Empirical multimedia broadcasting (EMB) control system and method with redundancy security

Abstract

The invention discloses a redundancy safe EMB control system and method. The control system comprises a central control unit (CCU) and a wheel edge control unit (DCS). Wherein the central control unit CCU is used for receiving a request signal of an upper computer, the central control unit CCU processes the request signal to output a corresponding clamping force instruction to the wheel edge control unit DCS, and the wheel edge control unit DCS is used for controlling a driving motor to output braking force; the central control unit CCU comprises a main control system and an auxiliary control system, the main control system and the auxiliary control system are backups for each other, and after one of the main control system and the auxiliary control system breaks down or fails, the other system takes over starting work. The EMB control system and method with redundancy security are designed through a redundancy design scheme, so that the reliability of the EMB system is improved, and the redundancy security is improved.

Description

Technical Field

[0001] The present invention relates to the field of automotive braking systems, and particularly to a redundant and safe EMB control system and method. Background Art

[0002] Current braking systems are all EHB hydraulic electro-hydraulic braking systems, and there is no mass-produced EMB fully dry electro-hydraulic braking system. The EMB system eliminates brake fluid and hydraulic components, and the braking torque is completely generated by actuator driven by motors installed on the four wheel ends. Therefore, corresponding solenoid valves, master cylinders, hydraulic pipelines, etc. are cancelled, which can greatly simplify the structure of the braking system and have more efficient and accurate braking performance. Four motors are used to drive the actuators for braking control, so the control strategy related to the EMB system is crucial. The existing technology for the design of the EMB system generally can be divided into two parts. One part considers the protection control of the motor drive, and the other part is the control of the EMB system itself.

[0003] The traditional EMB system is too single in system composition design and does not consider redundant safety control, resulting in the inability to effectively control the vehicle after some control units of the EMB system fail and no corresponding control strategy is designed, which cannot guarantee the reliability of the EMB system. Summary of the Invention

[0004] The purpose of the present invention is to overcome the deficiencies of the prior art, and provide a redundant and safe EMB control system and vehicle, and design a redundant and safe EMB control system and method through a redundant design scheme to improve the reliability of the EMB system and enhance redundant safety.

[0005] To achieve the above purpose, the technical solution adopted by the present invention is: a redundant and safe EMB control system, the control system includes a central control unit CCU and a wheel-side control unit DCS; wherein: the central control unit CCU is used to receive a request signal from the host computer, and the central control unit CCU processes the request signal to output a corresponding clamping force command to the wheel-side control unit DCS, and the wheel-side control unit DCS is used to control the drive motor to output a braking force;

[0006] The central control unit CCU includes a main control system and an auxiliary control system, and the main control system and the auxiliary control system are backup to each other. After one of them fails or malfunctions, the other system takes over and starts working.

[0007] The host computer request signal includes one or multiple of human driving, vehicle driving, external request, and equipment request signals.

[0008] The control system includes a dual-redundant power supply, which includes vehicle power supply 1 and vehicle power supply 2. The dual-redundant power supply is respectively connected to the central control unit CCU and the wheel-end control unit DCS to provide power redundancy for the EMB system.

[0009] The power supply terminals of the human-driven electronic brake pedal are respectively connected to the power-taking terminals of the central control unit CCU and are connected to the dual-redundant power supply through hard wires.

[0010] The CCU control function is backed up in the wheel-end control unit DCS. The host computer request signal is respectively connected to the central control unit CCU and the wheel-end control unit. Among them, the wheel-end control unit executes the backup CCU control function to achieve brake control after the central control unit CCU fails or malfunctions; and / or the CCU control function is backed up in the pedal control unit PCU. The host computer request signal is respectively connected to the central control unit CCU and the pedal control unit PCU. The pedal control unit PCU is communicatively connected to the wheel-end control unit DCS to output corresponding brake signals to DCS. The pedal control unit PCU executes the backup CCU control function to achieve brake control after the central control unit CCU fails or malfunctions.

[0011] The wheel-end control unit DCS includes four brake units ECU, namely: left front brake unit, right front brake unit, left rear brake unit, and right rear brake unit, which are used to control the brakes of one wheel respectively; the CCU control function is backed up in one or more of the four brake units ECU.

