshold value.

[0114] In the case of brake-by-wire aging, when the brake-by-wire chassis performs brake-by-wire operation according to the second brake-by-wire instruction, the gas pressure of the brake actuator end of the brake module may change slightly, that is, the change value is less than the second threshold. At this time, it is necessary to use pneumatic braking to transmit the gas in the gas tank to the brake switch end of the brake module through the newly added air pipeline. After the brake switch end of the brake module receives the transmitted gas, the brake actuator end of the brake module starts to perform the braking operation to stop the vehicle.

[0115] In a possible implementation manner, after executing step S1001 to detect whether the redundant bumper unit is triggered, the vehicle redundant safety control method may also be executed according to the following steps:

[0116] If the redundant bumper unit is not triggered, it is determined whether the current driving mode of the vehicle is the automatic driving mode.

[0117] When executing step S101, specifically: if the current driving mode of the vehicle is the automatic driving mode, it is determined whether the wire-controlled chassis meets the wire-controlled braking conditions.

[0118] In a specific embodiment, Figure 5 As shown, the vehicle redundant safety control method can be performed according to the following steps:

[0119] S201: Initialize each submodule in the domain controller, for example, set the high-side interface to a high-level output state;

[0120] S202: Determine whether the vehicle is currently in a redundant safety protection state and has stopped; if so, stop the vehicle in the current state and wait for a second confirmation to restart the vehicle;

[0121] S203: If not, detecting whether the redundant bumper unit is triggered; wherein the redundant bumper unit is triggered when the vehicle collides;

[0122] S204: If the redundant bumper unit is triggered, a second brake level signal is sent to the redundant control unit; wherein the redundant control unit is used to send a second pneumatic braking command to the wire-controlled chassis based on the second brake level signal; and the wire-controlled chassis is used to perform a pneumatic braking operation according to the second pneumatic braking command;

[0123] If the redundant bumper unit is not triggered, determining whether the current driving mode of the vehicle is an automatic driving mode;

[0124] S205: If the current driving mode of the vehicle is the automatic driving mode, determine whether the wire-controlled chassis meets the wire-controlled braking conditions; if the current driving mode of the vehicle is the manual driving mode, do not perform the following determination and return to step S202 to avoid affecting the manual driving operation;

[0125] S206: If the control-by-wire chassis does not meet the control-by-wire braking condition, a first brake level signal is sent to the redundant control unit; wherein the redundant control unit is used to send a first pneumatic braking instruction to the control-by-wire chassis based on the first brake level signal; and the control-by-wire chassis is used to perform a pneumatic braking operation according to the first pneumatic braking instruction;

[0126] S207: If the control-by-wire chassis meets the control-by-wire braking condition, determine whether each non-braking module on the control-by-wire chassis reports an error;

[0127] S208: If the non-brake module reports an error, sending a first brake-by-wire instruction to the brake-by-wire chassis; wherein the brake-by-wire chassis is further configured to perform a brake-by-wire operation according to the first brake-by-wire instruction;

[0128] S209: If the non-brake module does not report an error, determine whether there is a wire-controlled emergency brake command at present; or, if the non-brake module reports an error, when sending a first wire-controlled brake command to the wire-controlled chassis, determine whether the current first wire-controlled brake command is a wire-controlled emergency brake command;

[0129] S210: If there is no current emergency brake-by-wire command, or the current first emergency brake-by-wire command is not an emergency brake-by-wire command, return to step S202;

[0130] If there is a wire-controlled emergency brake command, or the current first wire-controlled emergency brake command is a wire-controlled emergency brake command, a second wire-controlled brake command is sent to the wire-controlled chassis; the wire-controlled chassis is used to perform a wire-controlled brake operation according to the second wire-controlled brake command;

[0131] S211: during the process in which the wire-controlled chassis performs the wire-controlled brake operation according to the second wire-controlled brake instruction, determining whether the actual deceleration of the vehicle reaches a first threshold within a target time period;

[0132] S212: If the actual deceleration of the vehicle does not reach the first threshold, a third braking level signal is sent to the redundant control unit; wherein the redundant control unit is used to send a third pneumatic braking instruction to the control-by-wire chassis based on the third braking level signal; and the control-by-wire chassis is used to perform a pneumatic braking operation according to the third pneumatic braking instruction;

