A vehicle redundancy safety control method and system

Abstract

This application provides a vehicle redundancy safety control method and system. The method includes: determining whether a drive-by-wire chassis meets the conditions for drive-by-wire braking; if the drive-by-wire chassis does not meet the conditions for drive-by-wire braking, sending a first braking level signal to a redundant control unit; wherein the redundant control unit is used to send a first pneumatic braking command to the drive-by-wire chassis based on the first braking level signal; the drive-by-wire chassis is used to execute a pneumatic braking operation according to the first pneumatic braking command; if the drive-by-wire chassis meets the conditions for drive-by-wire braking, determining whether each non-braking module on the drive-by-wire chassis reports an error; if a non-braking module reports an error, sending a first drive-by-wire braking command to the drive-by-wire chassis; wherein the drive-by-wire chassis is also used to execute a drive-by-wire braking operation according to the first drive-by-wire braking command. This method improves the stability of vehicle drive-by-wire braking.

Description

Technical Field

[0001] This application relates to the field of intelligent driving technology, and in particular to a vehicle redundancy safety control method and system. Background Technology

[0002] In the application scenarios of autonomous trucking, drive-by-wire trucks are an important application of autonomous driving technology in the commercial vehicle sector. They employ drive-by-wire technology, connecting control units and actuators via electrical signals, replacing traditional mechanical or hydraulic drives. Drive-by-wire chassis are the foundation of autonomous driving applications, integrating drive-by-wire steering, brake-by-wire, drive-by-wire, and drive-by-wire BCM (body control module) functions.

[0003] In this system, brake-by-wire sends brake commands via electrical signals to the brake-by-wire chassis, which then executes the corresponding brake-by-wire operation based on the received commands. However, for the brake-by-wire chassis to respond to brake commands, certain modules related to brake-by-wire must meet specific conditions. If these modules do not meet the conditions, the brake-by-wire chassis will not respond to the commands and therefore cannot perform braking operations. Therefore, the braking stability of current brake-by-wire chassis needs improvement. Summary of the Invention

[0004] In view of this, the purpose of this application is to provide a vehicle redundancy safety control method and system to improve the stability of vehicle brake-by-wire and thus improve vehicle driving safety.

[0005] In a first aspect, embodiments of this application provide a vehicle redundancy safety control method, wherein the vehicle redundancy safety control method is applied to a domain controller in a vehicle redundancy safety control system; the vehicle redundancy safety control system further includes: a drive-by-wire chassis and a redundant control unit; the method includes:

[0006] Determine whether the drive-by-wire chassis meets the conditions for drive-by-wire braking;

[0007] If the drive-by-wire chassis does not meet the conditions for drive-by-wire braking, a first braking level signal is sent to the redundant control unit; wherein, the redundant control unit is used to send a first pneumatic braking command to the drive-by-wire chassis based on the first braking level signal; the drive-by-wire chassis is used to perform pneumatic braking operation according to the first pneumatic braking command;

[0008] If the drive-by-wire chassis meets the conditions for drive-by-wire braking, then determine whether each non-braking module on the drive-by-wire chassis reports an error;

[0009] If the non-braking module reports an error, a first brake-by-wire command is sent to the brake-by-wire chassis; wherein, the brake-by-wire chassis is also used to perform brake-by-wire operation according to the first brake-by-wire command.

[0010] In conjunction with the first aspect, embodiments of this application provide a first possible implementation of the first aspect, wherein the domain controller further includes a redundant bumper unit; the method further includes:

[0011] Detect whether the redundant bumper unit is triggered; wherein, the redundant bumper unit is triggered when the vehicle is involved in a collision;

[0012] If the redundant bumper unit is triggered, a second braking level signal is sent to the redundant control unit; wherein, the redundant control unit is used to send a second pneumatic braking command to the drive-by-wire chassis based on the second braking level signal; the drive-by-wire chassis is used to perform pneumatic braking operation according to the second pneumatic braking command.

[0013] In conjunction with the first possible implementation of the first aspect, this application provides a second possible implementation of the first aspect, wherein the domain controller includes a high-side interface and an AD interface; the redundant control unit includes normally open relays and normally closed relays; the wired control chassis includes an I / O interface; the normally open relay includes a first normally open input terminal, a second normally open input terminal, a first normally open output terminal, and a second normally open output terminal; the normally closed relay includes a first normally closed input terminal, a second normally closed input terminal, a first normally closed output terminal, and a second normally closed output terminal; wherein the second normally open input terminal is grounded, the second normally closed input terminal is grounded, and the first normally closed output terminal is connected to VCC;

[0014] If the drive-by-wire chassis does not meet the conditions for drive-by-wire braking, a first braking level signal is sent to the redundant control unit, including:

[0015] The AD interface is used to receive a level signal from the redundant bumper unit indicating whether the redundant bumper unit has been triggered.

[0016] If the drive-by-wire chassis does not meet the conditions for drive-by-wire braking and the redundant bumper unit is not triggered, a first high-impedance state level signal is sent to the first normally open output terminal through the high-side interface; wherein, the redundant bumper unit is used to send a first high-level signal to the first normally open input terminal when the redundant bumper unit is not triggered.

[0017] When the redundant control unit is used to send a first pneumatic braking command to the drive-by-wire chassis based on the first braking level signal, it includes:

[0018] The first normally open input terminal is configured to conduct with the second normally open input terminal when the first high-level signal is received; wherein, when the first normally open input terminal receives the first high-level signal, the first normally open output terminal is connected with the second normally open output terminal;

[0019] The first normally open output terminal is used to send the first high-impedance state level signal received from the high-side interface to the first normally closed input terminal through the second normally open output terminal after the first normally open output terminal and the second normally open output terminal are turned on.

[0020] The first normally closed input terminal is used to conduct with the second normally closed input terminal when receiving the first high-impedance state level signal; wherein, when the first normally closed input terminal receives the first high-impedance state level signal, the first normally closed output terminal is conducted with the second normally closed output terminal; when the first normally closed output terminal is conducted with the second normally closed output terminal, a second high-level signal representing the first pneumatic braking command is output to the IO interface through VCC connected to the first normally closed output terminal, sequentially through the first normally closed output terminal and the second normally closed output terminal.

[0021] In conjunction with the second possible implementation of the first aspect, this application provides a third possible implementation of the first aspect, wherein the redundant bumper unit includes: a first normally closed limit switch and a second normally closed limit switch connected in series; the end of the first normally closed limit switch away from the second normally closed limit switch is connected to VCC; the end of the second normally closed limit switch away from the first normally closed limit switch is connected to the first normally open input terminal; when the redundant bumper unit is triggered, the first normally closed limit switch and / or the second normally closed limit switch are open; when the redundant bumper unit is not triggered, the first normally closed limit switch and the second normally closed limit switch are closed.

[0022] When the redundant bumper unit is not triggered, sending a first high-level signal to the first normally open input terminal includes:

[0023] The VCC connected to the first normally closed limit switch is used to output a first high-level signal to the first normally open input terminal in sequence through the closed first normally closed limit switch and the second normally closed limit switch when the redundant bumper unit is not triggered.

[0024] In conjunction with the third possible implementation of the first aspect, this application provides a fourth possible implementation of the first aspect, wherein, if the redundant bumper unit is triggered, a second braking level signal is sent to the redundant control unit, including:

[0025] The AD interface receives a first floating state level signal from the redundant bumper unit to indicate that the redundant bumper unit has been triggered; wherein, when the redundant bumper unit is triggered, the redundant bumper unit sends the first floating state level signal to the first normally open input terminal.

