Safety control method, controller, equipment, braking system, vehicle and medium

Abstract

The invention discloses a safety control method of a vehicle, a controller of the vehicle, electronic equipment, a braking system, the vehicle and a computer readable storage medium. The safety control method comprises the steps that a controller obtains a processing signal and a monitoring signal, the processing signal is obtained by processing an input signal, and the monitoring signal is obtained by monitoring the working state of the controller; and the controller outputs a control signal according to the processing signal and the monitoring signal, so that the vehicle enters a safe state. According to the safety control method, the vehicle is controlled to enter the safety state by monitoring the work of the controller and determining the control signal according to the input signal, so that the vehicle achieves the corresponding function safety target, and the possibility of system failure is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of electronic parking, and more specifically, to a safety control method for a vehicle, a controller, an electronic device, a braking system, a vehicle, and a computer-readable storage medium. Background Art

[0002] With the development of automotive electronic technology, electronic parking brake systems are replacing traditional mechanical lever parking brake systems and are widely used in vehicles. The complexity and integration of electronic parking brake systems are increasing, and the risk and frequency of failures caused by electronic and electrical failures are also higher, and the safety requirements for the system are also getting higher. Therefore, it is necessary to perform functional safety design on the system to reduce system failures to a certain range, thereby reducing harm to people. In the related art, there is a lack of design for the controller architecture of electronic parking brake systems. Summary of the Invention

[0003] Embodiments of the present invention provide a safety control method for a vehicle, a controller, an electronic device, a braking system, a vehicle, and a computer-readable storage medium.

[0004] Embodiments of the present invention provide a safety control method for a vehicle. The safety control method includes: a controller obtains a processing signal and a monitoring signal, the processing signal is obtained by processing an input signal, and the monitoring signal is obtained by monitoring the working state of the controller; the controller outputs a control signal according to the processing signal and the monitoring signal to make the vehicle enter a safe state.

[0005] In some embodiments, the control signal is used to control the braking system of the vehicle to perform a braking action to make the vehicle enter the safe state.

[0006] In some embodiments, the braking action includes at least one of a parking braking action and a driving braking action.

[0007] In some embodiments, the monitoring signal includes a driving signal. The controller outputs a control signal according to the processing signal and the monitoring signal, including: the controller outputs the control signal according to the processing signal and the driving signal.

[0008] In some embodiments, the braking system includes a driving circuit, and the driving signal is determined according to the output current of the driving circuit.

[0009] In some embodiments, the controller outputs the control signal according to the processing signal and the driving signal, including: the controller outputs a first control signal according to a first processing signal and the monitoring signal, and the first control signal is used to control the vehicle to enter a first safety state to achieve a first functional safety objective, and the first functional safety objective is to avoid unexpected driving braking.

[0010] In some embodiments, the controller outputs a first control signal according to a first processing signal and the monitoring signal, including: when the controller receives the first processing signal, if the controller simultaneously receives a first driving signal or a first H-bridge signal, the controller outputs the first control signal to control the vehicle to enter the first safety state, so that the vehicle can achieve the first functional safety objective.

[0011] In some embodiments, the braking system further includes a driving circuit and an H-bridge, the input signals include a switch signal and a wheel speed signal, the first processing signal is used to indicate that the switch signal is invalid and the wheel speed signal is greater than a set wheel speed threshold, the first driving signal is used to indicate that the driving circuit has an output current, and the first H-bridge signal is used to indicate that the H-bridge has an output current.

[0012] In some embodiments, the controller outputs the control signal according to the processing signal and the driving signal, including: the controller outputs a second control signal according to a second processing signal and the monitoring signal, and the second control signal is used to control the vehicle to enter a second safety state to achieve a second functional safety objective, and the second functional safety objective is to avoid unexpected parking release.

[0013] In some embodiments, the controller outputs a second control signal according to a second processing signal and the monitoring signal, including: when the controller receives the second processing signal, if the controller simultaneously receives a first driving signal or a first H-bridge signal, the controller outputs the second control signal to control the vehicle to enter the second safety state, so that the vehicle can achieve the second functional safety objective.

[0014] In some embodiments, the braking system further includes a driving circuit and an H-bridge, the input signals include a switch signal and a wheel speed signal, the second processing signal is used to indicate that the switch signal is invalid and the wheel speed signal is less than a set wheel speed threshold, the first driving signal is used to indicate that the driving circuit has an output current, and the first H-bridge signal is used to indicate that the H-bridge has an output current.

[0015] In some embodiments, the controller outputs the control signal according to the processing signal and the driving signal, including: the controller outputs a second control signal according to a third processing signal and the monitoring signal, and the second control signal is used to control the vehicle to enter a second safety state to achieve a third functional safety objective, and the third functional safety objective is to avoid the failure of the parking brake operation.

[0016] In some embodiments, the controller outputs a second control signal according to a third processing signal and the monitoring signal, including: when the controller receives the third processing signal, if the controller simultaneously receives a second driving signal and a second H-bridge signal, the controller outputs the second control signal to control the vehicle to enter the second safety state, so that the vehicle can achieve the third functional safety objective.

[0017] In some embodiments, the braking system further includes a driving circuit and an H-bridge, the input signals include a switch signal and a wheel speed signal, the third processing signal is used to indicate that the switch signal is valid and the wheel speed signal is less than a set wheel speed threshold, the second driving signal is used to indicate that there is no output current in the driving circuit, and the second H-bridge signal is used to indicate that there is no output current in the H-bridge.

[0018] In some embodiments, the input signal includes a wheel speed signal, the controller is further configured to determine an actual torque value, the monitoring signal includes a comparison signal, and the controller outputs a control signal according to the processing signal and the monitoring signal, including: the controller outputs the control signal according to the comparison signal and the wheel speed signal to control the vehicle to enter the safety state, the comparison signal is used to indicate that the torque difference is greater than a set torque threshold, and the torque difference is used to indicate the difference between the actual torque value and the reference torque value.

[0019] In some embodiments, the comparison signal is further used to indicate that the torque difference is greater than the set torque threshold within a set number of times.

[0020] In some embodiments, the safety control method further includes: the controller collects a driving current; the controller determines the reference torque value according to the driving current, the input signal and a preset reference algorithm, the preset reference algorithm is different from the preset actual algorithm of the controller, and the actual torque value is determined according to the preset actual algorithm.

[0021] In some embodiments, the braking system includes a driving circuit, and the driving current is the current of the driving circuit.

[0022] In some embodiments, the controller outputs the control signal according to the comparison signal and the wheel speed signal, including:

[0023] When the wheel speed signal is greater than the set wheel speed threshold, if the controller receives the comparison signal, the controller outputs a first control signal to control the vehicle to enter a first safety state. When the vehicle is in the first safety state, the braking system stops working to achieve the fourth functional safety goal.

[0024] In some embodiments, the braking system further includes a motor, and the fourth functional safety goal is to avoid the torque of the motor being greater than a first preset threshold when the vehicle is in a driving state.

[0025] In some embodiments, the controller outputs the control signal according to the comparison signal and the wheel speed signal, including:

[0026] When the wheel speed signal is less than the set wheel speed threshold, if the controller receives the comparison signal, the controller outputs a second control signal to control the vehicle to enter a second safety state to achieve the fifth functional safety goal.

[0027] In some embodiments, the braking system further includes an H-bridge and a motor. When the vehicle is in the second safety state, the H-bridge controls the motor to be in a clamped state, and the fifth functional safety goal is to avoid the torque of the motor being less than a second preset threshold when the vehicle is in a parked state.

[0028] In some embodiments, the safety control method further includes: the controller receives the status information transmitted between the first domain and the second domain, and the execution status includes the execution time length;

[0029] When the difference between the execution time length of the first domain and the execution time length of the second domain is greater than the set time threshold, the controller outputs a first control signal to control the vehicle to enter a first safety state. When the vehicle is in the first safety state, the braking system stops working.

[0030] In some embodiments, the first domain and the second domain each include a motor, and the status information is used to determine the execution status of the motors in the first domain and the second domain.

[0031] In some embodiments, the control signal includes a first control signal, and the safety state includes a first safety state; the braking system further includes an H-bridge, and the braking system further includes a power supply module, which includes a battery module and a safety shutdown module. The battery module supplies power to the H-bridge through the safety shutdown module. When the safety shutdown module receives the first control signal, the safety shutdown module is configured to disconnect the power supply of the battery module to the H-bridge to stop the operation of the H-bridge, so that the vehicle enters the first safety state.

[0032] In some embodiments, when the H-bridge is not operating, the safety shutdown module disconnects the power supply of the battery module to the H-bridge; when the H-bridge is operating, the battery module supplies power to the H-bridge through the safety shutdown module.

[0033] In some embodiments, the safety control method further includes: monitoring the hardware environment of the controller; and controlling the vehicle to enter a safety state when it is determined that the hardware environment of the controller fails.

[0034] An embodiment of the present invention provides a controller for a vehicle. The controller is configured to obtain a processing signal and a monitoring signal. The processing signal is obtained by processing an input signal, and the monitoring signal is obtained by monitoring the operating state of the controller; the controller is further configured to output a control signal according to the processing signal and the monitoring signal to make the vehicle enter a safety state.

[0035] An embodiment of the present invention provides an electronic device, which includes one or more processors and a memory. The memory stores a computer program. When the computer program is executed by the processor, the steps of the safety control method according to any of the above embodiments are implemented.

[0036] An embodiment of the present invention provides a braking system, which includes the controller according to the above embodiment or the electronic device according to the above embodiment.