[0133] S213: If the actual deceleration of the vehicle reaches the first threshold, determine whether the change value of the air pressure of the gas delivered to the brake execution module reaches the second threshold; wherein the brake execution module is a module in the wire-controlled chassis for performing a braking operation; when the brake execution module performs a braking operation, it is performed by the air pressure provided by the gas delivered to the brake execution module;

[0134] S214: If the change value of the air pressure provided by the gas delivered to the brake execution module does not reach the second threshold value, a fourth brake level signal is sent to the redundant control unit; wherein the redundant control unit is used to send a fourth pneumatic brake command to the wire-controlled chassis based on the fourth brake level signal; the wire-controlled chassis is used to perform a pneumatic braking operation according to the fourth pneumatic brake command to transmit gas to the brake switch end of the brake module; wherein the brake switch end of the brake module controls the brake execution end to perform a braking operation according to the received gas;

[0135] If the change in the air pressure provided by the gas delivered to the brake actuation module reaches the second threshold, the process returns to step S202 .

[0136] Based on the same technical concept, the embodiment of the present application also provides a vehicle redundant safety control system, the vehicle redundant safety control system comprising: a domain controller, a wire-controlled chassis, and a redundant control unit;

[0137] The domain controller is configured to determine whether the control-by-wire chassis meets the control-by-wire brake condition; and if the control-by-wire chassis does not meet the control-by-wire brake condition, send a first brake level signal to the redundant control unit;

[0138] The redundant control unit is configured to send a first pneumatic braking instruction to the control-by-wire chassis based on the first braking level signal;

[0139] The wire-controlled chassis is used to perform a pneumatic braking operation according to the first pneumatic braking instruction;

[0140] The domain controller is further configured to determine whether each non-braking module on the control-by-wire chassis reports an error if the control-by-wire chassis meets the control-by-wire braking condition; and send a first control-by-wire braking instruction to the control-by-wire chassis if the non-braking module reports an error;

[0141] The wire-controlled chassis is further configured to perform a wire-controlled braking operation according to the first wire-controlled braking instruction.

[0142] Optionally, the domain controller further comprises a redundant bumper unit;

[0143] The domain controller is further configured to detect whether the redundant bumper unit is triggered; wherein the redundant bumper unit is triggered when a vehicle collides; and if the redundant bumper unit is triggered, a second brake level signal is sent to the redundant control unit;

[0144] The redundant control unit is further configured to send a second pneumatic braking instruction to the wire-controlled chassis based on the second braking level signal;

[0145] The wire-controlled chassis is further used to perform a pneumatic braking operation according to the second pneumatic braking instruction.

[0146] Optionally, the domain controller includes a high-side interface and an AD interface; the redundant control unit includes a normally open relay and a normally closed relay; the wire-controlled chassis includes an IO interface; the normally open relay includes a first normally open input terminal, a second normally open input terminal, a first normally open output terminal, and a second normally open output terminal; the normally closed relay includes a first normally closed input terminal, a second normally closed input terminal, a first normally closed output terminal, and a second normally closed output terminal; wherein the second normally open input terminal is grounded, the second normally closed input terminal is grounded, and the first normally closed output terminal is connected to VCC;

[0147] When the domain controller is used to send a first brake level signal to the redundant control unit if the wire-controlled chassis does not meet the wire-controlled braking condition, it is specifically used to:

[0148] Receiving a level signal indicating whether the redundant bumper unit is triggered from the redundant bumper unit through the AD interface;

[0149] If the wire-controlled chassis does not meet the wire-controlled braking condition and the redundant bumper unit is not triggered, a first high-impedance state level signal is sent to the first normally open output terminal through the high-side interface; wherein the redundant bumper unit is used to send a first high-level signal to the first normally open input terminal when the redundant bumper unit is not triggered;

[0150] The redundant control unit, when used to send a first pneumatic braking instruction to the wire-controlled chassis based on the first braking level signal, includes:

[0151] The first normally open input terminal is used to conduct with the second normally open input terminal when receiving the first high level signal; wherein, when the first normally open input terminal receives the first high level signal, the first normally open output terminal is conducted with the second normally open output terminal;

[0152] The first normally open output terminal is used to send the first high-impedance state level signal received from the high-side interface to the first normally closed input terminal through the second normally open output terminal after the first normally open output terminal and the second normally open output terminal are connected;

[0153] The first normally closed input terminal is used to be connected to the second normally closed input terminal when receiving the first high-impedance state level signal; wherein, when the first normally closed input terminal receives the first high-impedance state level signal, the first normally closed output terminal is connected to the second normally closed output terminal; when the first normally closed output terminal is connected to the second normally closed output terminal, the second high level signal representing the first pneumatic brake instruction is output to the IO interface through the VCC connected to the first normally closed output terminal, the first normally closed output terminal, and the second normally closed output terminal in sequence.