[0026] If the redundant bumper unit is triggered, a second high-impedance state level signal is sent to the first normally open output terminal through the high-side interface;

[0027] Specifically, when the first normally open input terminal receives the first floating state level signal, the first normally open output terminal and the second normally open output terminal are not connected, so that the first normally closed input terminal receives the second floating state level signal; when the first normally closed input terminal receives the second floating state level signal, the first normally closed output terminal and the second normally closed output terminal are connected, so that VCC connected to the first normally closed output terminal outputs a third high-level signal to the IO interface in sequence through the first normally closed output terminal and the second normally closed output terminal to characterize the second braking level signal.

[0028] In conjunction with the third possible implementation of the first aspect, this application provides a fifth possible implementation of the first aspect, wherein the redundant bumper unit further includes a bypass normally open switch; one end of the bypass normally open switch is connected to VCC, and the other end is respectively connected to the first normally open input terminal, the AD interface, and the end of the second normally closed limit switch furthest from the first normally closed limit switch; after sending a second braking level signal to the redundant control unit if the redundant bumper unit is triggered, the method further includes:

[0029] When the vehicle is braked after a collision, if it needs to be restarted and at least one of the first normally closed limit switch, the second normally closed limit switch, and the line between VCC connected to the first normally closed limit switch and the first normally open input terminal is disconnected, the bypass normally open switch is controlled to close. When the bypass normally open switch is closed, a fourth high-level signal transmitted from VCC connected to the bypass normally open switch is received through the AD interface; wherein, when the bypass normally open switch is closed, the first normally open input terminal receives the fourth high-level signal transmitted from VCC connected to the bypass normally open switch.

[0030] A fifth high-level signal is sent to the first normally open output terminal through the high-side interface; wherein, when the first normally open input terminal receives the fourth high-level signal, the first normally open output terminal and the second normally open output terminal are turned on, so as to transmit the fifth high-level signal to the first normally closed input terminal through the turned first normally open output terminal and the second normally open output terminal.

[0031] When the first normally closed input terminal receives the fifth high-level signal, the first normally closed output terminal and the second normally closed output terminal are not turned on, so that the IO interface receives the fifth floating state level signal indicating the vehicle start command.

[0032] In conjunction with the first aspect, this application provides a sixth possible implementation of the first aspect, wherein, after determining whether each non-braking module on the steerable bus has reported an error if the steerable bus meets the conditions for steerable bus braking, the method further includes:

[0033] If the non-braking module does not report an error, it is determined whether there is a brake-by-wire emergency braking command; wherein the brake control amount of the brake-by-wire included in the brake-by-wire emergency braking command is greater than the preset control amount.

[0034] If there is a brake-by-wire emergency braking command, a second brake-by-wire command is sent to the brake-by-wire chassis; the brake-by-wire chassis is used to execute brake-by-wire operations according to the second brake-by-wire command.

[0035] During the process of the drive-by-wire chassis executing drive-by-wire operation according to the second drive-by-wire command, it is determined whether the actual deceleration of the vehicle reaches the first threshold within the target time period;

[0036] If the actual deceleration of the vehicle does not reach the first threshold, a third braking level signal is sent to the redundant control unit; wherein, the redundant control unit is used to send a third pneumatic braking command to the drive-by-wire chassis based on the third braking level signal; the drive-by-wire chassis is used to perform pneumatic braking operation according to the third pneumatic braking command.

[0037] In conjunction with the sixth possible implementation of the first aspect, this application provides a seventh possible implementation of the first aspect, wherein the method further includes:

[0038] If the actual deceleration of the vehicle reaches the first threshold, it is determined whether the change in gas pressure of the gas supplied to the brake actuator of the brake module reaches the second threshold; wherein, the brake actuator of the brake module is one end of the drive-by-wire chassis used to perform braking operation; when the brake actuator of the brake module performs braking operation, it is executed by the gas pressure provided by the gas supplied to the brake actuator.

[0039] If the change in gas pressure supplied to the braking actuator does not reach the second threshold, a fourth braking level signal is sent to the redundant control unit; wherein, the redundant control unit is used to send a fourth pneumatic braking command to the drive-by-wire chassis based on the fourth braking level signal; the drive-by-wire chassis is used to perform a pneumatic braking operation according to the fourth pneumatic braking command to transmit gas to the braking switch terminal of the braking module; wherein, the braking switch terminal of the braking module controls the braking actuator to perform a braking operation based on the received gas.

[0040] In conjunction with the first possible implementation of the first aspect, this application provides an eighth possible implementation of the first aspect, wherein, after detecting whether the redundant bumper unit is triggered, the method further includes:

[0041] If the redundant bumper unit is not triggered, it is determined whether the current driving mode of the vehicle is the autonomous driving mode.

[0042] The determination of whether the drive-by-wire chassis meets the conditions for drive-by-wire braking includes:

[0043] If the current driving mode of the vehicle is the automatic driving mode, then it is determined whether the drive-by-wire chassis meets the conditions for drive-by-wire braking.

[0044] Secondly, this application also provides a vehicle redundancy safety control system, which includes: a domain controller, a drive-by-wire chassis, and a redundant control unit;

[0045] The domain controller is used to determine whether the drive-by-wire chassis meets the conditions for drive-by-wire braking; and if the drive-by-wire chassis does not meet the conditions for drive-by-wire braking, it sends a first braking level signal to the redundant control unit.

[0046] The redundant control unit is used to send a first pneumatic braking command to the drive-by-wire chassis based on the first braking level signal.

[0047] The drive-by-wire chassis is used to perform pneumatic braking operations according to the first pneumatic braking command;

[0048] The domain controller is further configured to determine whether each non-braking module on the drive-by-wire chassis reports an error if the drive-by-wire chassis meets the conditions for drive-by-wire braking; and to send a first drive-by-wire braking command to the drive-by-wire chassis if the non-braking module reports an error.

[0049] The drive-by-wire chassis is also used to execute drive-by-wire braking operations according to the first drive-by-wire braking command.

[0050] This application provides a vehicle redundancy safety control method and system. Considering that existing vehicle redundancy safety control systems only include a domain controller and a drive-by-wire chassis, the domain controller can only achieve vehicle braking by sending drive-by-wire braking commands to the drive-by-wire chassis, which then responds to these commands. However, when the drive-by-wire chassis does not meet the drive-by-wire braking conditions (i.e., it cannot respond to the drive-by-wire braking command), vehicle braking cannot be achieved. Therefore, in this embodiment, a redundant control mechanism is added to the vehicle control system. When the drive-by-wire chassis does not meet the drive-by-wire braking conditions (i.e., it cannot respond to the drive-by-wire braking command), a pneumatic braking request is directly sent to the drive-by-wire chassis through the added redundant control mechanism. The drive-by-wire chassis then performs pneumatic braking operations according to the pneumatic braking command to achieve vehicle braking. When the drive-by-wire chassis meets the drive-by-wire braking conditions, but the non-braking module on the drive-by-wire chassis malfunctions, continued vehicle operation may be dangerous. Therefore, in this embodiment, a drive-by-wire braking command is sent to the drive-by-wire chassis, causing it to perform drive-by-wire braking operations according to the command, thereby achieving vehicle braking. As can be seen, in this embodiment, vehicle braking can be achieved regardless of whether the drive-by-wire chassis meets the conditions for drive-by-wire braking, which helps improve the stability of vehicle braking. Simultaneously, when the drive-by-wire chassis meets the conditions for drive-by-wire braking, but the non-braking module reports an error, controlling the drive-by-wire chassis to perform the drive-by-wire braking operation helps ensure vehicle safety.