[0037] An embodiment of the present invention provides a vehicle, which includes the controller according to the above embodiment or the electronic device according to the above embodiment.

[0038] An embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, the steps of the safety control method according to any of the above embodiments are implemented.

[0039] The safety control method according to the embodiment of the present invention outputs a control signal based on a processed signal obtained by processing an input signal and a monitoring signal obtained by monitoring the operation of a controller, so as to control the vehicle to enter a safe state, thereby improving the safety and reliability of the vehicle.

[0040] Additional aspects and advantages of the present invention will be given in part in the following description, become apparent in part from the following description, or be learned through the practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The above and / or additional aspects and advantages of the present invention will become apparent and be readily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0042] Figure 1 is a schematic flow chart of the safety control method according to the embodiment of the present invention;

[0043] Figure 2 is a schematic connection diagram of a controller, a drive circuit and a motor according to the embodiment of the present invention;

[0044] Figure 3 is a schematic diagram of an electronic parking brake system according to the embodiment of the present invention;

[0045] Figure 4 is a schematic flow chart of the safety control method according to the embodiment of the present invention;

[0046] Figure 5 is a schematic diagram of a first domain and a second domain according to the embodiment of the present invention;

[0047] Figure 6 is a schematic flow chart of the safety control method according to the embodiment of the present invention;

[0048] Figure 7 is a schematic diagram of a power supply module according to the embodiment of the present invention;

[0049] Figure 8 is a schematic flow chart of the safety control method according to the embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0050] The embodiments of the present invention will be described in detail below. The embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below by referring to the accompanying drawings are exemplary only for explaining the present invention and should not be construed as limiting the present invention.

[0051] With the development of automotive electronics technology, the electronic parking brake system is replacing the traditional mechanical lever parking brake system in widespread use in vehicles. As the complexity and integration level of the electronic parking brake system increase, the risk and frequency of failures in the electronic parking brake system due to electronic and electrical failures are also higher, and the safety requirements for the system are also increasing.

[0052] For electronic and electrical systems, the causes of failures can be attributed to two categories. One is system failure, which is caused by human errors during system development and operation, generally due to design specification errors and design mistakes. The other is random hardware failure, which is caused by physical reasons such as corrosion, thermal stress, aging, etc. When random hardware failure occurs cannot be predicted, but it follows a certain probability distribution. For the electronic parking brake system, electronic and electrical failures are mainly unexpected braking and unexpected parking release of the caliper motor. The unexpected braking and unexpected parking release of the caliper motor may cause the vehicle to become unstable or collide with other vehicles or pedestrians. Therefore, it is necessary to conduct functional safety design for the system to reduce system failures to a certain range to reduce harm to people.

[0053] Please refer to Figures 1 to 3 , an embodiment of the present invention provides a safety control method, and the safety control method includes:

[0054] 01: The controller 100 obtains a processing signal and a monitoring signal. The processing signal is obtained by processing an input signal, and the monitoring signal is obtained by monitoring the working state of the controller 100;

[0055] 02: The controller 100 outputs a control signal according to the processing signal and the monitoring signal to make the vehicle enter a safe state.

[0056] Specifically, the safety control method of the embodiment of the present invention can be implemented by the controller 100 of the embodiment of the present invention. The controller 100 includes a function layer 110 and a function monitoring layer 120. The function layer is configured to control the parking system to work according to the input signal to implement the parking brake function or the driving brake function. The function monitoring layer 120 includes a signal processing module 121, a monitoring processing module 122, and a fault control module 123. The signal processing module 121 is configured to process the input signal of the function layer 110 and output a processing signal; the monitoring processing module 122 is configured to monitor the work of the function layer 110 and output a monitoring signal; wherein, step 01 and step 02 can be implemented by the fault control module 123 of the function monitoring layer 120 of the controller 100, that is to say, the fault control module 123 is configured to obtain the processing signal and the monitoring signal, and output a control signal according to the processing signal and the monitoring signal to control the vehicle to enter a safe state, thereby achieving the functional safety goal.

[0057] Among them, the braking system includes an electronic parking brake system 1000 (EPB). The electronic parking brake system 1000 includes a drive circuit 301 and a motor 302. The drive circuit 301 and the motor 302 can be collectively referred to as the actuator of the electronic parking brake system. The motor 302 can be a caliper motor 302. The caliper motor 302 realizes the parking function by clamping the brake disc of the vehicle. When realizing the driving function, the motor 302 releases the brake disc of the vehicle so that the brake disc can rotate. The electronic parking brake system includes a first domain 1001 and a second domain 1002, where the first domain 1001 includes the left domain of the vehicle, and the second domain 1002 includes the right domain of the vehicle. The controller 100 can be a microcontroller (MCU). The functional safety goals can be obtained through analysis and sorting in the functional safety concept stage. For example, first, according to the two braking functions of the electronic parking brake system, functional failures and their potential hazards are obtained to identify the hazard events combined with the hazards of the whole vehicle and the operating scenarios. The two braking functions include static parking braking and dynamic driving braking; then, the probability (E) of the scenario occurring, the severity (S) of the hazard, and the controllability (C) of the hazard are confirmed in turn, and the ASIL (Automotive Safety Integrity Level) of the hazard event is evaluated according to the ISO26262 standard; finally, the functional safety goals of the electronic parking brake system are obtained through analysis and sorting. The obtained functional safety goals are as follows:

[0058]

[0059] Among them, SG_No represents the serial number of the functional safety goal, ASIL represents the Automotive Safety Integrity Level (A represents a lower hazard level, D represents a higher hazard level), the safety state represents the safety state of the vehicle corresponding to the functional safety goal of the same serial number, the operation mode represents the operating state of the vehicle when the functional safety goal is achieved, and FTTI represents the Fault Tolerant Time Interval. The functional safety goals and the functional failures of the electronic parking brake system correspond to each other. According to the functional safety goals, the functional safety requirements (FSR) of the electronic parking brake system can be obtained as follows:

[0060]

[0061]

[0062] According to the functional safety requirements (FSR), the technical safety requirements (TSR) are further obtained as follows:

[0063]

[0064]

[0065] Among them, E2E (End to End) is end-to-end protection, VCU is the core electronic control unit for realizing vehicle control decisions, and the drive circuit includes a drive chip, which is used to output a drive voltage. Based on the functional safety requirements, the functional safety system architecture of the electronic parking brake system 1000 is designed using a three-layer architecture based on E-GAS (Standardized E-Gas Monitoring Concept for Gasoline and Diesel Engine Control Units), and the architecture of the controller 100 can be obtained. Among them, the three-layer architecture includes a function layer 110 (Level 1) and a function monitoring layer 120 (Level 2). The function layer 110 is used to realize the basic functions of the electronic parking brake system 1000, that is, to control the drive circuit 301 to work according to the input signal, so that the drive circuit 301 controls the motor 302 to work, thereby realizing the parking brake function or the driving brake function. The function layer 110 includes all the drive control algorithms and calibration parameters of the electronic parking brake system, and can calculate the PWM duty cycle according to the input signal. The PWM duty cycle can be used to control the torque of the motor 302; the control algorithm includes a drive control algorithm, which is used to control the operation of the drive circuit 301 and can realize the logical control of the braking and release of the electronic parking brake system. The input signals include the switch signal in the left domain of the electronic parking brake system, the switch signal in the right domain of the electronic parking brake system, the wheel speed signal of the vehicle, the acceleration signal, the request transmitted through the CANFD bus, and the signal requesting the start of the electronic parking brake system by the multimedia, etc. Among them, the switch signal of the electronic parking brake system is transmitted through a hard wire. The processing of the input signal by the signal processing module 121 includes making a reasonable judgment on the effective range and integrity of the input signal to determine whether the switch signal is valid; the processing of the input signal by the signal processing module 121 also includes judging whether the vehicle is in a driving state or a parking state according to the wheel speed signal, etc. The signal processing module 121 obtains and outputs a processing result by processing the input signal; the monitoring and processing module 122 is used to monitor the working condition of the function layer 110, including judging whether the calculation of the torque of the motor 302 in the function layer 110 is correct, etc.; the fault control module 123 judges whether the electronic parking brake system has a functional fault according to the processing signal and the monitoring signal, and outputs a control signal when the electronic parking brake system has a functional fault to control the vehicle to enter a safe state, thereby realizing the functional safety goal.

[0066] In this way, by outputting a control signal according to the processing signal obtained by processing the input signal and the monitoring signal obtained by monitoring the operation of the function layer 110 by the monitoring and processing module to control the vehicle to enter a safe state, the vehicle can achieve the corresponding functional safety goal, thereby reducing the possibility of system failure and improving the safety and reliability of the electronic parking brake system 1000.

[0067] In some embodiments, the control signal is used to control the braking system of the vehicle to perform a braking action, so that the vehicle enters a safe state.

[0068] Specifically, the electronic parking brake system 1000 can perform a braking action to achieve braking of the vehicle. The functional layer of the controller 100 controls the parking system to work according to the input signal to achieve the braking action.

[0069] In this way, by outputting a control signal, the braking system of the vehicle can be controlled to perform a braking action to control vehicle braking, so as to control the vehicle to enter a safe state.

[0070] In some embodiments, the braking action includes at least one of a parking braking action and a driving braking action.

[0071] Specifically, the parking braking action is used to indicate braking of the vehicle when the vehicle is in a parked state, and the driving braking action is used to indicate braking of the vehicle when the vehicle is in a driving state. The electronic parking brake system of the vehicle can be controlled to perform parking braking or driving braking through the control signal.