[0012] The human-driven request signal, vehicle-driven request signal, and external request signal in the external request signal are all connected to the CCU and DCS through at least two of CAN, CANFD, Ethernet, and hard wires; the CCU and DCS are connected through one private CAN and one public CAN.

[0013] The four brake units ECU in the DCS are all connected to the four-wheel speed sensors through hard wires, and the four-wheel speed sensors are dual-chip redundant sensor assemblies.

[0014] At least one of the four brake units ECU in the DCS serves as the master control, and the remaining brake units ECU are controlled by the master control. The brake units ECU are connected to each other; among them, the backup CCU function is set in the master control. When there are multiple master controls, one of the master controls is selected to execute the backup CCU function in the order of priority.

[0015] A control method for a redundant and secure EMB control system, including when the central control unit CCU is in a normal state, it receives a request signal and processes and converts it into a clamping force command and inputs it into the in-wheel motor control unit DCS. The in-wheel motor control unit DCS executes and controls braking; when it monitors that the central control unit CCU fails or malfunctions, the in-wheel motor control unit DCS takes over the control function of the EMB system. The DCS obtains the request signal and processes and calculates it according to its pre-backup CCS function to obtain a control command and executes the output control.

[0016] The advantages of the present invention are as follows: By redesigning the EMB system and its control strategy, the safety redundancy degree of the system is greatly improved. Making full use of the relationship between the EMB system architectures, through the strategy, power redundancy, hard wire redundancy, signal redundancy, wheel speed redundancy, function arbitration, execution control, state jump conditions, single-point and multi-point failure aspects of the strategy are defined, so that the EMB system has a higher safety redundancy degree and a reasonable and effective control strategy. In the EMB system, according to the redundancy idea, arbitration logic, and state jump conditions, various aspects are defined, and then a set of control strategies with high safety redundancy degree and reasonable and effective execution are obtained. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The following briefly describes the content expressed in each drawing of the specification of the present invention and the marks in the drawings:

[0018] Figure 1 It is the system architecture diagram of the EBM control system according to the first embodiment of the present invention;

[0019] Figure 2 It is the system architecture diagram of the EBM control system according to the second embodiment of the present invention;

[0020] Figure 3 It is the schematic diagram of the control strategy for the human driving, vehicle driving, and external request working conditions in the first embodiment of the present invention;

[0021] Figure 4 It is the schematic diagram of the control strategy for the human driving, vehicle driving, and external request working conditions in the second embodiment of the present invention;

[0022] Figure 5 It is the schematic diagram of the working process of the equipment request working condition system of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0023] The following further describes the specific embodiments of the present invention in detail by describing the optimal embodiments with reference to the drawings.

[0024] In this embodiment, the hardware redundancy and functional redundancy of the EMB system are mainly designed in a redundant manner to improve the reliability of the system, avoid the defect that the braking function of the system fails due to the failure of the EMB, and affect the driving safety of the vehicle. With redundant design, since both the hardware and software functions have redundant design, even if one of them fails, the redundant function can be used to enable the EMB system to continue to work normally, improving the reliability of the EMB system, and thus improving the reliability of vehicle braking and avoiding the safety hazards brought by braking failure. The specific solution is introduced as follows:

[0025] As Figure 1 shown, in one kind of this embodiment, the EMB system mainly consists of a central control unit (CCU), a wheel-side control unit (DCS), an electronic brake pedal, and four EMBs. The CCU has a main and auxiliary dual-system, receives human driving / vehicle driving / external request / device request, inputs the clamping force command into the DCS, and then drives the motor to perform full-function control of the braking system. The DCS can transmit the wheel speed signal to the CCU and can undertake backup ABS control when the CCU fails. The control architecture of the EMB system is as Figure 1 shown, and is introduced one by one as follows:

[0026] As Figure 1 shown, a redundant and safe EMB control system, the control system includes a central control unit CCU and a wheel-side control unit DCS;

[0027] Among them: The central control unit CCU is used to receive the request signal from the upper computer. The central control unit CCU processes the request signal to output the corresponding clamping force command to the wheel-side control unit DCS. The wheel-side control unit DCS is used to control the drive motor to output the braking force. Under normal circumstances, the CCU processes the received signal and inputs the clamping force command into the DCS, and the DCS controls the motor to achieve braking control. In order to improve the system safety, the function of the CCU is backed up to the DCS, that is, the function of the CCU for data processing is backed up to the DCS in a software backup manner. When the CCU is working normally, the DCS is in a passive controlled state. When the CCU fails or malfunctions, the DCS executes the backup CCU function, calculates the corresponding clamping force information through the backup CCU function, and then executes the clamping force to achieve braking control.