[0154] Optionally, the redundant bumper unit comprises: a first normally closed travel switch and a second normally closed travel switch connected in series; one end of the first normally closed travel switch away from the second normally closed travel switch is connected to VCC; one end of the second normally closed travel switch away from the first normally closed travel switch is connected to the first normally open input end; when the redundant bumper unit is triggered, the first normally closed travel switch and the second normally closed travel switch are disconnected; when the redundant bumper unit is not triggered, the first normally closed travel switch and / or the second normally closed travel switch are closed;

[0155] The redundant bumper unit, when used to send a first high level signal to the first normally open input terminal when the redundant bumper unit is not triggered, comprises:

[0156] The VCC connected to the first normally closed travel switch is used to output a first high level signal to the first normally open input terminal through the closed first normally closed travel switch and the second normally closed travel switch in sequence when the redundant bumper unit is not triggered.

[0157] Optionally, when the domain controller is used to send a second brake level signal to the redundant control unit if the redundant bumper unit is triggered, the controller includes:

[0158] Receiving a first floating state level signal indicating that the redundant bumper unit is triggered from the redundant bumper unit through the AD interface;

[0159] The redundant bumper unit is used to send the first floating state level signal to the first normally open input terminal when the redundant bumper unit is triggered;

[0160] The domain controller is configured to send a second high-impedance state level signal to the first normally open output terminal through the high-side interface if the redundant bumper unit is triggered;

[0161] Among them, when the first normally open input terminal receives the first floating state level signal, the first normally open output terminal and the second normally open output terminal are not connected, so that the first normally closed input terminal receives the second floating state level signal; when the first normally closed input terminal receives the second floating state level signal, the first normally closed output terminal and the second normally closed output terminal are connected, so that the VCC connected to the first normally closed output terminal outputs the third high level signal used to characterize the second brake level signal to the IO interface in sequence through the first normally closed output terminal and the second normally closed output terminal.

[0162] Optionally, the redundant bumper unit further includes a bypass normally open switch; one end of the bypass normally open switch is connected to VCC, and the other end is respectively connected to the first normally open input end, the AD interface, and an end of the second normally closed travel switch that is away from the first normally closed travel switch;

[0163] The domain controller is further used for, after the redundant bumper unit is triggered, sending a second brake level signal to the redundant control unit, when the vehicle collides and is braked, if it is necessary to restart the vehicle, and at least one of the lines between the first normally closed travel switch, the second normally closed travel switch, and the VCC connected to the first normally closed travel switch and the first normally open input terminal is disconnected, then controlling the bypass normally open switch to close, and when the bypass normally open switch is closed, receiving a fourth high level signal transmitted from the VCC connected to the bypass normally open switch through the AD interface; wherein, when the bypass normally open switch is closed, the first normally open input terminal receives the fourth high level signal transmitted from the VCC connected to the bypass normally open switch;

[0164] The domain controller is further configured to send a fifth high level signal to the first normally open output terminal through the high side interface;

[0165] The first normally open input terminal is used for, when receiving the fourth high level signal, conducting the first normally open output terminal with the second normally open output terminal, so as to transmit the fifth high level signal to the first normally closed input terminal through the conducted first normally open output terminal and the second normally open output terminal;

[0166] The first normally closed input terminal is used to disconnect the first normally closed output terminal and the second normally closed output terminal when receiving the fifth high level signal, so that the IO interface receives the fifth floating state level signal representing the vehicle start command.