[0072] In this way, the electronic parking brake system of the vehicle can be controlled to perform parking braking or driving braking through the control signal.

[0073] In some embodiments, the monitoring signal includes a driving signal, and step 02 (the controller outputs a control signal according to the processing signal and the monitoring signal) includes:

[0074] 021: The controller 100 outputs a control signal according to the processing signal and the driving signal.

[0075] Specifically, step 021 can be implemented by the fault control module 123, that is, the fault control module 123 is further configured to output a control signal according to the processing signal and the driving signal.

[0076] Specifically, the controller can judge whether the vehicle has a functional fault according to the processing signal and the driving signal, and output a control signal when it is determined that a functional fault occurs, so as to control the vehicle to enter a safe state.

[0077] In this way, the fault control module 123 can judge whether the electronic parking brake system 1000 has a functional fault through the processing signal and the driving signal, and output a control signal when it is determined that a functional fault occurs, so as to control the vehicle to enter a safe state.

[0078] In some embodiments, the braking system includes a driving circuit 301, and the driving signal is determined according to the output current of the driving circuit 301.

[0079] Specifically, the monitoring processing module 122 includes an output monitoring module 1221. The output monitoring module 1221 is configured to output a driving signal according to the output current of the driving circuit 301. The output monitoring module 1221 is configured to collect the output current of the driving circuit 301 and output a driving signal according to whether the output current of the driving circuit 301 is collected. The fault control module 123 determines whether the vehicle has a functional fault according to the processing signal and the driving signal. When it is determined that the vehicle has a functional fault, the fault control module 123 outputs a control signal to control the vehicle to enter the corresponding safe state, so as to achieve the corresponding functional safety goal. For example, if the processing module determines that the switch signal of the input signal indicates that the driver has not activated the electronic parking brake system and outputs the corresponding processing signal, but the output monitoring module 1221 collects the output current at the driving circuit 301 and outputs the corresponding driving signal, the fault control module 123 receives the above processing signal and driving signal, and can determine that the vehicle has activated the electronic parking brake system for braking when the driver has no intention of activating the electronic parking brake system, that is, there is a functional fault of unexpected braking of the electronic parking brake system. Then, the fault control module 123 outputs the corresponding control signal to control the vehicle to enter the corresponding safe state.

[0080] In this way, by monitoring whether there is an output current in the driving circuit 301 through the output monitoring module 1221 and outputting a driving signal, the fault control module 123 can determine whether the electronic parking brake system 1000 has a functional fault according to the processing signal and the driving signal, and when it is determined that there is a functional fault, output a control signal to control the vehicle to enter a safe state.

[0081] Please refer to Figure 3 , in some embodiments, the braking system further includes a parking switch 500. The input signal includes a switch signal and a wheel speed signal. The wheel speed signal is used to represent the wheel speed of the vehicle. When the parking switch 500 is off, the switch signal is invalid; when the parking switch 500 is on, the switch signal is valid; the processing signal is determined according to the wheel speed signal and the switch signal.

[0082] Specifically, the signal processing module 121 is further configured to output a processing signal based on the wheel speed signal and the switch signal. The switch signal of the parking switch 500 is sampled by means of a dual-channel redundant sampling circuit, that is, two different sampling circuits are set to sample the switch signal. The two sampling circuits are crimped, and the switch signal is transmitted to the MCU through a hard wire. When the parking switch 500 is triggered, that is, when the parking switch 500 is closed, the driver has the intention to activate the electronic parking brake system, which is regarded as the switch signal being valid. At this time, the switch signal can be a high level; when the parking switch 500 is not triggered, that is, when the parking switch 500 is open, the driver has no intention to activate the electronic parking brake system, which is regarded as the switch signal being invalid. At this time, the switch signal can be a low level. When the wheel speed signal is less than the set wheel speed threshold, it represents that the vehicle is in the parked state; when the wheel speed signal is greater than the set wheel speed threshold, it represents that the vehicle is in the driving state. In one embodiment, the wheel speed threshold is 3, that is, when the wheel speed signal is greater than 3, it is determined that the vehicle is in the driving state; when the wheel speed signal is less than 3, it is determined that the vehicle is in the parked state. The signal processing module 121 outputs a processing signal based on the comparison result of the wheel speed signal and the set wheel speed threshold and the judgment result of whether the switch signal is valid. The fault control module 123 can judge whether the vehicle has a functional fault based on the processing signal and the monitoring signal, and output a control signal when a functional fault occurs to control the vehicle to enter a safe state and achieve the functional goal.

[0083] In this way, based on the switch signal and the wheel speed signal, the driving state of the vehicle and whether the driver has the intention to activate the electronic parking brake system 1000 can be determined, and the corresponding processing signal can be output. Based on the received processing signal and the monitoring signal, a control signal can be output to control the vehicle to enter the corresponding safe state.

[0084] In some embodiments, the braking system further includes an H-bridge 303 and a motor 302. The H-bridge 303 is used to drive the motor 302 to work to achieve the parking brake function or the driving brake function. The monitoring signal further includes an H-bridge signal, and the H-bridge signal is determined according to the output current of the H-bridge. The processing signal is determined according to the processing signal, the driving signal, and the H-bridge signal.

[0085] Specifically, the output monitoring module 1221 is further configured to output an H-bridge signal according to the output current of the H-bridge 303, and the fault control module 123 is further configured to output a control signal according to the processing signal, the driving signal, and the H-bridge signal. The driving circuit 301 is connected to the H-bridge 303, and the H-bridge 303 is connected to the motor 302. The driving circuit 301 drives the H-bridge 303 to operate to control the rotation of the motor 302, thereby realizing the parking function and the driving function. The driving circuit 301, the H-bridge 303, and the motor 302 can be collectively referred to as the actuator of the electronic parking brake system. The H-bridge 303 includes a positive electrode and a negative electrode. The output monitoring module 1221 respectively collects whether there is an output current at the positive electrode and the negative electrode of the H-bridge 303, and simultaneously collects the output current of the driving circuit 301 and the output current of the H-bridge 303. By respectively arranging two independent and redundant acquisition circuits at the positive electrode and the negative electrode, it can be ensured that when one of the acquisition circuits fails, the acquisition can be performed through the other normally operating acquisition circuit, providing double protection and comprehensively monitoring the working state of the electronic parking brake system. The fault control module 123 determines whether a functional fault occurs in the electronic parking brake system according to the processing signal, the driving signal, and the H-bridge signal. When a functional fault occurs, the fault control module 123 outputs a control signal to control the vehicle to enter a safe state.

[0086] In this way, simultaneously collecting the output current of the driving circuit 301 and the output current of the H-bridge 303 can provide double protection and comprehensively monitor the working state of the electronic parking brake system.

[0087] In some embodiments, step 021 (the controller 100 outputs a control signal according to the processing signal and the driving signal) includes:

[0088] 0211: The controller 100 outputs a first control signal according to the first processing signal and the monitoring signal. The first control signal is used to control the vehicle to enter a first safe state to achieve the first functional safety goal.

[0089] Specifically, in the case where the switch signal is invalid and the wheel speed signal is greater than the set wheel speed threshold, the signal processing module 121 is configured to output a first processing signal; step 0211 can be implemented by the fault control module 123, that is, the fault control module 123 is configured to output a first control signal according to the first processing signal and the monitoring signal. The first control signal is used to control the vehicle to enter a first safe state to achieve the first functional safety goal.

[0090] Among them, the first functional safety goal is to avoid unexpected driving braking, and the corresponding functional failure is unexpected driving braking, that is, when the driver does not activate the electronic parking brake system, the electronic parking brake system operates to perform parking braking. Unexpected driving braking may cause the vehicle to suddenly brake during driving, resulting in the vehicle losing control and causing serious consequences such as collisions. Therefore, the automotive safety integrity level of the first functional safety goal is D. The first safety state corresponding to the first functional safety goal is to turn off the electronic parking brake system, that is, directly control the electronic parking brake system 1000 to stop working. When the switch signal is invalid and the wheel speed signal is greater than the set wheel speed threshold, the signal processing module 121 outputs a first processing signal. The fault control module 123 can determine that the vehicle is in a driving state based on the first processing signal and that the driver has no intention of activating the electronic parking brake system. At this time, the fault control module 123 can determine whether the electronic parking brake system has a functional failure of unexpected driving braking based on the monitoring signal, and output a first control signal when it determines that a functional failure has occurred to control the vehicle to enter the first safety state, that is, control the electronic parking brake system to stop working to avoid unexpected driving braking and achieve the first functional safety goal. In addition, when in the first safety state, the vehicle reminds the driver of the corresponding functional failure, and the driver can learn about the functional failure that has occurred and the safety state of the vehicle through the instrument panel.

[0091] Thus, when the switch signal is invalid and the wheel speed signal is greater than the set wheel speed threshold, the processing signal is the first processing signal. Based on the first processing signal, it is determined that the vehicle is in a driving state and the driver has no intention of activating the electronic parking brake system 1000. At this time, a first control signal is output according to the monitoring signal to control the vehicle to enter the first safety state and stop the operation of the electronic parking brake system 1000, thereby achieving the first functional safety goal and avoiding unexpected driving braking.

[0092] In some embodiments, step 021 (the controller 100 outputs a control signal according to the processing signal and the drive signal) includes:

[0093] 0212: The controller 100 outputs a second control signal according to the second processing signal and the monitoring signal, and the second control signal is used to control the vehicle to enter the second safety state to achieve the second functional safety goal.