[0051] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0052] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0053] Figure 1 This paper shows a schematic diagram of the structure of a vehicle redundancy safety control system provided in an embodiment of this application;

[0054] Figure 2 A flowchart of a vehicle redundancy safety control method provided in an embodiment of this application is shown;

[0055] Figure 3 This paper shows a schematic diagram of the structure of the second vehicle redundancy safety control system provided in an embodiment of this application;

[0056] Figure 4This paper shows a schematic diagram of the structure of a third vehicle redundancy safety control system provided in an embodiment of this application;

[0057] Figure 5 A flowchart of another vehicle redundancy safety control method provided in an embodiment of this application is shown. Detailed Implementation

[0058] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0059] Considering the insufficient braking stability of current drive-by-wire chassis, this application provides a vehicle redundancy safety control method and system to improve vehicle braking stability and thus ensure vehicle driving safety. The following embodiments describe these methods.

[0060] To facilitate understanding of this embodiment, a vehicle control method disclosed in this application will first be described in detail. This vehicle control method is applied to a domain controller in a vehicle control system; such as... Figure 1 As shown, the vehicle redundant safety control system also includes: a drive-by-wire chassis and a redundant control unit.

[0061] In this embodiment, the vehicle can be a truck, the vehicle control system can be a truck redundancy safety control system, and the vehicle redundancy safety control method can be a truck redundancy safety control method.

[0062] like Figure 2 As shown, the vehicle redundancy safety control method includes the following steps S101-S104:

[0063] S101: Determine whether the drive-by-wire chassis meets the conditions for drive-by-wire braking.

[0064] In this embodiment, such as Figure 1 As shown, the domain controller contains a first CAN (Controller Area Network) interface, and the drive-by-wire chassis contains a second CAN interface. The first CAN interface (attached) Figure 1 The first CAN and the second CAN interface (attached) Figure 1CAN communication can be performed between the second CAN in the system.

[0065] In this embodiment, the drive-by-wire chassis includes a braking module, which comprises a braking actuator and a braking switch. The braking actuator performs braking operations based on the gas pressure at its location, thus braking the vehicle. The braking switch acts as a switch for the braking actuator, controlling the start time of the braking operation. In the prior art, the braking switch is connected to the electronic braking unit via CAN communication, and the braking actuator is connected to the gas tank via a gas pipeline.

[0066] Braking by drive refers to the domain controller sending a braking command via the first CAN interface to the second CAN interface on the brake-by-drive chassis. Upon receiving the braking command, the electronic braking unit of the brake-by-drive chassis sends a brake-by-drive instruction to the brake switch terminal of the braking module via CAN communication, indicating the start of braking. After receiving the brake-by-drive instruction from the electronic braking unit, the brake switch terminal of the braking module uses the voltage provided by the gas output from the gas tank through the gas pipeline to perform the braking operation.

[0067] However, for a brake-by-wire chassis to execute brake-by-wire operations in response to brake-by-wire commands, certain modules related to brake-by-wire within the chassis must meet specific conditions. If these modules do not meet the conditions for brake-by-wire, the chassis will not respond to brake-by-wire commands and therefore cannot perform braking operations.

[0068] Therefore, in order to ensure that the vehicle's brake-by-wire can be executed stably, it is necessary to promptly determine whether the brake-by-wire chassis meets the conditions for brake-by-wire based on the vehicle status feedback information.

[0069] S102: If the drive-by-wire chassis does not meet the conditions for drive-by braking, a first braking level signal is sent to the redundant control unit; wherein, the redundant control unit is used to send a first pneumatic braking command to the drive-by-wire chassis based on the first braking level signal; the drive-by-wire chassis is used to perform pneumatic braking operation according to the first pneumatic braking command.

[0070] In this embodiment, when the steerable chassis does not meet the conditions for steerable braking, the vehicle is directly braked using another braking method (i.e., the newly added pneumatic braking method). In other words, when the steerable chassis does not meet the conditions for steerable braking, the vehicle is prevented from continuing to move.

[0071] The newly added pneumatic braking method involves adding an air passage between the brake switch terminal of the braking module and the air tank. Pneumatic braking means that the domain controller sends a first pneumatic braking command to the drive-by-wire chassis. Upon receiving the command, the chassis transmits gas from the air tank to the brake switch terminal of the braking module via the newly added air passage. The brake switch terminal uses the voltage provided by the transmitted gas as the pneumatic command to initiate braking. After receiving the command from the newly added air passage, the brake module's brake actuator begins braking using the voltage provided by the gas output from the air tank via the original air passage.

[0072] S103: If the drive-by-wire chassis meets the conditions for drive-by-wire braking, then determine whether each non-braking module on the drive-by-wire chassis reports an error.

[0073] In this embodiment, the drive-by-wire chassis also includes other modules that are unrelated to or less related to drive-by braking. When the drive-by-wire chassis meets the conditions for drive-by braking, it is determined whether the modules on the drive-by-wire chassis that are unrelated to or less related to drive-by braking report an error.

[0074] S104: If the non-braking module reports an error, a first brake-by-wire command is sent to the brake-by-wire chassis; wherein, the brake-by-wire chassis is also used to execute brake-by-wire operations according to the first brake-by-wire command.

[0075] In this embodiment, if a module on the drive-by-wire chassis that is unrelated to or has little connection with drive-by braking reports an error, a first drive-by-wire command is sent from the first CAN interface to the second CAN interface, so that the drive-by-wire chassis can perform drive-by braking operation according to the first drive-by-wire command and perform drive-by braking on the vehicle.

[0076] In one possible implementation, such as Figure 3 As shown, the domain controller also includes a redundant bumper unit; the vehicle redundancy safety control method can also be executed according to the following steps S1001-S1002:

[0077] S1001: Detect whether the redundant bumper unit is triggered; whereby the redundant bumper unit is triggered when the vehicle is involved in a collision.

[0078] Typically, redundant bumper units are located near the vehicle's bumper. When the vehicle is not involved in a collision (the bumper is not impacted), the redundant bumper unit is not activated. When a collision occurs (the bumper is impacted), the redundant bumper unit is activated.

[0079] S1002: If the redundant bumper unit is triggered, a second braking level signal is sent to the redundant control unit; wherein, the redundant control unit is used to send a second pneumatic braking command to the drive-by-wire chassis based on the second braking level signal; the drive-by-wire chassis is used to perform pneumatic braking operation according to the second pneumatic braking command.

[0080] In this embodiment, when a collision occurs (the bumper collides), the vehicle is braked using pneumatic braking.

[0081] In one possible implementation, such as Figure 4 As shown, the domain controller includes a high-side interface and an AD interface (analog-to-digital signal interface, such as...). Figure 3 The redundant control unit includes normally open and normally closed relays; the drive-by-wire chassis includes I / O interfaces (input / output interfaces, such as...). Figure 3 The normally open relay includes a first normally open input terminal K1, a second normally open input terminal K2, a first normally open output terminal K3, and a second normally open output terminal K4; the normally closed relay includes a first normally closed input terminal B1, a second normally closed input terminal B2, a first normally closed output terminal B3, and a second normally closed output terminal B4; wherein, the second normally open input terminal K2 is grounded, the second normally closed input terminal B2 is grounded, and the first normally closed output terminal B3 is connected to VCC (circuit power supply voltage).