[0167] Optionally, the domain controller is further configured to, if the control-by-wire chassis meets the control-by-wire braking condition, determine whether each non-braking module on the control-by-wire chassis reports an error, and if the non-braking module does not report an error, determine whether there is currently a control-by-wire emergency brake instruction; and if there is currently a control-by-wire emergency brake instruction, send a second control-by-wire brake instruction to the control-by-wire chassis;

[0168] The wire-controlled chassis is used to perform a wire-controlled brake operation according to the second wire-controlled brake instruction; wherein the brake control amount of the wire-controlled brake included in the wire-controlled emergency brake instruction is greater than a preset control amount;

[0169] The domain controller is further configured to determine whether the actual deceleration of the vehicle reaches a first threshold value within a target time period during the process in which the control-by-wire chassis performs a control-by-wire operation according to the second control-by-wire brake instruction; if the actual deceleration of the vehicle does not reach the first threshold value, send a third brake level signal to the redundant control unit;

[0170] The redundant control unit is configured to send a third pneumatic braking instruction to the control-by-wire chassis based on the third braking level signal;

[0171] The wire-controlled chassis is used to perform a pneumatic braking operation according to the third pneumatic braking instruction.

[0172] Optionally, the domain controller is further used for:

[0173] If the actual deceleration of the vehicle reaches the first threshold, it is determined whether the change value of the air pressure provided by the gas delivered to the brake execution end of the brake module reaches the second threshold; wherein the brake execution end of the brake module is an end of the wire-controlled chassis used to perform a braking operation; when the brake execution end of the brake module performs a braking operation, it is performed by the air pressure provided by the gas delivered to the brake execution end;

[0174] If the change value of the air pressure provided by the gas delivered to the brake actuation end does not reach the second threshold, sending a fourth brake level signal to the redundant control unit;

[0175] The redundant control unit is configured to send a fourth pneumatic braking instruction to the control-by-wire chassis based on the fourth braking level signal;

[0176] The wire-controlled chassis is used to perform pneumatic braking operations according to the fourth pneumatic braking instruction to transmit gas to the brake switch end of the brake module; wherein the brake switch end of the brake module controls the brake execution end to perform a braking operation according to the received gas.

[0177] Optionally, the domain controller is further configured to detect whether the redundant bumper unit is triggered, and if the redundant bumper unit is not triggered, determine whether the current driving mode of the vehicle is the automatic driving mode;

[0178] When the domain controller is used to determine whether the wire-controlled chassis meets the wire-controlled braking condition, it is specifically used to:

[0179] If the current driving mode of the vehicle is the automatic driving mode, it is determined whether the wire-controlled chassis meets the conditions for wire-controlled braking.

[0180] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the system described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0181] In the several embodiments provided in the present application, it should be understood that the disclosed systems and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0182] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0183] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0184] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application can essentially be embodied in the form of a software product, or in other words, the part that contributes to the prior art or the part of the technical solution. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0185] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present application, which are used to illustrate the technical solutions of the present application, rather than to limit them. The protection scope of the present application is not limited thereto. Although the present application is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed in the present application, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A vehicle redundant safety control method, characterized in that: The vehicle redundant safety control method is applied to a domain controller in a vehicle redundant safety control system; The vehicle redundant safety control system further includes: a wire-controlled chassis and a redundant control unit; the method includes: Determining whether the wire-controlled chassis meets the wire-controlled braking condition; If the wire-controlled chassis does not meet the wire-controlled braking condition, a first brake level signal is sent to the redundant control unit; wherein the redundant control unit is used to send a first pneumatic braking instruction to the wire-controlled chassis based on the first brake level signal; and the wire-controlled chassis is used to perform a pneumatic braking operation according to the first pneumatic braking instruction; If the wire-controlled chassis meets the wire-controlled braking condition, determining whether each non-braking module on the wire-controlled chassis reports an error; If the non-braking module reports an error, a first brake-by-wire instruction is sent to the brake-by-wire chassis; wherein the brake-by-wire chassis is further configured to perform a brake-by-wire operation according to the first brake-by-wire instruction.

2. The method according to claim 1, characterized in that: The domain controller also includes a redundant bumper unit; the method further includes: Detecting whether the redundant bumper unit is triggered; wherein the redundant bumper unit is triggered when a vehicle collides; If the redundant bumper unit is triggered, a second braking level signal is sent to the redundant control unit; wherein the redundant control unit is used to send a second pneumatic braking instruction to the wire-controlled chassis based on the second braking level signal; the wire-controlled chassis is used to perform pneumatic braking operations according to the second pneumatic braking instruction.