[0094] Specifically, when the switch signal is invalid and the wheel speed signal is less than the set wheel speed threshold, the signal processing module 121 is configured to output a second processing signal; step 0212 can be implemented by the fault control module 123, that is, the fault control module 123 outputs a second control signal according to the second processing signal and the monitoring signal, and the second control signal is used to control the vehicle to enter the second safety state to achieve the second functional safety goal.

[0095] Among them, the second functional safety goal is to avoid unintended parking release, and the corresponding functional failure is unintended parking release, that is, when the driver does not activate the electronic parking brake system, the electronic parking brake system operates to release the brake, enabling the vehicle to enter the driving state. Unintended parking release may cause the vehicle to move suddenly while parked. At this time, since the driver may have left the vehicle and cannot handle it in time, the vehicle operates without control and may cause serious consequences such as collisions. Therefore, the automotive safety integrity level of the first functional safety goal is C. The first safety state corresponding to the first functional safety goal is to control the motor 302 to be in the clamping state, that is, to control the electronic parking brake system to maintain the braking so that the vehicle can maintain the parked state. When the switch signal is invalid and the wheel speed signal is less than the set wheel speed threshold, the signal processing module 121 outputs a second processing signal. The fault control module 123 can determine that the vehicle is in the parked state based on the second processing signal and that the driver has no intention of starting the electronic parking brake system. At this time, the fault control module 123 can determine whether the electronic parking brake system has a functional failure of unintended parking release based on the monitoring signal, and output a second control signal when it determines that a functional failure has occurred to control the vehicle to enter the second safety state, that is, to control the motor 302 to be in the clamping state to avoid unintended parking release and achieve the second functional safety goal.

[0096] In this way, when the switch signal is invalid and the wheel speed signal is less than the set wheel speed threshold, the processing signal is the second processing signal. Based on the second processing signal, it is determined that the vehicle is in the parked state and the driver has no intention of starting the electronic parking brake system 1000. At this time, a second control signal is output according to the monitoring signal to control the vehicle to enter the second safety state, and the motor 302 is controlled to be in the clamping state, thereby achieving the second functional safety goal and avoiding unintended parking release.

[0097] In some embodiments, step 021 (the controller 100 outputs a control signal according to the processing signal and the drive signal) includes:

[0098] 0213: The controller 100 outputs a second control signal according to the third processing signal and the monitoring signal. The second control signal is used to control the vehicle to enter the second safety state to achieve the third functional safety goal.

[0099] Specifically, when the switch signal is valid and the wheel speed signal is less than the set wheel speed threshold, the signal processing module 121 outputs a third processing signal; step 0213 can be implemented by the fault control module 123. That is to say, the fault control module 123 outputs a second control signal according to the third processing signal and the monitoring signal. The second control signal is used to control the vehicle to enter the second safety state to achieve the third functional safety goal.

[0100] Among them, the third functional safety goal is to avoid the failure of the parking brake function of the electronic parking brake system 1000. The corresponding functional failure is the failure of the parking brake function, that is, when the driver activates the electronic parking brake system, the electronic parking brake system fails and cannot implement the parking function, resulting in the vehicle being unable to brake. The failure of the parking brake function may cause the vehicle to be unable to park stably when parked. At this time, since the driver has not left the vehicle, it can be handled in a timely manner. Therefore, the automotive safety integrity level of the third functional safety goal is B. The third safety state corresponding to the third functional safety goal is to control the motor 302 to be in the clamping state, that is, to control the electronic parking brake system to maintain braking so that the vehicle can maintain the parked state. When the switch signal is valid and the wheel speed signal is less than the set wheel speed threshold, the signal processing module 121 outputs a third processing signal. The fault control module 123 can determine that the vehicle is in the parked state and the driver has the intention to activate the electronic parking brake system according to the third processing signal. At this time, the fault control module 123 can determine whether the electronic parking brake system has a functional failure of the parking brake function according to the monitoring signal, and output a second control signal when it is determined that a functional failure occurs, so as to control the vehicle to enter the second safety state, that is, to control the motor 302 to be in the clamping state, so as to avoid the failure of the parking brake function and achieve the third functional safety goal. In addition, when in the second safety state, the vehicle reminds the driver of the corresponding functional failure.

[0101] Thus, when the switch signal is valid and the wheel speed signal is less than the set wheel speed threshold, the processing signal is to output a third processing signal, which can determine that the vehicle is in the parked state and the driver has the intention to activate the electronic parking brake system 1000 according to the third processing signal. At this time, a second control signal is output according to the monitoring signal to control the vehicle to enter the second safety state and control the motor 302 to be in the clamping state, so as to achieve the second functional safety goal and avoid unexpected parking release.

[0102] In some embodiments, step 0211 (the controller 100 outputs a first control signal according to the first processing signal and the monitoring signal) includes:

[0103] 02111: When the controller 100 receives the first processing signal, if the controller 100 simultaneously receives the first drive signal or the first H-bridge signal, the controller 100 outputs a first control signal to control the vehicle to enter the first safety state, so that the vehicle can achieve the first functional safety goal.

[0104] Specifically, step 02111 can be implemented by the fault control module 123. That is to say, when the fault control module 123 receives the first processing signal, if the fault control module 123 receives the first drive signal or the first H-bridge signal, the fault control module 123 is configured to output the first control signal to control the vehicle to enter the first safety state, so that the vehicle can achieve the first functional safety goal.

[0105] In this way, when the controller receives the first processing signal and the first drive signal at the same time or receives the first processing signal and the first H-bridge signal at the same time, it outputs the first control signal to control the vehicle to enter the first safety state.

[0106] In some embodiments, the braking system further includes a drive circuit 301 and an H-bridge 303. The input signals include a switch signal and a wheel speed signal. The first processing signal is used to indicate that the switch signal is invalid and the wheel speed signal is greater than a set wheel speed threshold. The first drive signal is used to indicate that there is an output current in the drive circuit 301. The first H-bridge signal is used to indicate that there is an output current in the H-bridge 303.

[0107] Specifically, when the output monitoring module 1221 collects an output current in the drive circuit 301, collects an output current in the H-bridge 303, or collects output currents in both the drive circuit 301 and the H-bridge 303, it can determine that the actuator has performed a pull-up or release action, that is, the electronic parking brake system is in an operating state. Then, when the fault control module 123 receives the first H-bridge signal, receives the first drive signal, or receives the first H-bridge signal and the first drive signal, the fault control module 123 can determine that the electronic parking brake system is in an operating state; if the fault control module 123 receives the first processing signal at this time, the fault control module 123 can determine that the vehicle is in a driving state and the driver has no intention of starting the electronic parking brake system. At this time, the electronic parking brake system is an unexpected driving brake, and a functional failure has occurred. Therefore, the fault control module 123 outputs the first control signal to control the vehicle to enter the first safety state, turn off the electronic parking brake system, and stop the electronic parking brake system from working, so as to achieve the first functional safety goal and avoid unexpected driving brakes.

[0108] In this way, when receiving the first processing signal, if the first H-bridge signal or the first drive signal is received at the same time, it can be determined that the electronic parking brake system 1000 has a functional failure of unexpected driving brake, and then the first control signal is output to control the electronic parking brake system 1000 to stop working, so that the vehicle enters the first safety state, thereby achieving the first functional safety goal.

[0109] In some embodiments, step 0212 (the controller 100 outputs a second control signal according to the second processing signal and the monitoring signal) includes:

[0110] 02121: When the controller 100 receives the second processing signal, if the controller 100 simultaneously receives the first drive signal or the first H-bridge signal, the controller 100 outputs a second control signal to control the vehicle to enter the second safety state, enabling the vehicle to achieve the second functional safety objective.

[0111] Specifically, step 02121 can be implemented by the fault control module 123. That is, when the fault control module 123 receives the second processing signal, if the fault control module 123 receives the first drive signal or the first H-bridge signal, the fault control module 123 is configured to output a second control signal to control the vehicle to enter the second safety state, enabling the vehicle to achieve the second functional safety objective.

[0112] Thus, when the controller simultaneously receives the second processing signal and the first drive signal or simultaneously receives the second processing signal and the first H-bridge signal, it outputs a second control signal to control the vehicle to enter the second safety state. In some embodiments, the braking system further includes a drive circuit 301 and an H-bridge 303. The input signals include a switch signal and a wheel speed signal. The second processing signal is used to indicate that the switch signal is invalid and the wheel speed signal is less than a set wheel speed threshold. The first drive signal is used to indicate that there is an output current in the drive circuit 301. The first H-bridge signal is used to indicate that there is an output current in the H-bridge 303.

[0113] Specifically, when the fault control module 123 receives the first H-bridge signal, receives the first drive signal, or receives the first H-bridge signal and the first drive signal, if the fault control module 123 receives the second processing signal at this time, the fault control module 123 can determine that the vehicle is in the parked state and the driver has no intention of activating the electronic parking brake system. Then, at this time, the electronic parking brake system has an unexpected parking release, and a functional failure occurs. Therefore, the fault control module 123 outputs a second control signal to control the vehicle to enter the second safety state, and controls the motor 302 to be in the clamping state, thereby achieving the second functional safety objective and avoiding unexpected parking release.

[0114] Thus, when receiving the second processing signal, if the first H-bridge signal or the first drive signal is simultaneously received, it can be determined that the electronic parking brake system 1000 has a functional failure of unexpected parking release, and then a second control signal is output to control the motor 302 to be in the clamping state, enabling the vehicle to enter the second safety state, thereby achieving the second functional safety objective.