[0028] To improve the reliability of the system, the central control unit CCU includes a main control system and a secondary control system. The main control system and the secondary control system are backup to each other. After one of them fails or malfunctions, the other system takes over and starts working. The CCU is divided into a main control system and a secondary control system. The main control system is the default working system, which executes data according to the received host computer request signal and sends it to the DCS. The secondary control system is in a non-working state, which only monitors the failure or malfunction state of the main control system. When the secondary control system monitors the failure or malfunction of the main control system, it will start working. At this time, the secondary control system is switched to the default working state, and the main control system is in a non-working state due to failure or malfunction. At this time, the secondary control system calculates and outputs the corresponding clamping force command to the DCS according to the host computer request signal.

[0029] Since the main control system and the secondary control system are set in the CCU, the failure or malfunction of the CCU means that both the main control system and the secondary control system fail simultaneously. Since the probability of simultaneous failure of the main control and secondary control systems is small, this method can greatly reduce the instability defect of the EMB system.

[0030] The host computer request signal includes one or more of the signals of manual driving, vehicle driving, external request, and equipment request. Manual driving refers to the signal sent by the driver during driving, including but not limited to the electronic brake pedal signal, single pedal signal, EPB button signal, etc.; Vehicle driving refers to the request signal sent by the vehicle intelligent driving system or the assisted driving system, including but not limited to the DAS signal, etc.; External request refers to the request signal outside the EMB system, generally referring to the in-vehicle data during vehicle driving, including the transmission control unit TCU, ACU airbag controller, etc.; For example, when implementing secondary protection based on the ACU airbag controller, it is necessary to execute the corresponding braking control function based on the request signal of the airbag controller. Equipment request refers to the request signal of equipment such as a diagnostic instrument, which is used for braking control during diagnostic control.

[0031] Based on the host computer request signal, it can be divided into manual driving, vehicle driving, external request working conditions, and equipment request working conditions, so as to implement different control strategies under different working conditions.

[0032] The EMB control system in this solution adopts power redundancy setting, and sets dual redundant power supplies to supply power to each part of the EMB system redundantly, so as to meet the requirements of reliable power supply for the EMB. Such as Figure 1 As shown, the dual redundant power supplies include vehicle power supply 1 and vehicle power supply 2. The dual redundant power supplies are respectively connected to the central control unit CCU and the in-wheel control unit DCS to provide power redundancy for the EMB system. In order to improve the stability and reliability of power supply, vehicle power supply 1 and vehicle power supply 2 in the dual redundant power supplies are both connected to the CCU and the DCS through hard wires, thus realizing stable and reliable power supply.

[0033] The power supply terminals of the human-driven electronic brake pedal are respectively connected to the power take-off terminals of the central control unit CCU and hard-wired to the dual-redundant power supply. The human-driven electronic brake pedal is used to provide a braking request signal during manual driving. Therefore, the human-driven electronic brake pedal also requires power supply stability and has a power redundancy function. The electronic brake pedal draws power from the main and auxiliary systems of the CCU and is directly hard-wired to the vehicle power supply, achieving the goal of power redundancy for each control module.

[0034] To achieve further redundancy, the human-driven electronic brake pedal can be connected to the main control system and the auxiliary control system of the CCU through hard wire and CAN line (at least one of them), and at the same time has the function of being connected to the DCS through hard wire and CAN line (at least one of them), achieving hard wire redundancy and also realizing the connection with the DCS, providing basic data for the DCS to execute the CCU backup function.