3. The method according to claim 2, characterized in that: The domain controller includes a high-side interface and an AD interface; the redundant control unit includes a normally open relay and a normally closed relay; the wire-controlled chassis includes an IO interface; the normally open relay includes a first normally open input terminal, a second normally open input terminal, a first normally open output terminal, and a second normally open output terminal; the normally closed relay includes a first normally closed input terminal, a second normally closed input terminal, a first normally closed output terminal, and a second normally closed output terminal; wherein the second normally open input terminal is grounded, the second normally closed input terminal is grounded, and the first normally closed output terminal is connected to VCC; If the control-by-wire chassis does not meet the control-by-wire braking condition, sending a first braking level signal to the redundant control unit includes: Receiving a level signal indicating whether the redundant bumper unit is triggered from the redundant bumper unit through the AD interface; If the wire-controlled chassis does not meet the wire-controlled braking condition and the redundant bumper unit is not triggered, a first high-impedance state level signal is sent to the first normally open output terminal through the high-side interface; wherein the redundant bumper unit is used to send a first high-level signal to the first normally open input terminal when the redundant bumper unit is not triggered; The redundant control unit, when used to send a first pneumatic braking instruction to the wire-controlled chassis based on the first braking level signal, includes: The first normally open input terminal is used to conduct with the second normally open input terminal when receiving the first high level signal; wherein, when the first normally open input terminal receives the first high level signal, the first normally open output terminal is conducted with the second normally open output terminal; The first normally open output end is used to send the first high-impedance state level signal received from the high-side interface to the first normally closed input end through the second normally open output end after the first normally open output end and the second normally open output end are connected; The first normally closed input terminal is used to be connected to the second normally closed input terminal when receiving the first high-impedance state level signal; wherein, when the first normally closed input terminal receives the first high-impedance state level signal, the first normally closed output terminal is connected to the second normally closed output terminal; when the first normally closed output terminal is connected to the second normally closed output terminal, the second high level signal representing the first pneumatic braking instruction is output to the IO interface through the VCC connected to the first normally closed output terminal, the first normally closed output terminal, the second normally closed output terminal in sequence.

4. The method according to claim 3, characterized in that: The redundant bumper unit comprises: a first normally closed travel switch and a second normally closed travel switch connected in series; one end of the first normally closed travel switch away from the second normally closed travel switch is connected to VCC; one end of the second normally closed travel switch away from the first normally closed travel switch is connected to the first normally open input end; when the redundant bumper unit is triggered, the first normally closed travel switch and / or the second normally closed travel switch are disconnected; when the redundant bumper unit is not triggered, the first normally closed travel switch and the second normally closed travel switch are closed; The redundant bumper unit, when used to send a first high level signal to the first normally open input terminal when the redundant bumper unit is not triggered, comprises: The VCC connected to the first normally closed travel switch is used to output a first high level signal to the first normally open input terminal through the closed first normally closed travel switch and the second normally closed travel switch in sequence when the redundant bumper unit is not triggered.

5. The method according to claim 4, characterized in that: If the redundant bumper unit is triggered, a second brake level signal is sent to the redundant control unit, comprising: receiving a first floating state level signal indicating that the redundant bumper unit is triggered from the redundant bumper unit through the AD interface; wherein, when the redundant bumper unit is triggered, the redundant bumper unit sends the first floating state level signal to the first normally open input terminal; If the redundant bumper unit is triggered, a second high-impedance state level signal is sent to the first normally open output terminal through the high-side interface; Among them, when the first normally open input terminal receives the first floating state level signal, the first normally open output terminal and the second normally open output terminal are not connected, so that the first normally closed input terminal receives the second floating state level signal; when the first normally closed input terminal receives the second floating state level signal, the first normally closed output terminal and the second normally closed output terminal are connected, so that the VCC connected to the first normally closed output terminal outputs the third high level signal used to characterize the second brake level signal to the IO interface in sequence through the first normally closed output terminal and the second normally closed output terminal.