[0115] In some embodiments, step 0213 (the controller 100 outputs a second control signal according to the third processing signal and the monitoring signal) includes:

[0116] 02131: When the controller 100 receives the third processing signal, if the controller 100 simultaneously receives the second drive signal and the second H-bridge signal, the controller 100 outputs a second control signal to control the vehicle to enter the second safety state, enabling the vehicle to achieve the third functional safety objective.

[0117] Specifically, step 02131 can be implemented by the fault control module 123. That is, when the fault control module 123 receives the third processing signal, if the fault control module 123 receives the second drive signal and the second H-bridge signal, the fault control module 123 is configured to output a second control signal to control the vehicle to enter the second safety state, enabling the vehicle to achieve the third functional safety objective.

[0118] In this way, when the controller simultaneously receives the third processing signal and the second drive signal or simultaneously receives the third processing signal and the second H-bridge signal, it outputs a second control signal to control the vehicle to enter the second safety state.

[0119] In some embodiments, the braking system further includes a drive circuit 301 and an H-bridge 303. The input signals include a switch signal and a wheel speed signal. The third processing signal is used to indicate that the switch signal is valid and the wheel speed signal is less than a set wheel speed threshold. The second drive signal is used to indicate that there is no output current in the drive circuit 301. The second H-bridge signal is used to indicate that there is no output current in the H-bridge 303.

[0120] Specifically, when the fault control module 123 receives the second H-bridge signal and the second drive signal, if the fault control module 123 receives the third processing signal at this time, the fault control module 123 can determine that the vehicle is in the parked state and the driver has the intention to activate the electronic parking brake system. At this time, there is a functional failure of the parking brake function in the electronic parking brake system. Therefore, the fault control module 123 outputs a second control signal to control the vehicle to enter the second safety state, and controls the motor 302 to be in the clamping state, thereby achieving the third functional safety objective and avoiding the failure of the parking brake function and the vehicle being unable to park.

[0121] In this way, when receiving the third processing signal, if the second H-bridge signal and the second drive signal are simultaneously received, it can be determined that there is a functional failure of the parking brake function in the electronic parking brake system 1000, and then a second control signal is output to control the motor 302 to be in the clamping state, enabling the vehicle to enter the second safety state, thereby achieving the third functional safety objective.

[0122] Please refer to Figure 2, in some embodiments, the input signal includes a wheel speed signal, the functional layer 110 is further configured to determine an actual torque value, the monitoring signal includes a comparison signal, and step 02 (the controller 100 outputs a control signal according to the processed signal and the monitoring signal) includes:

[0123] 022: The controller 100 outputs a control signal according to the comparison signal and the wheel speed signal to control the vehicle to enter a safe state. The comparison signal is used to indicate that the torque difference is greater than a set torque threshold, and the torque difference is used to represent the difference between the actual torque value and the reference torque value.

[0124] Specifically, the monitoring and processing module 122 includes a processing and comparison module 1222. When the torque difference is greater than the set torque threshold, the processing and comparison module 1222 is configured to output a comparison signal. The torque difference is used to represent the difference between the actual torque value and the reference torque value. Step 022 can be implemented by the fault control module 123. That is to say, the fault control module 123 is used to output a control signal according to the comparison signal and the wheel speed signal to control the vehicle to enter a safe state.

[0125] Wherein, the input signal further includes an acceleration signal. According to the wheel speed signal, it can be determined whether the vehicle is in a parked state or a driving state. When the vehicle is in the driving state, the driving speed of the current vehicle can also be determined according to the wheel speed signal. When the driver triggers the parking switch 500, the functional layer 110 can calculate the actual torque value required for parking according to the wheel speed signal and the acceleration signal. The processing and comparison module 1222 can compare the difference between the actual torque value and the reference torque value with the set torque threshold. When the difference between the actual torque value and the reference torque value is greater than the set torque threshold, the processing and comparison module 1222 outputs a comparison signal. The fault control module 123 can determine that the torque of the current motor 302 does not meet the requirements according to the comparison signal, and determine the functional fault that occurs according to the wheel speed signal, and output a control signal to control the vehicle to enter a safe state, so as to achieve the corresponding functional safety goal.

[0126] In this way, the difference between the actual torque value and the reference torque value can be compared with the set torque value, and a comparison signal is output when the difference between the actual torque value and the reference torque value is greater than the set torque value. According to the comparison signal and the wheel speed signal, the type of functional fault of the vehicle can be determined, and a control signal is output to control the vehicle to enter a safe state.

[0127] In some embodiments, the comparison signal is further used to indicate that the torque difference is greater than the set torque threshold within a set number of times.

[0128] Specifically, when the torque difference is greater than the set torque threshold within a set number of times, the processing and comparison module 1222 is configured to output a comparison signal, and the fault control module 123 is configured to output a control signal based on the comparison signal and the wheel speed signal. When the processing and comparison module 1222 determines that the difference between the actual torque value and the reference torque value is greater than the set torque threshold, the processing and comparison module 1222 collects the input signal of the functional layer 110 and the calculated actual torque value again, and compares the second torque difference with the set torque threshold. The second torque difference is the difference between the actually collected torque value and the reference torque value determined according to the input signal. If the second torque difference is still greater than the set torque threshold, the processing and comparison module 1222 makes a third comparison. If within the set number of times, the processing and comparison module 1222 determines that the torque difference is greater than the set torque threshold, the processing and comparison module 1222 outputs a comparison signal to represent that the torque of the current motor 302 does not meet the requirements and a functional fault has occurred. Therefore, the fault control module 123 outputs a control signal based on the received comparison signal and the wheel speed signal.

[0129] In this way, by repeatedly comparing the torque difference with the set torque threshold, it is possible to accurately monitor functional faults of excessive or insufficient torque, avoid misjudgment, and improve the accuracy of monitoring.

[0130] Please refer to Figure 2 and Figure 4 , in some embodiments, the safety control method further includes:

[0131] 03: The controller 100 collects the drive current;

[0132] 04: The controller 100 determines the reference torque value according to the drive current, the input signal, and a preset reference algorithm. The preset reference algorithm is different from the preset actual algorithm of the controller 100, and the actual torque value is determined according to the preset actual algorithm.

[0133] Specifically, steps 03 and 04 can be implemented by the output monitoring module 1221 and the drive monitoring module 1223 of the functional monitoring layer 120. That is, the output monitoring module 1221 is configured to collect the drive current; the drive monitoring module 1223 is configured to determine the reference torque value according to the drive current collected by the output monitoring module 1221, the input signal, and the preset reference algorithm. The preset reference algorithm is different from the preset actual algorithm of the functional layer 110, and the actual torque value is determined according to the preset actual algorithm.

[0134] Among them, the input signal includes a switch signal and a wheel speed signal. The drive monitoring module 1223 calculates a reference torque value according to the switch signal, the wheel speed signal, the drive current collected by the output monitoring module 1221, and a preset reference algorithm. The preset reference algorithm is an algorithm redundant to the preset actual algorithm of the function layer 110. The reference torque value determined according to the preset reference algorithm can be used to determine the rationality of the actual torque value. When the difference between the reference torque value and the actual torque value is greater than the set torque threshold, the processing comparison module 1222 outputs a comparison signal to represent that the torque of the current motor 302 does not meet the requirements. When receiving the comparison signal, the fault control module 123 outputs a control signal according to the wheel speed signal to control the vehicle to enter a safe state.

[0135] In this way, a reference torque value can be obtained according to the switch signal, the wheel speed signal, the drive current, and the preset reference algorithm. According to the comparison result of the difference between the reference torque value and the actual torque value and the set torque threshold, it can be determined whether the torque of the current motor 302 is within an appropriate range. When the torque difference is greater than the set torque threshold, the torque of the current motor 302 does not meet the requirements, and the electronic parking brake system 1000 has a functional failure. Therefore, when receiving the comparison signal, a control signal is output according to the wheel speed signal to control the vehicle to enter a safe state and make the torque within an appropriate range.

[0136] In some embodiments, the braking system includes a drive circuit, and the drive current is the current of the drive circuit.

[0137] Specifically, the output monitoring module 1221 is configured to collect the drive current of the drive circuit 301; the drive monitoring module 1223 is configured to determine a reference torque value according to the drive current of the drive circuit 301 collected by the output monitoring module 1221, the input signal, and a preset reference algorithm. The preset reference algorithm is different from the preset actual algorithm of the function layer 110, and the actual torque value is determined according to the preset actual algorithm.

[0138] In this way, the working state of the drive circuit can be determined according to the drive current.

[0139] In some embodiments, step 022 (the controller 100 outputs a control signal according to the comparison signal and the wheel speed signal) includes:

[0140] 0221: When the wheel speed signal is greater than the set wheel speed threshold, if the comparison signal is received, the controller 100 outputs a first control signal to control the vehicle to enter a first safe state. When the vehicle is in the first safe state, the braking system stops working to achieve the fourth functional safety goal.

[0141] Specifically, step 0221 can be implemented by the fault control module 123. When the wheel speed signal is greater than the set wheel speed threshold, if the fault control module 123 receives a comparison signal, the fault control module 123 is configured to output a first control signal to control the vehicle to enter a first safety state. When the vehicle is in the first safety state, the electronic parking brake system 1000 stops working to achieve the fourth functional safety goal.

[0142] In this way, when the wheel speed signal is greater than the set wheel speed threshold, if the torque difference is greater than the set torque threshold, the controller 100 outputs a first control signal to control the vehicle to enter a first state, thereby achieving the fourth functional safety goal.