[0035] The CCU control function is backed up in the wheel-end control unit DCS. The host computer request signal is respectively connected to the central control unit CCU and the wheel-end control unit. Among them, the wheel-end control unit executes the backup CCU control function after the central control unit CCU fails or malfunctions to achieve braking control. The host computer request signal is respectively sent into the CCU and the DCS, so that after the CCU fails or malfunctions, the DCS can execute the corresponding host computer request signal and execute the corresponding braking control function.

[0036] As Figure 2 shown, it is a schematic diagram of the EMB system architecture in the second embodiment. Among them, the CCU function backup is set in the pedal control unit. The human-driven request signal is sent into the pedal control unit PCU through CAN, hard wire and other means. When the CCU function fails, the PCU realizes the CCU function backup. After the CCU function backup is executed, the corresponding control signal is output to the DCS and executed by the DCS.

[0037] As Figure 1 shown, the human-driven request signal is respectively connected to the CCU through CAN and hard wire to redundantly send the human-driven request signal into the CCU; the human-driven request signal is respectively connected to the DCS through the common CAN and hard wire of the human-driven signal to realize that the human-driven signal is sent into the CCU and the DCS through dual-redundant signals. The vehicle driving and external requests are respectively connected to the CCU and the DCS through CAN signals, so that both the CCU and the DCS can obtain the vehicle driving, external requests, and device request signals.

[0038] The in-wheel control unit DCS includes four brake unit ECUs, namely: the left front brake unit ECU1, the right front brake unit ECU2, the left rear brake unit ECU3, and the right rear brake unit ECU4, which are used to control the braking of one wheel respectively; one or more of the four brake unit ECUs back up the CCU control function. The four control unit ECUs work independently and are connected to each other by hardwire or network connection, that is, one of the ECUs can receive the control signals of other ECUs to achieve the purpose of interactive control.

[0039] The human driving request signal, vehicle driving request signal, and external request signal in the external request signal are all connected to the CCU and DCS through at least one of CAN, CANFD, Ethernet, and hardwire; the CCU and DCS are connected by a private CAN and a public CAN. This enables both the DCS and CCU to obtain the request signal, facilitating the DCS to receive the request signal and execute the corresponding braking control function even after the CCU fails or malfunctions. Since the CCU and DCS communicate and interact control instructions under normal circumstances, it is necessary to ensure the reliability of the connection between the CCU and DCS. Therefore, a private CAN and a public CAN are set up for connection to achieve the reliability of their interaction.

[0040] As Figure 1 shown, the four brake unit ECUs in the DCS are all connected to the four-wheel speed sensors through hardwire. The four-wheel speed sensors are dual-chip redundant sensor assemblies, thus enabling reliable acquisition of the rotational speeds of the four wheels and providing the basic wheel speed signals for the corresponding braking control.

[0041] Since the CCU is the main controller, when it is in the working state, it can directly process the obtained request signals and output control instructions. However, when it fails or malfunctions, the DCS needs to execute the CCU backup function. The backup CCU function is the control strategy in the CCU, and the corresponding clamping force is calculated based on the operation of the CCU function. Since the DCS includes four ECUs, when backing up the CCU function, at least one of the four brake unit ECUs in the DCS can be used as the main controller, and the remaining brake unit ECUs are controlled by the main controller. The brake unit ECUs are connected to each other; the backup CCU function is set in the main controller. When there are multiple main controllers, one of the main controllers is selected to execute the backup CCU function in the order of priority.

[0042] When a main control ECU is set, signals of manual driving, vehicle driving, external requests, and device requests are all input into the main control ECU. Then, the main control ECU executes the backup CCU function to achieve the control of braking. When multiple ECUs are selected as the main control, priorities can be set for multiple main controls. The main control ECU with a higher priority processes the received request signal data to obtain control information such as the corresponding clamping force, and transmits the control signal to other ECUs through the main control ECU for execution to achieve the braking control of the four wheels.

[0043] In the states of manual driving, vehicle driving, and external requests, the request signals of the working states of each EMB system can be connected to the CCU and DCS through CAN / CAN-FD / Ethernet and hardwiring. The CCU and DCS are connected through a private CAN and a public CAN. The working requests of the EMB system are preferentially executed by the CCU. The CCU processes the received request signals to obtain control signals such as the clamping force required for braking, and inputs the required clamping force to the DCS. The DCS controls the four wheel-end motors to achieve the functions.