[0082] If the drive-by-wire chassis does not meet the conditions for drive-by-wire braking in step S102, the first braking level signal is sent to the redundant control unit. Specifically, the following steps S1021-S1022 can be performed:

[0083] S1021: Receives a level signal from the redundant bumper unit via the AD interface, indicating whether the redundant bumper unit has been triggered;

[0084] S1022: If the drive-by-wire chassis does not meet the conditions for drive-by-wire braking and the redundant bumper unit is not triggered, a first high-impedance state level signal is sent to the first normally open output terminal through the high-side interface; wherein, the redundant bumper unit is used to send a first high-level signal to the first normally open input terminal when the redundant bumper unit is not triggered.

[0085] In step S102, when the redundant control unit sends a first pneumatic braking command to the drive-by-wire chassis based on the first braking level signal, it includes:

[0086] The first normally open input terminal K1 is used to conduct with the second normally open input terminal K2 when a first high-level signal is received; wherein, when the first normally open input terminal K1 receives the first high-level signal, the first normally open output terminal K3 and the second normally open output terminal K4 are conducted.

[0087] After the first normally open output terminal K3 and the second normally open output terminal K4 are turned on, the first high-impedance state level signal received from the high-side interface is sent to the first normally closed input terminal B1 through the second normally open output terminal K4.

[0088] The first normally closed input terminal B1 is used to conduct with the second normally closed input terminal B2 when a first high-impedance state level signal is received; wherein, when the first normally closed input terminal B1 receives the first high-impedance state level signal, the first normally closed output terminal B3 and the second normally closed output terminal B4 are conducted; when the first normally closed output terminal B3 and the second normally closed output terminal B4 are conducted, a second high-level signal representing the first pneumatic braking command is output to the IO interface through VCC connected to the first normally closed output terminal B3 and the second normally closed output terminal B4 in sequence.

[0089] In step S103, after receiving a second high-level signal representing a first pneumatic braking command, the IO interface in the drive-by-wire chassis performs a pneumatic braking operation according to the first pneumatic braking command.

[0090] In one possible implementation, such as Figure 4 As shown, the redundant bumper unit includes: a first normally closed limit switch SQ1 and a second normally closed limit switch SQ2 connected in series; the end of the first normally closed limit switch SQ1 away from the second normally closed limit switch SQ2 is connected to VCC; the end of the second normally closed limit switch SQ2 away from the first normally closed limit switch SQ1 is connected to a first normally open input terminal K1; when the redundant bumper unit is triggered, the first normally closed limit switch SQ1 and / or the second normally closed limit switch SQ2 are open; when the redundant bumper unit is not triggered, the first normally closed limit switch SQ1 and the second normally closed limit switch SQ2 are closed.

[0091] In step S1022, as Figure 4 As shown, the redundant control unit, when used to send a first pneumatic braking command to the drive-by-wire chassis based on a first braking level signal, includes:

[0092] The VCC connected to the first normally closed limit switch SQ1 is used to output a first high-level signal to the first normally open input terminal K1 in sequence through the closed first normally closed limit switch SQ1 and the second normally closed limit switch SQ2 when the redundant bumper unit is not triggered.

[0093] In one possible implementation, such as Figure 4 As shown, when the redundant bumper unit is triggered in step S1002, and a second braking level signal is sent to the redundant control unit, the specific steps can be as follows:

[0094] The AD interface receives a first floating state level signal from the redundant bumper unit to indicate that the redundant bumper unit has been triggered; wherein, when the redundant bumper unit is triggered, the redundant bumper unit sends the first floating state level signal to the first normally open input terminal K1.

[0095] If the redundant bumper unit is triggered, a second high-impedance state level signal is sent to the first normally open output terminal K3 through the high-side interface;

[0096] When the first normally open input terminal K1 receives the first floating state level signal, the first normally open output terminal K3 and the second normally open output terminal K4 are not connected, so that the first normally closed input terminal B1 receives the second floating state level signal; when the first normally closed input terminal B1 receives the second floating state level signal, the first normally closed output terminal B3 and the second normally closed output terminal B4 are connected, so that VCC connected to the first normally closed output terminal B3 sequentially outputs a third high-level signal to the IO interface through the first normally closed output terminal B3 and the second normally closed output terminal B4 to characterize the second braking level signal.

[0097] In this embodiment, the first normally closed limit switch SQ1 and the second normally closed limit switch SQ2 are located on both sides of the safety device. If either side of the bumper collides, the corresponding normally closed limit switch (either the first normally closed limit switch SQ1 or the second normally closed limit switch SQ2) on the colliding side will open. At this time, the AD interface and the first normally open input terminal K1 can receive a second high-impedance state level signal from the redundant bumper unit, indicating that the redundant bumper unit has been triggered.

[0098] In one possible implementation, such as Figure 4 As shown, the redundant bumper unit also includes a bypass normally open switch S1; one end of the bypass normally open switch S1 is connected to VCC, and the other end is connected to the first normally open input terminal K1, the AD interface, and the end of the second normally closed limit switch SQ2 furthest from the first normally closed limit switch SQ1; if the redundant bumper unit is triggered in step S1002, a second braking level signal is sent to the redundant control unit, and then the vehicle control method can also be executed according to the following steps S10023-S10025:

[0099] S10023: When the vehicle is braked after a collision, if it is necessary to restart the vehicle, and at least one of the first normally closed limit switch, the second normally closed limit switch, and the line between VCC connected to the first normally closed limit switch and the first normally open input terminal is disconnected, then the bypass normally open switch S1 is controlled to close. When the bypass normally open switch S1 is closed, a fourth high-level signal transmitted from VCC connected to the bypass normally open switch S1 is received through the AD interface; wherein, when the bypass normally open switch S1 is closed, the first normally open input terminal K1 receives the fourth high-level signal transmitted from VCC connected to the bypass normally open switch S1.

[0100] In this embodiment, after a vehicle collision causes the vehicle to brake, if the collision is resolved and at least one of the following is damaged and disconnected: the first normally closed limit switch SQ1, the second normally closed limit switch SQ2, and the line between VCC connected to the first normally open input terminal K1 and the second normally closed limit switch SQ1, the fourth high-level signal can still be provided to the AD interface and the first normally open input terminal K1 by closing the bypass normally open switch S1.

[0101] S10024: Send a fifth high-level signal to the first normally open output terminal K3 through the high-side interface; wherein, when the first normally open input terminal K1 receives the fourth high-level signal, the first normally open output terminal K3 and the second normally open output terminal K4 are turned on, so as to transmit the fifth high-level signal to the first normally closed input terminal B1 through the turned first normally open output terminal K3 and the second normally open output terminal K4.

[0102] S10025: When the first normally closed input terminal B1 receives the fifth high-level signal, the first normally closed output terminal B3 and the second normally closed output terminal B4 are not turned on, so that the IO interface can receive the fifth floating state level signal used to indicate the vehicle start command.

[0103] In this embodiment, after a vehicle collision causes braking, if the collision is resolved and the first normally closed limit switch SQ1 and the second normally closed limit switch SQ2 are damaged, a fourth high-level signal is provided to the AD interface and the first normally open input terminal K1 by closing the bypass normally open switch S1. This causes the IO interface to receive a fifth floating state level signal indicating a vehicle start command. After the IO interface receives the fifth floating state level signal indicating a vehicle start command, the drive-by-wire chassis can restart the vehicle and drive it to a vehicle repair shop.