[0143] In some embodiments, the braking system further includes a motor 302, and the fourth functional safety goal is to prevent the torque of the motor 302 from being greater than a first preset threshold when the vehicle is in a driving state.

[0144] Specifically, when the wheel speed signal is greater than the set wheel speed threshold, it can be considered that the vehicle is in a driving state. If the fault control module 123 receives a comparison signal at this time, the torque of the motor 302 does not meet the requirements at this time. During driving, there is often a functional failure of the motor 302 with excessive torque, that is, the torque of the motor 302 may be greater than the first preset threshold. Excessive torque of the motor 302 during driving will cause the vehicle to be in an out-of-control state and may lead to serious consequences such as collisions. Therefore, the fault control module 123 outputs a first control signal to control the electronic parking brake system 1000 to stop working, so that the vehicle enters a first safety state, thereby achieving the fourth functional safety goal and preventing the torque of the motor 302 from being greater than the first preset threshold when the vehicle is in a driving state.

[0145] In this way, based on the wheel speed signal being greater than the set wheel speed threshold, it can be determined that the vehicle is in a driving state. If a comparison signal is received, it can be determined that the torque of the motor 302 is excessive when the vehicle is in a driving state. To prevent the torque of the motor 302 from being greater than the first preset threshold, a first control signal is output to control the electronic parking brake system 1000 to stop working, so as to achieve the fourth functional safety goal and avoid adverse consequences such as out-of-control collisions caused by excessive torque when the vehicle is in a driving state.

[0146] Please refer to Figure 2 and Figure 3 , in some embodiments, step 022 (outputting a control signal according to the comparison signal and the wheel speed signal) includes:

[0147] 0222: When the wheel speed signal is less than the set wheel speed threshold, if a comparison signal is received, output a second control signal to control the vehicle to enter a second safety state. When the vehicle is in the second safety state, the H-bridge controls the motor to be in a clamped state to achieve the fifth functional safety goal.

[0148] Specifically, step 0222 can be implemented by the fault control module 123. That is, when the wheel speed signal is less than the set wheel speed threshold, if the fault control module 123 receives a comparison signal, the fault control module 123 is configured to output a second control signal to control the vehicle to enter the second safety state. When the vehicle is in the second safety state, the H-bridge 303 controls the motor 302 to be in a clamped state to achieve the fifth functional safety goal.

[0149] In this way, when the wheel speed signal is less than the set wheel speed threshold, if the torque difference is greater than the set torque threshold, the controller 100 outputs a second control signal to control the vehicle to enter the second state, thereby achieving the fifth functional safety goal.

[0150] In some embodiments, the braking system further includes an H-bridge 303 and a motor 302. When the vehicle is in the second safety state, the H-bridge 303 controls the motor 302 to be in a clamped state. The fifth functional safety goal is to prevent the torque of the motor 302 from being less than the second preset threshold when the vehicle is in the parked state.

[0151] Specifically, when the wheel speed signal is less than the set wheel speed threshold, the vehicle can be regarded as being in the parked state. If the fault control module 123 receives a comparison signal at this time, the torque of the motor 302 does not meet the requirements at this time. In the parked state, there is often a functional failure of the motor 302 with too small torque, that is, the torque of the motor 302 may be less than the second preset threshold. Too small torque of the motor 302 during parking will cause the vehicle to slip and other states, which may lead to consequences such as collisions. However, since the driver has not left the vehicle at this time, it can be dealt with in time. Therefore, the hazard level of too small torque of the motor 302 when the vehicle is in the parked state is B. When the wheel speed signal is less than the set wheel speed threshold and the comparison module is received, the fault control module 123 outputs a second control signal to make the H-bridge 303 control the motor 302 to clamp and maintain the clamped state, so that the vehicle enters the second safety state, thereby achieving the fifth functional safety goal and preventing the torque of the motor 302 from being less than the second preset threshold when the vehicle is in the parked state.

[0152] In this way, according to the wheel speed signal being less than the set wheel speed threshold, it can be determined that the vehicle is in the parked state. If a comparison signal is received, it can be determined that the torque of the motor 302 is too small when the vehicle is in the driving state. To prevent the torque of the motor 302 from being less than the first preset threshold, a second control signal is output to control the motor 302 to clamp and maintain the clamped state, so as to achieve the fifth functional safety goal and avoid adverse consequences such as parking failure and out-of-control collision caused by too small torque when the vehicle is in the parked state.

[0153] Please refer to Figure 3 、 Figure 5 andFigure 6 , in some embodiments, the braking system includes a first domain 1001 and a second domain 1002, the first domain 1001 and the second domain 1002 are independent of each other, and the first domain 1001 and the second domain 1002 transmit their respective status information to each other; the safety control method further includes:

[0154] 05: The controller 100 receives the status information transmitted between the first domain 1001 and the second domain 1002, and the execution status includes the execution time length;

[0155] 06: When the difference between the execution time length of the first domain 1001 and the execution time length of the second domain 1002 is greater than the set time threshold, the controller 100 outputs a first control signal to control the vehicle to enter the first safety state. When the vehicle is in the first safety state, the braking system stops working.

[0156] Specifically, steps 08 and 09 can be implemented by the fault control module 123. That is to say, the fault control module 123 is configured to receive the status information transmitted between the first domain 1001 and the second domain 1002, and the execution status includes the execution time length. When the difference between the execution time length of the first domain 1001 and the execution time length of the second domain 1002 is greater than the set time threshold, the fault control module 123 is configured to output a first control signal to control the vehicle to enter the first safety state. When the vehicle is in the first safety state, the electronic parking braking system 1000 stops working. Among them, the set time threshold can be 100 ms, the first domain 1001 can be the left domain of the vehicle, and the second domain 1002 can be the right domain of the vehicle.

[0157] In this way, by monitoring the status information transmitted between the first domain and the second domain, the execution time lengths of the first domain and the second domain can be determined, and when the difference between the execution time lengths of the first domain and the second domain is greater than the set time threshold, a first control signal is output to control the vehicle to enter the first safety state.

[0158] In some embodiments, the first domain and the second domain each include a motor, and the status information is used to determine the execution status of the motors in the first domain and the second domain.

[0159] Specifically, the first domain 1001 includes the motor 302 and the drive circuit 301, and may also include the H-bridge 303. The drive circuit 301 is used to drive the H-bridge 303 to work, so as to control the operation of the motor 302, thereby realizing the braking or release of the left wheel; the second domain 1002 includes the motor 302 and the drive circuit 301, and may also include the H-bridge 303. The drive circuit 301 is used to drive the H-bridge 303 to work, so as to control the operation of the motor 302, thereby realizing the braking or release of the right wheel. The switch signals of the parking switch 500 are respectively transmitted to the left domain and the right domain through hard wires. The left domain and the right domain transmit their respective status information to each other. For example, the left domain transmits the parking switch status of the left domain, the caliper status of the left domain, and the available status of the left domain of the electronic parking brake system to the right domain; the right domain transmits the parking switch status of the right domain, the caliper status of the right domain, and the available status of the right domain of the electronic parking brake system to the left domain. At the same time, the above status information is all transmitted to the fault monitoring module. The fault monitoring module determines the execution status of the left domain and the right domain according to the respective status information of the left domain and the right domain. The execution status includes the execution time length, and the execution time length is the time length for the actuator in the left domain or the right domain to execute the parking brake function or the driving brake function. If the difference between the execution time length of the left domain and the execution time length of the right domain is greater than 100 ms, the fault control module 123 determines that the electronic parking brake system has an unexpected driving brake, and outputs a first control signal to control the vehicle to enter the first safety state, so that the electronic parking brake system stops working. In addition, if the fault monitoring module determines that the execution status of the left domain and the right domain is inconsistent, such as the left domain is in the parking brake state and the right domain is in the brake release state, it means that the electronic parking brake system has a functional fault of unexpected braking at this time. Therefore, the fault monitoring module outputs a first control signal to control the electronic parking brake system to stop working, that is, to control the left domain and the right domain to stop working at the same time, so that the vehicle enters the first safety state to achieve the first functional safety goal.

[0160] In this way, by receiving the status information of the first domain 1001 and the second domain 1002, it is determined whether the execution status of the first domain 1001 and the second domain 1002 is consistent. When the difference between the execution time length of the first domain 1001 and the execution time length of the second domain 1002 is greater than the set time threshold, it is configured to output a first control signal to control the vehicle to enter the state where the electronic parking brake system 1000 stops working, so that the vehicle enters the first safety state.

[0161] Please refer to Figure 7, in some embodiments, the control signal includes a first control signal, and the safety state includes a first safety state; the braking system further includes an H-bridge 303, and the braking system further includes a power supply module 400. The power supply module 400 includes a battery module 401 and a safety shutdown module 402. The battery module 401 supplies power to the H-bridge 303 through the safety shutdown module 402. When the safety shutdown module 402 receives the first control signal, the safety shutdown module 402 is configured to disconnect the power supply of the battery module 401 to the H-bridge 303 to stop the operation of the H-bridge 303, so that the braking system stops working, and the vehicle enters the first safety state.