[0044] The CCU preferentially uses the public CAN for communication with the system request signal and the DCS. When the network communication between the CCU and the system request and the DCS is abnormal, the hardwired signal or the private CAN signal is preferentially used to ensure the function, so as to ensure the communication connection between the CCU and the request signal such as the electronic brake pedal and the communication connection between the CCU and the DCS, to meet the requirement of signal interaction between the two.

[0045] The DCS monitors the communication connection status between the DCS and the CCU and the fault or failure status of the CCU itself. When the DCS detects problems in both the connection and communication between the DCS and the CCU, or when the CCU detects a fault or communication abnormality through self-check or its own software, and the CCU sends the corresponding status bit of communication error with the system request, the request signals of the working states of each EMB system are directly connected to the DCS through CAN / CAN-FD / Ethernet, and the DCS directly executes the request to achieve the function. If the network connection between the DCS and the system request is abnormal, the hardwired signal is used to ensure the function implementation. If the request signal cannot be obtained through the network and the hardwiring, an error fault is reported. The DCS and the CCU can detect whether the communication connection between the two is normal through a heartbeat mechanism or other mechanisms. If the communication between the DCS and the CCU is abnormal, the DCS is switched to be the main control, and the DCS controls the braking according to the request signal; the CCU detects whether the communication interaction between itself and the request signal device is abnormal through self-check or monitoring. When an abnormality occurs, the CCU sends the corresponding status bit of communication abnormality through the CAN network. After receiving this status bit, the DCS is switched to be the main control, and the DCS controls the braking according to the request signal.

[0046] In this embodiment, when the CCU can communicate with the system request signal and the DCS normally (when any one of CAN / CAN-FD / Ethernet, hard wire, or private CAN is effective), the CCU is responsible for processing the request signal, determining the control strategy of the execution caliper, and sending the control instruction to the DCS for execution; if the CCU loses communication with at least one of the system request signal or the DCS completely (CAN / CAN-FD / Ethernet, hard wire, or private CAN all occur), and the DCS can communicate with the system request normally (when any one of CAN / CAN-FD / Ethernet or hard wire is effective), then the DCS processes the request signal, determines the control strategy of the execution caliper, and performs arbitration to determine the control of the execution caliper.

[0047] When the CCU and the DCS receive the signal of the function request synchronously, they perform arbitration control on the signal and select the request signal with a higher priority for execution; it is divided into two methods:

[0048] ① The EMB provides internal arbitration for its working states:

[0049] 1) After receiving the human driving request signal, the braking signal in the human driving request signal takes precedence, and the braking signal is preferentially executed; when multiple braking request signals are received, the last one received is given priority within the same execution cycle (last win); because the EMB system has a corresponding signal output cycle for execution, when multiple braking signals are received before the output instruction, the last braking request signal received is used for execution, so as to match the real needs of the user as much as possible.

[0050] 2) For the vehicle driving and external request signals, arbitration is performed according to the functional safety level. The functional safety level is set for each type of request signal, and then the received request signals are sorted by priority, and the ones with a higher functional safety level are preferentially executed;

[0051] 3) For the device request signal, during the process of responding to the device request, the priorities of human driving, vehicle driving, external request, and device request are set; when there is a demand in human driving, vehicle driving, or external request, that is, when one of the request signals is received, the execution of the device request is exited, and the request in human driving, vehicle driving, or external request is executed. When multiple requests are sent simultaneously, arbitration is performed according to the cross-system working state. The arbitration strategy is that if the functions corresponding to multiple requests do not conflict, then all functions are executed; if the functions conflict, then they are executed according to the pre-set functional priorities of the request signals.

[0052] ② The EMB provides arbitration among its working states: The human driving has the highest priority. When the human driving request signal is received, it directly enters the human driving mode, and at the same time records the execution state of the vehicle before entering the human driving. When the human driving exits and needs to re-enter or resume the previous execution state.

[0053] For the redundancy of the DCS, at least any one of the four brake units (ECUs) can be placed. It is the master controller, sending signals to the other three brake units (ECUs) to execute their control requirements. When the redundant control is placed in two or more ECUs, the failure takeover is performed according to the defined priority order, and the ECU with a higher priority is selected to execute according to the priority level order. After the ECU with a higher priority fails, the ECU of the lower level is switched to take over the work.