[0104] In one possible implementation, after performing step S103, the following steps S1051-S1054 may also be performed:

[0105] S1051: If the non-braking module does not report an error, determine whether there is a brake-by-wire emergency braking command; wherein, the brake control amount of the brake-by-wire included in the brake-by-wire emergency braking command is greater than the preset control amount.

[0106] S1052: If there is a brake-by-wire emergency braking command, a second brake-by-wire command is sent to the brake-by-wire chassis; the brake-by-wire chassis is used to execute brake-by-wire operations according to the second brake-by-wire command.

[0107] S1053: During the process of the online control chassis executing the online control braking operation according to the second online control braking command, it is determined whether the actual deceleration of the vehicle reaches the first threshold within the target time period.

[0108] S1054: If the actual deceleration of the vehicle does not reach the first threshold, a third braking level signal is sent to the redundant control unit; wherein, the redundant control unit is used to send a third pneumatic braking command to the drive-by-wire chassis based on the third braking level signal; the drive-by-wire chassis is used to perform pneumatic braking operation according to the third pneumatic braking command.

[0109] In this embodiment, when the actual deceleration of the vehicle does not reach the first threshold, it indicates that the brake-by-wire is not effective. At this time, it is necessary to execute pneumatic braking through the redundant control unit to stop the vehicle.

[0110] In one possible implementation, after performing step S1054, the following steps S1055-S1056 may also be performed:

[0111] S1055: If the actual deceleration of the vehicle reaches the first threshold, then determine whether the change in gas pressure of the gas supplied to the brake actuator of the brake module reaches the second threshold; wherein, the brake actuator of the brake module is one end of the drive-by-wire chassis used to perform the braking operation; when the brake actuator of the brake actuator module performs the braking operation, it is performed by the gas pressure supplied to the brake actuator.

[0112] S1056: If the change in gas pressure provided by the gas supplied to the braking actuator does not reach the second threshold, a fourth braking level signal is sent to the redundant control unit; wherein, the redundant control unit is used to send a fourth pneumatic braking command to the drive-by-wire chassis based on the fourth braking level signal; the drive-by-wire chassis is used to perform pneumatic braking operation according to the fourth pneumatic braking command to transmit gas to the braking switch terminal of the braking module; wherein, the braking switch terminal of the braking module controls the braking actuator to perform braking operation according to the received gas.

[0113] For example, assuming the gas pressure delivered to the brake actuator of the brake module is 800 kPa when the vehicle is in motion, when the brake-by-wire is in normal operation, the gas pressure at the brake actuator of the brake module may drop to 780 kPa when the brake-by-wire chassis performs brake-by-wire operation according to the second brake-by-wire command. The change value at this time is 20 kPa, which is greater than the second threshold.

[0114] In the case of online control braking time-limited operation, when the drive-by-wire chassis executes the drive-by-wire braking operation according to the second drive-by-wire braking command, the gas pressure change at the brake actuator end of the braking module may be small, i.e., the change value is less than the second threshold. At this time, it is necessary to use pneumatic braking to transfer the gas in the air tank to the brake switch end of the braking module through an additional air passage. After receiving the transferred gas, the brake actuator end of the braking module begins to perform the braking operation to stop the vehicle.

[0115] In one possible implementation, after executing step S1001 to detect whether the redundant bumper unit has been triggered, the vehicle redundancy safety control method may further perform the following steps:

[0116] If the redundant bumper unit is not triggered, it is determined whether the current driving mode of the vehicle is autonomous driving mode.

[0117] When executing step S101, specifically: if the current driving mode of the vehicle is automatic driving mode, then determine whether the drive-by-wire chassis meets the conditions for drive-by-wire braking.

[0118] In a specific embodiment, such as Figure 5 As shown, the vehicle redundancy safety control method can be implemented according to the following steps:

[0119] S201: Initialize the various submodules in the domain controller. For example, set the high-side interface to a high-level output state;

[0120] S202: Determine whether the vehicle is currently in a redundant safety protection state and the vehicle has stopped; if so, stop the vehicle in the current state and wait for a second confirmation to restart the vehicle;

[0121] S203: If not, then detect whether the redundant bumper unit is triggered; wherein, the redundant bumper unit is triggered when the vehicle is involved in a collision;

[0122] S204: If the redundant bumper unit is triggered, a second braking level signal is sent to the redundant control unit; wherein, the redundant control unit is used to send a second pneumatic braking command to the drive-by-wire chassis based on the second braking level signal; the drive-by-wire chassis is used to perform pneumatic braking operation according to the second pneumatic braking command.

[0123] If the redundant bumper unit is not triggered, determine whether the current vehicle's driving mode is autonomous driving mode.

[0124] S205: If the current driving mode of the vehicle is automatic driving mode, determine whether the drive-by-wire chassis meets the conditions for drive-by-wire braking; if the current driving mode of the vehicle is manual driving mode, do not perform the subsequent judgment, return to step S202, and avoid affecting manual driving operation.

[0125] S206: If the drive-by-wire chassis does not meet the conditions for drive-by braking, a first braking level signal is sent to the redundant control unit; wherein, the redundant control unit is used to send a first pneumatic braking command to the drive-by-wire chassis based on the first braking level signal; the drive-by-wire chassis is used to perform pneumatic braking operation according to the first pneumatic braking command.

[0126] S207: If the drive-by-wire chassis meets the conditions for drive-by-wire braking, then determine whether each non-braking module on the drive-by-wire chassis reports an error;

[0127] S208: If the non-braking module reports an error, a first brake-by-wire command is sent to the brake-by-wire chassis; wherein, the brake-by-wire chassis is also used to execute brake-by-wire operations according to the first brake-by-wire command;

[0128] S209: If the non-braking module does not report an error, determine whether there is a drive-by-wire emergency braking command; or, if the non-braking module reports an error, when sending the first drive-by-wire braking command to the drive-by-wire chassis, determine whether the current first drive-by-wire braking command is a drive-by-wire emergency braking command.

[0129] S210: If there is no brake-by-wire emergency braking command at present, or if the current first brake-by-wire command is not a brake-by-wire emergency braking command, then return to step S202;

[0130] If there is a brake-by-wire emergency braking command, or if the current first brake-by-wire command is a brake-by-wire emergency braking command, then a second brake-by-wire command is sent to the brake-by-wire chassis; the brake-by-wire chassis is used to execute brake-by-wire operations according to the second brake-by-wire command.

[0131] S211: During the process of the online control chassis executing the online control braking operation according to the second online control braking command, it is determined whether the actual deceleration of the vehicle reaches the first threshold within the target time period.

[0132] S212: If the actual deceleration of the vehicle does not reach the first threshold, a third braking level signal is sent to the redundant control unit; wherein, the redundant control unit is used to send a third pneumatic braking command to the drive-by-wire chassis based on the third braking level signal; the drive-by-wire chassis is used to perform pneumatic braking operation according to the third pneumatic braking command.