[0162] Specifically, the battery module 401 includes a 12V battery, and the 12V battery can be the vehicle's storage battery, which is not limited here. The power supply module 400 further includes a power management module 403. The power management module 403 is configured to process the electrical energy provided by the 12V battery, reduce the voltage to 3.3V and then supply it to the drive circuit 301 and the MCU. The 12V battery is used to turn off the power management module 403 and the drive circuit 301, and the 12V battery is also used to supply power to the H-bridge 303 through the safety shutdown module 402. The safety shutdown module 402 can be powered by an additional 3.3V power supply or by the 3.3V voltage converted by the power management module 403, which is not limited here. Both the left domain and the right domain each include at least one power management module 403 and a safety shutdown module 402. The power management module 403 and the safety shutdown module 402 in the left domain and the right domain respectively control or supply power to the drive circuit 301, the MCU and the H-bridge 303 within their respective domains. When the H-bridge 303 stops working, the electronic parking brake system stops working; and since the first safety state is that the electronic parking brake system stops working, the fault control module 123 can control the safety shutdown module 402 to stop the power supply of the 12V battery to the H-bridge 303, so that the H-bridge 303 stops working, thereby controlling the electronic parking brake system to stop working and the vehicle enters the first safety state. Therefore, when the vehicle has an unexpected braking or a functional failure where the torque of the motor 302 is too large during driving, the fault control module 123 can output the first control signal to control the safety shutdown module 402 to disconnect, so as to stop the power supply of the 12V battery to the H-bridge 303, thereby controlling the electronic parking brake system to stop working and the vehicle enters the first safety state.

[0163] In this way, by disconnecting the power supply of the battery module 401 to the H-bridge 303 when the safety shutdown module 402 receives the first control signal, the operation of the H-bridge 303 can be controlled to stop, thereby controlling the electronic parking brake system 1000 to stop working and the vehicle enters the first safety state.

[0164] In some embodiments, when the H-bridge 303 is not working, the safety shutdown module 402 disconnects the power supply of the battery module 401 to the H-bridge 303; when the H-bridge 303 is working, the battery module 401 supplies power to the H-bridge 303 through the safety shutdown module 402.

[0165] Specifically, in the related art, when the H-bridge 303 is not working, the power supply to the H-bridge 303 is not disconnected. If an incorrect command for unexpected braking occurs, the H-bridge 303 will respond to it and control the motor 302 to work, resulting in a functional failure of the unexpected vehicle braking. In the embodiment of the present invention, the safety shutdown module 402 disconnects the power supply of the battery module 401 to the H-bridge 303 when the H-bridge 303 is not working, so that even if an incorrect command for unexpected vehicle braking is received, the H-bridge 303 will not respond to it because there is no power supply, thereby avoiding the functional failure of the unexpected vehicle braking. When the H-bridge 303 is working, the safety shutdown module 402 connects the power supply of the battery module 401 to the H-bridge 303 to enable the H-bridge 303 to work properly.

[0166] In this way, when the H-bridge 303 is not working, by disconnecting the power supply to the H-bridge 303 through the safety shutdown module 402, it can be ensured that even if an incorrect command for unexpected vehicle braking occurs, since the H-bridge 303 has no power supply, the H-bridge 303 still does not work, thereby avoiding unexpected vehicle braking.

[0167] Please refer to Figure 8 In some embodiments, the safety control method further includes:

[0168] 07: Monitoring the hardware environment of the controller;

[0169] 08: When it is determined that the hardware environment of the controller fails, controlling the vehicle to enter a safe state.

[0170] Specifically, steps 07 and 08 can be implemented by the hardware monitoring layer 130 of the controller 100. The hardware monitoring layer 130 is configured to monitor the hardware environment of the functional layer 110 and the functional monitoring layer 120 of the controller 100. When it is determined that the hardware environment of the functional layer 110 fails, the hardware monitoring layer 130 is configured to control the vehicle to enter a safe state.

[0171] Please refer to Figure 2, in addition, the electronic parking brake system 1000 includes a drive circuit 301, a motor 302, an H-bridge 303, a system basis chip (SBC) and an MCU. The controller 100 can be jointly composed of the MCU and the SBC, where Level 1 and Level 2 are set in the MCU. The function monitoring layer 120 further includes a program flow monitoring module 124, which is configured to monitor the logic and timing of the algorithms for implementing the parking brake function or the driving brake function in the function layer 110 in combination with the hardware monitoring layer 130. The hardware monitoring layer 130 is responsible for monitoring the hardware environment of the function layer 110 and the function monitoring layer 120. The hardware monitoring layer 130 includes a memory monitoring module 131, a response mechanism monitoring module 132, a clock monitoring module 133, a power supply monitoring module 134, an external watchdog 135, a monitoring comparison module 136, etc. Among them, the memory monitoring module 131, the response mechanism monitoring module 132, and the clock monitoring module 133 are set in the MCU, and the power supply monitoring module 134, the external watchdog 135, and the monitoring comparison module 136 are set in the SBC. The function monitoring layer 120 further includes a program flow monitoring module 124. The hardware monitoring layer 130 can be used to complete tasks such as memory checking, ALU (Arithmetic and Logic Unit) checking, and program flow checking. Among them, the memory monitoring module 131 is configured to check whether there are problems such as memory data inversion, incorrect writing, and incorrect data; the response mechanism monitoring module 132 checks whether the programs in the software such as the MCU in the right domain correctly answer the questions of each monitoring module within the set time window. If the questions of the monitoring unit cannot be correctly answered after exceeding a certain time or number of times, it will control the left domain and the right domain to reset; when controlling the left domain and the right domain to reset, the external watchdog 135 controls the safety shutdown module 402 to cut off the power supply to the H-bridge 303, so that the electronic parking brake system enters a safe state; the program flow monitoring module 124 is configured to check whether the algorithms of the memory detection module, the response mechanism detection module, and the clock monitoring module 133 are normal. The algorithms include monitoring algorithms, diagnostic algorithms, and service algorithms; the external watchdog 135 monitors whether the hardware environment of Level 1 and Level 2 is normal. When the hardware environment is abnormal, the external watchdog 135 controls the safety shutdown module 402 to cut off the power supply to the H-bridge 303. The power supply module 400 can provide a stable voltage for the electronic parking brake system 1000. The power supply monitoring module 134 is used to check the under-voltage and over-voltage of the power supply module 400, check the drift and oscillation of the power supply affecting the functional safety target, and check the voltage spike of the power supply affecting the functional safety target.Among them, the power supply monitoring module 134 can monitor the power supply situation of the 12V battery to the drive circuit 301, the H-bridge 303, and the power management module 403. The power supply module can also monitor the power supply situation of the 3.3V voltage of the power management module 403 to the drive circuit 301 and the MCU, and detect and report the position where undervoltage or overvoltage occurs. After receiving the report, the external watchdog 135 controls the safety shutdown module 402 to cut off the power supply to the H-bridge 303, so that the H-bridge 303 stops working, thereby making the vehicle enter a safe state.

[0172] In this way, through the hardware monitoring layer 130, the hardware environment of the function layer 110 and the function monitoring layer 120 can be monitored, and when an abnormality occurs, the vehicle can be controlled to enter a safe state to achieve the functional safety goal and avoid abnormalities such as system failure caused by functional failures of the vehicle.

[0173] An embodiment of the present invention provides an electronic device, which includes one or more processors and a memory. The memory stores a computer program. When the computer program is executed by the processor, the steps of the safety control method in any of the above embodiments are implemented.

[0174] In this way, by outputting a control signal according to the processed signal obtained by processing the input signal and the monitoring signal obtained by monitoring the operation of the function layer 110 to control the vehicle to enter a safe state, the vehicle can achieve the corresponding functional safety goal, thereby reducing the possibility of system failure and improving the safety and reliability of the electronic parking brake system 1000.

[0175] An embodiment of the present invention provides an electronic parking brake system, which includes the controller in any of the above embodiments or the electronic device in the above embodiment.

[0176] In this way, by outputting a control signal according to the processed signal obtained by processing the input signal and the monitoring signal obtained by monitoring the operation of the function layer 110 to control the vehicle to enter a safe state, the vehicle can achieve the corresponding functional safety goal, thereby reducing the possibility of system failure and improving the safety and reliability of the electronic parking brake system 1000.

[0177] An embodiment of the present invention provides a vehicle, which includes the controller in any of the above embodiments or the electronic device in the above embodiment.

[0178] Specifically, please refer to Figure 2, the switch signal of the parking switch 500 is transmitted through a hard wire, the signal of the ADAS (Advanced Driver Assistance System) is transmitted through Gigabit Ethernet, the signal of the rear domain is transmitted through Ethernet, the signal of the multimedia host is transmitted through CANFD, and the signal between the drive circuit 301 and the MCU is transmitted through SPI (Serial Peripheral Interface).

[0179] In this way, by outputting a control signal according to the processed signal obtained by processing the input signal and the monitoring signal obtained by monitoring the operation of the monitoring function layer 110, the vehicle is controlled to enter a safe state, so that the vehicle can achieve the corresponding functional safety goal, thereby reducing the possibility of system failure and improving the safety and reliability of the electronic parking brake system 1000.

[0180] An embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, the steps of the safety control method according to any one of the above embodiments are implemented.

[0181] In this way, by outputting a control signal according to the processed signal obtained by processing the input signal and the monitoring signal obtained by monitoring the operation of the monitoring function layer 110, the vehicle is controlled to enter a safe state, so that the vehicle can achieve the corresponding functional safety goal, thereby reducing the possibility of system failure and improving the safety and reliability of the electronic parking brake system 1000.

[0182] In the description of this specification, the description with reference to terms such as "one embodiment", "some embodiments", "schematic embodiments", "examples", "specific examples" or "some examples" means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. In addition, without conflict, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0183] In addition, the term "connection" should be understood in a broad sense. For example, it can include a fixed connection, a detachable connection, or an integral connection; it can include a direct connection, an indirect connection through an intermediate medium, and can also include the communication inside two elements. For those of ordinary skill in the art, the specific meaning of the above terms in the present invention can be understood according to specific circumstances.