6. The method according to claim 4, characterized in that: The redundant bumper unit further includes a bypass normally open switch; one end of the bypass normally open switch is connected to VCC, and the other end is respectively connected to the first normally open input end, the AD interface, and an end of the second normally closed travel switch away from the first normally closed travel switch; if the redundant bumper unit is triggered, after sending a second brake level signal to the redundant control unit, the method further includes: When the vehicle collides and is braked, if it is necessary to restart the vehicle, and at least one of the first normally closed travel switch, the second normally closed travel switch, and the line between the VCC connected to the first normally closed travel switch and the first normally open input terminal is disconnected, the bypass normally open switch is controlled to be closed, and when the bypass normally open switch is closed, a fourth high level signal transmitted from the VCC connected to the bypass normally open switch is received through the AD interface; wherein, when the bypass normally open switch is closed, the first normally open input terminal receives the fourth high level signal transmitted from the VCC connected to the bypass normally open switch; sending a fifth high level signal to the first normally open output terminal through the high-side interface; wherein, when the first normally open input terminal receives the fourth high level signal, the first normally open output terminal and the second normally open output terminal are connected, so as to transmit the fifth high level signal to the first normally closed input terminal through the connected first normally open output terminal and the second normally open output terminal; When the first normally closed input terminal receives the fifth high level signal, the first normally closed output terminal and the second normally closed output terminal are disconnected, so that the IO interface receives the fifth floating state level signal for indicating a vehicle start command.

7. The method according to claim 1, characterized in that: If the control-by-wire chassis meets the control-by-wire braking condition, after determining whether each non-braking module on the control-by-wire chassis reports an error, the method further includes: If the non-brake module does not report an error, it is determined whether there is a wire-controlled emergency brake command at present; wherein the brake control amount of the wire-controlled brake contained in the wire-controlled emergency brake command is greater than the preset control amount; If there is a wire-controlled emergency brake command currently, a second wire-controlled brake command is sent to the wire-controlled chassis; the wire-controlled chassis is used to perform a wire-controlled brake operation according to the second wire-controlled brake command; During the process in which the brake-by-wire chassis performs a brake-by-wire operation according to the second brake-by-wire instruction, determining whether the actual deceleration of the vehicle reaches a first threshold within a target time period; If the actual deceleration of the vehicle does not reach the first threshold, a third braking level signal is sent to the redundant control unit; wherein the redundant control unit is used to send a third pneumatic braking instruction to the wire-controlled chassis based on the third braking level signal; and the wire-controlled chassis is used to perform pneumatic braking operations according to the third pneumatic braking instruction.

8. The method according to claim 7, characterized in that: The method further comprises: If the actual deceleration of the vehicle reaches the first threshold, it is determined whether the change value of the air pressure of the gas delivered to the brake execution end of the brake module reaches the second threshold; wherein the brake execution end of the brake module is an end of the wire-controlled chassis for performing a braking operation; when the brake execution end of the brake module performs a braking operation, it is performed by the air pressure provided by the gas delivered to the brake execution end; If the change in air pressure provided by the gas delivered to the brake actuator end does not reach the second threshold, a fourth brake level signal is sent to the redundant control unit; wherein the redundant control unit is used to send a fourth pneumatic braking instruction to the wire-controlled chassis based on the fourth brake level signal; the wire-controlled chassis is used to perform a pneumatic braking operation according to the fourth pneumatic braking instruction to transmit gas to the brake switch end of the brake module; wherein the brake switch end of the brake module controls the brake actuator end to perform a braking operation according to the received gas.

9. The method according to claim 2, characterized in that: After detecting whether the redundant bumper unit is triggered, the method further includes: If the redundant bumper unit is not triggered, determining whether the current driving mode of the vehicle is an automatic driving mode; The determining whether the wire-controlled chassis meets the wire-controlled braking condition includes: If the current driving mode of the vehicle is the automatic driving mode, it is determined whether the wire-controlled chassis meets the conditions for wire-controlled braking.

10. A vehicle redundant safety control system, characterized in that: The vehicle redundant safety control system includes: a domain controller, a wire-controlled chassis, and a redundant control unit; The domain controller is configured to determine whether the control-by-wire chassis meets the control-by-wire brake condition; and if the control-by-wire chassis does not meet the control-by-wire brake condition, send a first brake level signal to the redundant control unit; The redundant control unit is configured to send a first pneumatic braking instruction to the control-by-wire chassis based on the first braking level signal; The wire-controlled chassis is used to perform a pneumatic braking operation according to the first pneumatic braking instruction; The domain controller is further configured to determine whether each non-braking module on the control-by-wire chassis reports an error if the control-by-wire chassis meets the control-by-wire braking condition; and send a first control-by-wire braking instruction to the control-by-wire chassis if the non-braking module reports an error; The wire-controlled chassis is further configured to perform a wire-controlled braking operation according to the first wire-controlled braking instruction.

Images