[0133] S213: If the actual deceleration of the vehicle reaches the first threshold, then determine whether the change in the gas pressure delivered to the brake actuator module reaches the second threshold; wherein, the brake actuator module is a module in the drive-by-wire chassis used to perform braking operations; when performing braking operations, the brake actuator module is executed by the gas pressure provided by the gas delivered to the brake actuator module;

[0134] S214: If the change in gas pressure supplied to the braking actuator module does not reach the second threshold, a fourth braking level signal is sent to the redundant control unit; wherein, the redundant control unit is used to send a fourth pneumatic braking command to the drive-by-wire chassis based on the fourth braking level signal; the drive-by-wire chassis is used to perform pneumatic braking operation according to the fourth pneumatic braking command to transmit gas to the braking switch terminal of the braking module; wherein, the braking switch terminal of the braking module controls the braking actuator terminal to perform braking operation according to the received gas;

[0135] If the change in gas pressure supplied to the braking actuator module reaches the second threshold, then return to step S202.

[0136] Based on the same technical concept, this application also provides a vehicle redundancy safety control system, which includes: a domain controller, a drive-by-wire chassis, and a redundant control unit;

[0137] The domain controller is used to determine whether the drive-by-wire chassis meets the conditions for drive-by-wire braking; and if the drive-by-wire chassis does not meet the conditions for drive-by-wire braking, it sends a first braking level signal to the redundant control unit.

[0138] The redundant control unit is used to send a first pneumatic braking command to the drive-by-wire chassis based on the first braking level signal.

[0139] The drive-by-wire chassis is used to perform pneumatic braking operations according to the first pneumatic braking command;

[0140] The domain controller is further configured to determine whether each non-braking module on the drive-by-wire chassis reports an error if the drive-by-wire chassis meets the conditions for drive-by-wire braking; and to send a first drive-by-wire braking command to the drive-by-wire chassis if the non-braking module reports an error.

[0141] The drive-by-wire chassis is also used to execute drive-by-wire braking operations according to the first drive-by-wire braking command.

[0142] Optionally, the domain controller further includes redundant bumper units;

[0143] The domain controller is also configured to detect whether the redundant bumper unit is triggered; wherein the redundant bumper unit is triggered when the vehicle is involved in a collision; and if the redundant bumper unit is triggered, a second braking level signal is sent to the redundant control unit.

[0144] The redundant control unit is also used to send a second pneumatic braking command to the drive-by-wire chassis based on the second braking level signal;

[0145] The drive-by-wire chassis is also used to perform pneumatic braking operations according to the second pneumatic braking command.

[0146] Optionally, the domain controller includes a high-side interface and an AD interface; the redundant control unit includes normally open relays and normally closed relays; the wired chassis includes an I / O interface; the normally open relay includes a first normally open input terminal, a second normally open input terminal, a first normally open output terminal, and a second normally open output terminal; the normally closed relay includes a first normally closed input terminal, a second normally closed input terminal, a first normally closed output terminal, and a second normally closed output terminal; wherein, the second normally open input terminal is grounded, the second normally closed input terminal is grounded, and the first normally closed output terminal is connected to VCC;

[0147] When the domain controller sends a first braking level signal to the redundant control unit if the drive-by-wire chassis does not meet the conditions for drive-by-wire braking, it is specifically used for:

[0148] The AD interface is used to receive a level signal from the redundant bumper unit indicating whether the redundant bumper unit has been triggered.

[0149] If the drive-by-wire chassis does not meet the conditions for drive-by-wire braking and the redundant bumper unit is not triggered, a first high-impedance state level signal is sent to the first normally open output terminal through the high-side interface; wherein, the redundant bumper unit is used to send a first high-level signal to the first normally open input terminal when the redundant bumper unit is not triggered.

[0150] When the redundant control unit is used to send a first pneumatic braking command to the drive-by-wire chassis based on the first braking level signal, it includes:

[0151] The first normally open input terminal is configured to be connected to the second normally open input terminal when the first high-level signal is received; wherein, when the first normally open input terminal receives the first high-level signal, the first normally open output terminal is connected to the second normally open output terminal.

[0152] The first normally open output terminal is used to send the first high-impedance state level signal received from the high-side interface to the first normally closed input terminal through the second normally open output terminal after the first normally open output terminal and the second normally open output terminal are turned on.

[0153] The first normally closed input terminal is used to conduct with the second normally closed input terminal when the first high-impedance state level signal is received; wherein, when the first normally closed input terminal receives the first high-impedance state level signal, the first normally closed output terminal is conducted with the second normally closed output terminal; when the first normally closed output terminal is conducted with the second normally closed output terminal, a second high-level signal representing the first pneumatic braking command is output to the IO interface through VCC connected to the first normally closed output terminal, sequentially through the first normally closed output terminal and the second normally closed output terminal.

[0154] Optionally, the redundant bumper unit includes: a first normally closed limit switch and a second normally closed limit switch connected in series; the end of the first normally closed limit switch away from the second normally closed limit switch is connected to VCC; the end of the second normally closed limit switch away from the first normally closed limit switch is connected to the first normally open input terminal; when the redundant bumper unit is triggered, the first normally closed limit switch and the second normally closed limit switch are disconnected; when the redundant bumper unit is not triggered, the first normally closed limit switch and / or the second normally closed limit switch are closed.

[0155] When the redundant bumper unit is not triggered, sending a first high-level signal to the first normally open input terminal includes:

[0156] The VCC connected to the first normally closed limit switch is used to output a first high-level signal to the first normally open input terminal in sequence through the closed first normally closed limit switch and the second normally closed limit switch when the redundant bumper unit is not triggered.

[0157] Optionally, when the domain controller sends a second braking level signal to the redundant control unit if the redundant bumper unit is triggered, it includes:

[0158] The AD interface is used to receive a first floating state level signal indicating that the redundant bumper unit has been triggered.

[0159] The redundant bumper unit is used to send the first floating state level signal to the first normally open input terminal when the redundant bumper unit is triggered.

[0160] The domain controller is configured to send a second high-impedance state level signal to the first normally open output terminal through the high-side interface if the redundant bumper unit is triggered.

[0161] Specifically, when the first normally open input terminal receives the first floating state level signal, the first normally open output terminal and the second normally open output terminal are not connected, so that the first normally closed input terminal receives the second floating state level signal; when the first normally closed input terminal receives the second floating state level signal, the first normally closed output terminal and the second normally closed output terminal are connected, so that VCC connected to the first normally closed output terminal outputs a third high-level signal to the IO interface in sequence through the first normally closed output terminal and the second normally closed output terminal to characterize the second braking level signal.

[0162] Optionally, the redundant bumper unit further includes a bypass normally open switch; one end of the bypass normally open switch is connected to VCC, and the other end is connected to the first normally open input terminal, the AD interface, and the end of the second normally closed limit switch that is furthest from the first normally closed limit switch.

[0163] The domain controller is further configured to, after sending a second braking level signal to the redundant control unit if the redundant bumper unit is triggered, if the vehicle needs to be restarted after a collision and at least one of the first normally closed limit switch, the second normally closed limit switch, and the line between the VCC connected to the first normally open input terminal and the first normally closed limit switch is disconnected, control the bypass normally open switch to close. When the bypass normally open switch is closed, the controller receives a fourth high-level signal transmitted from the VCC connected to the bypass normally open switch through the AD interface; wherein, when the bypass normally open switch is closed, the first normally open input terminal receives the fourth high-level signal transmitted from the VCC connected to the bypass normally open switch.

[0164] The domain controller is also configured to send a fifth high-level signal to the first normally open output terminal through the high-side interface;

[0165] The first normally open input terminal is used to connect the first normally open output terminal and the second normally open output terminal when the fourth high-level signal is received, so as to transmit the fifth high-level signal to the first normally closed input terminal through the connected first normally open output terminal and the second normally open output terminal.