[0184] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the quantity of the indicated technical features. Thus, features defined with "first" and "second" may explicitly or implicitly include at least one of such features. In the description of the present invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise specifically defined.

[0185] Any process or method description shown in a flowchart or described otherwise herein may be understood to represent a module, segment, or portion of code including one or more executable instructions for implementing a specific logical function or process. The scope of the preferred embodiments of the present invention includes additional implementations, where functions may be executed in a substantially simultaneous manner or in an order opposite to that shown or discussed, according to the functions involved, which should be understood by those skilled in the art to which the embodiments of the present invention pertain.

[0186] Although the embodiments of the present invention have been shown and described above, it can be understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those of ordinary skill in the art may make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present invention.

Claims

1. A safety control method for a vehicle, characterized in that, the safety control method includes: A controller obtains a processing signal and a monitoring signal, where the processing signal is obtained by processing an input signal, and the monitoring signal is obtained by monitoring the working state of the controller; The controller outputs a control signal according to the processing signal and the monitoring signal, so that the vehicle enters a safe state.

2. The safety control method according to claim 1, characterized in that, the control signal is used to control the braking system of the vehicle to perform a braking action, so that the vehicle enters the safe state.

3. The safety control method according to claim 2, characterized in that, the braking action includes at least one of a parking braking action and a driving braking action.

4. The safety control method according to claim 2, characterized in that, the monitoring signal includes a driving signal, and the controller outputs a control signal according to the processing signal and the monitoring signal, including: The controller outputs the control signal according to the processing signal and the driving signal.

5. The safety control method according to claim 4, characterized in that, the braking system includes a driving circuit, and the driving signal is determined according to the output current of the driving circuit.

6. The safety control method according to claim 4, characterized in that, the controller outputs the control signal according to the processing signal and the driving signal, including: The controller outputs a first control signal according to a first processing signal and the monitoring signal, and the first control signal is used to control the vehicle to enter a first safe state to achieve a first functional safety goal, and the first functional safety goal is to avoid unexpected driving braking.

7. The safety control method according to claim 6, characterized in that, the controller outputs a first control signal according to a first processing signal and the monitoring signal, including: When the controller receives the first processing signal, if it simultaneously receives a first driving signal or a first H-bridge signal, it outputs the first control signal to control the vehicle to enter the first safe state, so that the vehicle can achieve the first functional safety goal.

8. The safety control method according to claim 7, characterized in that, the braking system further includes a driving circuit and an H-bridge, the input signals include a switch signal and a wheel speed signal, the first processing signal is used to indicate that the switch signal is invalid and the wheel speed signal is greater than a set wheel speed threshold, the first driving signal is used to indicate that the driving circuit has an output current, and the first H-bridge signal is used to indicate that the H-bridge has an output current.

9. The safety control method according to claim 4, characterized in that, the controller outputs the control signal according to the processing signal and the driving signal, including: The controller outputs a second control signal according to a second processing signal and the monitoring signal, and the second control signal is used to control the vehicle to enter a second safe state to achieve a second functional safety goal, and the second functional safety goal is to avoid unexpected parking release.

10. The safety control method according to claim 9, wherein, the controller outputs a second control signal according to the second processing signal and the monitoring signal, including: when the controller receives the second processing signal, if the controller simultaneously receives a first driving signal or a first H-bridge signal, the controller outputs the second control signal to control the vehicle to enter the second safety state, so that the vehicle can achieve the second functional safety goal.

11. The safety control method according to claim 10, wherein, the braking system further includes a driving circuit and an H-bridge, the input signals include a switch signal and a wheel speed signal, the second processing signal is used to indicate that the switch signal is invalid and the wheel speed signal is less than a set wheel speed threshold, the first driving signal is used to indicate that the driving circuit has an output current, and the first H-bridge signal is used to indicate that the H-bridge has an output current.

12. The safety control method according to claim 4, wherein, the controller outputs the control signal according to the processing signal and the driving signal, including: the controller outputs a second control signal according to a third processing signal and the monitoring signal, the second control signal is used to control the vehicle to enter a second safety state to achieve a third functional safety goal, and the third functional safety goal is to avoid the failure of the parking brake operation.

13. The safety control method according to claim 12, wherein, the controller outputs a second control signal according to the third processing signal and the monitoring signal, including: when the controller receives the third processing signal, if the controller simultaneously receives a second driving signal and a second H-bridge signal, the controller outputs the second control signal to control the vehicle to enter the second safety state, so that the vehicle can achieve the third functional safety goal.

14. The safety control method according to claim 13, wherein, the braking system further includes a driving circuit and an H-bridge, the input signals include a switch signal and a wheel speed signal, the third processing signal is used to indicate that the switch signal is valid and the wheel speed signal is less than a set wheel speed threshold, the second driving signal is used to indicate that the driving circuit has no output current, and the second H-bridge signal is used to indicate that the H-bridge has no output current.

15. The safety control method according to claim 2, wherein, the input signal includes a wheel speed signal, the controller is further configured to determine an actual torque value, the monitoring signal includes a comparison signal, and the controller outputs a control signal according to the processing signal and the monitoring signal, including: the controller outputs the control signal according to the comparison signal and the wheel speed signal to control the vehicle to enter the safety state, the comparison signal is used to indicate that the torque difference is greater than a set torque threshold, and the torque difference is used to indicate the difference between the actual torque value and the reference torque value.

16. The safety control method according to claim 15, wherein, The comparison signal is further used to indicate that the torque difference is greater than the set torque threshold within a set number of times.

17. The safety control method according to claim 15, wherein, the safety control method further includes: the controller collects the drive current; the controller determines the reference torque value according to the drive current, the input signal and a preset reference algorithm, the preset reference algorithm is different from the preset actual algorithm of the controller, and the actual torque value is determined according to the preset actual algorithm.

18. The safety control method according to claim 16, wherein, the braking system includes a drive circuit, and the drive current is the current of the drive circuit.

19. The safety control method according to claim 17, wherein, the controller outputs the control signal according to the comparison signal and the wheel speed signal, including: when the wheel speed signal is greater than the set wheel speed threshold, if the controller receives the comparison signal, the controller outputs a first control signal to control the vehicle to enter a first safety state. When the vehicle is in the first safety state, the braking system stops working to achieve the fourth functional safety goal.

20. The safety control method according to claim 19, wherein, the braking system further includes a motor, and the fourth functional safety goal is to avoid the torque of the motor being greater than a first preset threshold when the vehicle is in a driving state.

21. The safety control method according to claim 17, wherein, the controller outputs the control signal according to the comparison signal and the wheel speed signal, including: when the wheel speed signal is less than the set wheel speed threshold, if the controller receives the comparison signal, the controller outputs a second control signal to control the vehicle to enter a second safety state to achieve the fifth functional safety goal.

22. The safety control method according to claim 21, wherein, the braking system further includes an H-bridge and a motor. When the vehicle is in the second safety state, the H-bridge controls the motor to be in a clamping state, and the fifth functional safety goal is to avoid the torque of the motor being less than a second preset threshold when the vehicle is in a parking state.

23. The safety control method according to claim 2, wherein, the safety control method further includes: the controller receives the status information transmitted between the first domain and the second domain, and the execution status includes the execution time length; when the difference between the execution time length of the first domain and the execution time length of the second domain is greater than the set time threshold, the controller outputs a first control signal to control the vehicle to enter a first safety state. When the vehicle is in the first safety state, the braking system stops working.

24. The safety control method according to claim 23, wherein, the first domain and the second domain each include a motor, and the status information is used to determine the execution status of the motors in the first domain and the second domain.

25. The safety control method according to claim 2, wherein, The control signal includes a first control signal, and the safety state includes a first safety state; the braking system further includes an H-bridge, and the braking system further includes a power supply module. The power supply module includes a battery module and a safety shutdown module. The battery module supplies power to the H-bridge through the safety shutdown module. When the safety shutdown module receives the first control signal, the safety shutdown module is configured to disconnect the power supply of the battery module to the H-bridge to stop the operation of the H-bridge, so that the vehicle enters the first safety state.

26. The safety control method according to claim 25, wherein, when the H-bridge is not operating, the safety shutdown module disconnects the power supply of the battery module to the H-bridge; when the H-bridge is operating, the battery module supplies power to the H-bridge through the safety shutdown module.

27. The safety control method according to claim 1, wherein, the safety control method further includes: monitoring the hardware environment of the controller; when it is determined that the hardware environment of the controller fails, controlling the vehicle to enter a safety state.

28. A controller for a vehicle, wherein, the controller is configured to obtain a processing signal and a monitoring signal. The processing signal is obtained by processing an input signal, and the monitoring signal is obtained by monitoring the working state of the controller; the controller is further configured to output a control signal according to the processing signal and the monitoring signal to make the vehicle enter a safety state.

29. An electronic device, wherein, the electronic device includes one or more processors and a memory. The memory stores a computer program. When the computer program is executed by the processor, the steps of the safety control method according to any one of claims 1-27 are implemented.

30. A braking system, wherein, the braking system includes the controller according to claim 28 or the electronic device according to claim 29.

31. A vehicle, wherein, the vehicle includes the controller according to claim 28 or the electronic device according to claim 29.

32. A computer-readable storage medium, on which a computer program is stored, wherein, when the program is executed by a processor, the steps of the safety control method according to any one of claims 1-27 are implemented.

Images