[0166] The first normally closed input terminal is configured to de-conduct the first normally closed output terminal and the second normally closed output terminal when the fifth high-level signal is received, so that the IO interface receives the fifth floating state level signal indicating a vehicle start command.

[0167] Optionally, the domain controller is further configured to, if the drive-by-wire chassis meets the conditions for drive-by-wire braking, determine whether each non-braking module on the drive-by-wire chassis has reported an error; if the non-braking module has not reported an error, determine whether there is a drive-by-wire emergency braking command; and if there is a drive-by-wire emergency braking command, send a second drive-by-wire braking command to the drive-by-wire chassis.

[0168] The drive-by-wire chassis is used to execute drive-by-wire braking operations according to the second drive-by-wire braking command; wherein the drive-by-wire emergency braking command includes a drive-by-wire braking control amount that is greater than a preset control amount;

[0169] The domain controller is further configured to determine, during the process of the drive-by-wire chassis performing drive-by-wire operation according to the second drive-by-wire command, whether the actual deceleration of the vehicle reaches a first threshold within a target time period; if the actual deceleration of the vehicle does not reach the first threshold, then send a third braking level signal to the redundant control unit.

[0170] The redundant control unit is used to send a third pneumatic braking command to the drive-by-wire chassis based on the third braking level signal.

[0171] The drive-by-wire chassis is used to perform pneumatic braking operations according to the third pneumatic braking command.

[0172] Optionally, the domain controller is further configured to:

[0173] If the actual deceleration of the vehicle reaches the first threshold, it is determined whether the change in air pressure provided by the gas supplied to the brake actuator of the brake module reaches the second threshold; wherein, the brake actuator of the brake module is one end of the drive-by-wire chassis used to perform braking operation; when the brake actuator of the brake module performs braking operation, it is executed by the air pressure provided by the gas supplied to the brake actuator.

[0174] If the change in gas pressure supplied by the gas delivered to the braking actuator does not reach the second threshold, a fourth braking level signal is sent to the redundant control unit.

[0175] The redundant control unit is used to send a fourth pneumatic braking command to the drive-by-wire chassis based on the fourth braking level signal.

[0176] The drive-by-wire chassis is used to perform pneumatic braking operations according to the fourth pneumatic braking command, so as to transmit gas to the brake switch terminal of the brake module; wherein, the brake switch terminal of the brake module controls the brake actuator terminal to perform braking operations according to the received gas.

[0177] Optionally, the domain controller is further configured to detect whether the redundant bumper unit has been triggered, and if the redundant bumper unit has not been triggered, determine whether the current driving mode of the vehicle is the autonomous driving mode.

[0178] When determining whether the drive-by-wire chassis meets the conditions for drive-by-wire braking, the domain controller is specifically used for:

[0179] If the current driving mode of the vehicle is the automatic driving mode, then it is determined whether the drive-by-wire chassis meets the conditions for drive-by-wire braking.

[0180] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process of the system described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0181] In the several embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the shown or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0182] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0183] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0184] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a processor-executable, non-volatile, computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0185] Finally, it should be noted that the above-described embodiments are merely specific implementations of this application, used to illustrate the technical solutions of this application, and not to limit them. The scope of protection of this application is not limited thereto. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the scope of the technology disclosed in this application. Such modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of protection of the claims.

Claims

1. A vehicle redundant safety control method, characterized by, The vehicle redundant safety control method is applied to a domain controller in a vehicle redundant safety control system; The vehicle redundant safety control system further comprises a chassis-by-wire chassis, a redundant control unit, and a redundant bumper unit; the method comprises: determining whether the chassis-by-wire chassis meets the conditions for chassis-by-wire braking; if the chassis-by-wire chassis does not meet the conditions for chassis-by-wire braking, sending a first brake level signal to the redundant control unit; wherein the redundant control unit is configured to send a first pneumatic brake instruction to the chassis-by-wire chassis based on the first brake level signal; and the chassis-by-wire chassis is configured to perform a pneumatic brake operation according to the first pneumatic brake instruction; if the chassis-by-wire chassis meets the conditions for chassis-by-wire braking, determining whether each non-braking module on the chassis-by-wire chassis has an error; if the non-braking module has no error, determining whether there is a chassis-by-wire emergency brake instruction at present; if there is a chassis-by-wire emergency brake instruction at present, sending a second chassis-by-wire brake instruction to the chassis-by-wire chassis; during the process in which the chassis-by-wire chassis performs a chassis-by-wire braking operation according to the second chassis-by-wire brake instruction, determining whether the actual deceleration of the vehicle reaches a first threshold value within a target time period; if the actual deceleration of the vehicle does not reach the first threshold value, sending a third brake level signal to the redundant control unit; wherein the redundant control unit is configured to send a third pneumatic brake instruction to the chassis-by-wire chassis based on the third brake level signal; and the chassis-by-wire chassis is configured to perform a pneumatic brake operation according to the third pneumatic brake instruction; if the non-braking module has an error, sending a first chassis-by-wire brake instruction to the chassis-by-wire chassis; wherein the chassis-by-wire chassis is further configured to perform a chassis-by-wire braking operation according to the first chassis-by-wire brake instruction; if the redundant bumper unit is triggered, sending a second brake level signal to the redundant control unit; wherein the redundant control unit is configured to send a second pneumatic brake instruction to the chassis-by-wire chassis based on the second brake level signal; and the chassis-by-wire chassis is configured to perform a pneumatic brake operation according to the second pneumatic brake instruction.

2. The method of claim 1, wherein, The if the redundant bumper unit is triggered, sending a second brake level signal to the redundant control unit, comprises: detecting whether the redundant bumper unit is triggered; wherein the redundant bumper unit is triggered when the vehicle is in a collision; if the redundant bumper unit is triggered, sending a second brake level signal to the redundant control unit.

3. The method of claim 2, wherein, The domain controller comprises a high-side interface and an AD interface; the redundant control unit comprises a normally open relay and a normally closed relay; the chassis-by-wire chassis comprises an IO interface; the normally open relay comprises a first normally open input end, a second normally open input end, a first normally open output end, and a second normally open output end; the normally closed relay comprises a first normally closed input end, a second normally closed input end, a first normally closed output end, and a second normally closed output end; wherein the second normally open input end is grounded, the second normally closed input end is grounded, and the first normally closed output end is connected to VCC; The if the chassis-by-wire chassis does not meet the conditions for chassis-by-wire braking, sending a first brake level signal to the redundant control unit, comprises: receiving, by the AD interface, a level signal from the redundant bumper unit, the level signal indicating whether the redundant bumper unit is triggered or not; if the by-wire chassis does not satisfy the condition of by-wire brake and the redundant bumper unit is not triggered, sending, by the high-side interface, a first high-impedance state level signal to the first normally-open output terminal; wherein the redundant bumper unit is configured to send a first high level signal to the first normally-open input terminal when the redundant bumper unit is not triggered; the redundant control unit comprises the following when sending a first pneumatic brake instruction to the by-wire chassis based on the first brake level signal: the first normally-open input terminal is configured to be conductive with the second normally-open input terminal when receiving the first high level signal; wherein the first normally-open input terminal is configured to be conductive with the second normally-open output terminal when receiving the first high level signal; the first normally-open output terminal is configured to send the first high-impedance state level signal received from the high-side interface to the first normally-closed input terminal through the second normally-open output terminal after the first normally-open output terminal is conductive with the second normally-open output terminal; the first normally-closed input terminal is configured to be conductive with the second normally-closed input terminal when receiving the first high-impedance state level signal; wherein the first normally-closed input terminal is configured to be conductive with the second normally-closed output terminal when receiving the first high-impedance state level signal; and when the first normally-closed output terminal is conductive with the second normally-closed output terminal, outputting a second high level signal indicating the first pneumatic brake instruction to the IO interface through VCC connected to the first normally-closed output terminal, the first normally-closed output terminal and the second normally-closed output terminal in sequence.

4. The method of claim 3, wherein, the redundant bumper unit comprises a first normally-closed travel switch and a second normally-closed travel switch connected in series; one end of the first normally-closed travel switch away from the second normally-closed travel switch is connected to VCC; one end of the second normally-closed travel switch away from the first normally-closed travel switch is connected to the first normally-open input terminal; when the redundant bumper unit is triggered, the first normally-closed travel switch and / or the second normally-closed travel switch is open; when the redundant bumper unit is not triggered, the first normally-closed travel switch and the second normally-closed travel switch are closed; the redundant bumper unit comprises the following when sending a first high level signal to the first normally-open input terminal when the redundant bumper unit is not triggered: VCC connected to the first normally-closed travel switch is configured to output a first high level signal to the first normally-open input terminal through the closed first normally-closed travel switch and the second normally-closed travel switch in sequence when the redundant bumper unit is not triggered.

5. The method of claim 4, wherein, if the redundant bumper unit is triggered, sending a second brake level signal to the redundant control unit, comprising: receive, through the AD interface, a first floating state level signal from the redundant bumper unit, the first floating state level signal indicating that the redundant bumper unit is triggered; wherein when the redundant bumper unit is triggered, the redundant bumper unit sends the first floating state level signal to the first normally open input terminal; if the redundant bumper unit is triggered, send a second high resistance state level signal to the first normally open output terminal through the high-side interface; wherein when the first normally open input terminal receives the first floating state level signal, the first normally open output terminal and the second normally open output terminal are not conductive, so that the first normally closed input terminal receives a second floating state level signal; when the first normally closed input terminal receives the second floating state level signal, the first normally closed output terminal and the second normally closed output terminal are conductive, so that VCC connected to the first normally closed output terminal is sequentially output to the IO interface through the first normally closed output terminal and the second normally closed output terminal to output a third high level signal representing the second brake level signal.

6. The method of claim 4, wherein, The redundant bumper unit further comprises a bypass normally open switch; one end of the bypass normally open switch is connected to VCC, and the other end is connected to the first normally open input terminal, the AD interface, and the end of the second normally closed travel switch away from the first normally closed travel switch, respectively; after the method further comprises: if the vehicle needs to be restarted after being braked due to a collision, and at least one of the first normally closed travel switch, the second normally closed travel switch, and the line between VCC connected to the first normally closed travel switch and the first normally open input terminal is disconnected, the bypass normally open switch is controlled to be closed, and after the bypass normally open switch is closed, a fourth high level signal transmitted from VCC connected to the bypass normally open switch is received through the AD interface; wherein when the bypass normally open switch is closed, the first normally open input terminal receives the fourth high level signal transmitted from VCC connected to the bypass normally open switch; send a fifth high level signal to the first normally open output terminal through the high-side interface; wherein when the first normally open input terminal receives the fourth high level signal, the first normally open output terminal and the second normally open output terminal are conductive, so that the fifth high level signal is transmitted to the first normally closed input terminal through the conductive first normally open output terminal and the second normally open output terminal; when the first normally closed input terminal receives the fifth high level signal, the first normally closed output terminal and the second normally closed output terminal are not conductive, so that the IO interface receives a fifth floating state level signal representing a vehicle start instruction.

7. The method of claim 1, wherein, The brake control amount of the drive-by-wire brake included in the drive-by-wire emergency braking instruction is greater than a preset control amount; the drive-by-wire chassis is used to perform drive-by-wire operation according to the second drive-by-wire braking instruction.

8. The method of claim 1, wherein, The method further comprises: If the actual deceleration of the vehicle reaches the first threshold value, it is determined whether the change value of the gas pressure of the gas delivered to the brake execution end of the brake module reaches a second threshold value; wherein the brake execution end of the brake module is one end of the drive-by-wire chassis used to execute the brake operation; the brake execution end of the brake module is executed by the gas pressure provided by the gas delivered to the brake execution end when executing the brake operation; If the change value of the gas pressure provided by the gas delivered to the brake execution end does not reach the second threshold value, a fourth brake level signal is sent to the redundant control unit; wherein the redundant control unit is used to send a fourth pneumatic brake instruction to the drive-by-wire chassis based on the fourth brake level signal; the drive-by-wire chassis is used to execute a pneumatic brake operation according to the fourth pneumatic brake instruction to transmit gas to the brake switch end of the brake module; wherein the brake switch end of the brake module controls the brake execution end to execute the brake operation according to the received gas.

9. The method of claim 2, wherein, After detecting whether the redundant bumper unit is triggered, the method further comprises: If the redundant bumper unit is not triggered, it is determined whether the current driving mode of the vehicle is an automatic driving mode; The determination of whether the drive-by-wire chassis meets the conditions of drive-by-wire includes: If the current driving mode of the vehicle is the automatic driving mode, it is determined whether the drive-by-wire chassis meets the conditions of drive-by-wire.

10. A vehicle redundant safety control system, characterized by, The vehicle redundant safety control system comprises a domain controller, a drive-by-wire chassis, a redundant control unit, and a redundant bumper unit; The domain controller is used to determine whether the drive-by-wire chassis meets the conditions of drive-by-wire; and if the drive-by-wire chassis does not meet the conditions of drive-by-wire, a first brake level signal is sent to the redundant control unit; The redundant control unit is used to send a first pneumatic brake instruction to the drive-by-wire chassis based on the first brake level signal; The drive-by-wire chassis is used to execute a pneumatic brake operation according to the first pneumatic brake instruction; The domain controller is further used to determine whether each non-brake module on the drive-by-wire chassis has an error if the drive-by-wire chassis meets the conditions of drive-by-wire; if the non-brake module does not have an error, it is determined whether there is a drive-by-wire emergency brake instruction currently; if there is a drive-by-wire emergency brake instruction currently, a second drive-by-wire instruction is sent to the drive-by-wire chassis; during the execution of the drive-by-wire operation of the drive-by-wire chassis according to the second drive-by-wire instruction, it is determined whether the actual deceleration of the vehicle reaches a first threshold value within a target time period; if the actual deceleration of the vehicle does not reach the first threshold value, a third brake level signal is sent to the redundant control unit; and if the non-brake module has an error, a first drive-by-wire instruction is sent to the drive-by-wire chassis; The redundant control unit is further used to send a third pneumatic brake instruction to the drive-by-wire chassis based on the third brake level signal; The drive-by-wire chassis is further used to execute a pneumatic brake operation according to the third pneumatic brake instruction; and execute a drive-by-wire operation according to the first drive-by-wire instruction; The domain controller is further configured to send a second brake level signal to the redundancy control unit if the redundancy bumper unit is triggered. The redundancy control unit is further configured to send a second pneumatic brake instruction to the drive-by-wire chassis based on the second brake level signal. The drive-by-wire chassis is further configured to perform a pneumatic brake operation according to the second pneumatic brake instruction.

Images