[0054] Under normal conditions, the CCU master control system controls the vehicle braking of the EMB system. When the CCU master control system fails, it is handed over to the auxiliary control system for vehicle braking control. When both the CCU main and auxiliary systems fail, the master ECU in the DCS cooperates with the four calipers to perform the backup ABS control. Due to the limited computing power and resources of the ECU, when acting as the master to output the corresponding braking control for the request signal, most of the chip resources have been occupied basically. Therefore, in order to protect the reliability of the vehicle, only the abs control function is backed up in the master ECU, that is, when the master ECU performs braking control, it executes the backup ABS control function to ensure the safety and reliability of the vehicle during braking.

[0055] When single-point, double-point or three-point failures occur in the DCS, hierarchical degradation should be carried out to ensure the maximum utilization of the ground adhesion coefficient for deceleration braking. The four ECUs 1, 2, 3, and 4 in the DCS can determine whether their braking control of the wheels is normal according to what they detect. If one of the ECUs cannot perform braking control on the vehicle, it is a single-point failure of the braking control. Similarly, double-point or three-point failures may occur. At this time, according to different failures, the hierarchical degradation of the braking control is realized to ensure the maximum utilization of the ground adhesion coefficient for deceleration braking. The braking control strategy corresponding to the request signal is executed according to different failure modes to realize the braking control of the vehicle.

[0056] When the DCS controls the braking motor for braking, the four ECUs 1, 2, 3, and 4 respectively control the braking motor corresponding to one wheel. Each ECU corresponds to a detector to detect whether the braking force at the vehicle is normal. If the braking fails, that is, the current vehicle cannot apply effective braking force for braking, a failure fault is reported to the master ECU; the master ECU judges whether it is in a single-point, double-point or three-point failure fault according to the number of failure faults; when in a single-point, double-point or three-point failure fault, the master ECU controls the braking force applied to the left and right ECUs, and satisfies the vehicle braking control in the case of single-point, double-point or three-point failures in the way that the braking forces on the left and right sides are the same and the braking force is reduced.

[0057] Among them, the brake failure can be judged according to the wheel speed after the acquisition ECU applies the brake. When the ECU controls the vehicle brake motor it controls to apply braking force, the rotational speed of the wheel will generate different decelerations under different conditions according to the braking force. By detecting the vehicle speed and calculating the change in deceleration to judge whether the current ECU's control of the wheel brake fails, different standard deceleration values corresponding to different braking forces are preset for judgment. When the decelerations under the same braking force collected and calculated in real time are different or have a large difference, it is judged that the braking force fails. After judging the braking force failure, if the main control ECU identifies and obtains the ECU in the normal state currently, first reduce the braking force, and then control the braking forces on both sides to be the same. That is, in the failure state, if it is detected that at least one brake on both the left and right sides is normal, the braking force is reduced from the braking force when all four ECUs are normal to the braking force in the failure state, and then the braking force is distributed according to the number of normal ECUs on the left and right sides of the vehicle and transmitted to each ECU for execution. The purpose of doing this is to ensure that the braking forces on both sides are consistent, avoid the vehicle from wagging its tail and tilting due to braking, and at the same time reduce the braking force to adapt to the situation where there is a brake failure on one of the left and right sides and full braking force cannot be satisfied for braking. That is, when the request signal comes, the main control ECU calculates the standard braking force or receives the standard braking force calculated based on the request signal sent by the CCU. When all four ECUs are in the normal state, the main control ECU controls other ECUs to output brake control according to the standard braking force respectively; when in the single-point, double-point, or three-point failure state, since the number of brake ECUs decreases and the number of brake motors decreases, the braking force that can be provided decreases, and to ensure that the braking forces on both sides are consistent, the standard braking force needs to be reduced. The main control ECU reduces the standard braking force according to the set ratio to obtain the reduced braking force, and then issues the braking according to the number of ECUs on the left and right sides with this braking force. When a single-point, double-point, or three-point failure occurs in the DCS, it is necessary to degrade in layers (by adjusting the braking force of the remaining effective wheels to keep the braking forces on both sides in a balanced state and ensure maximum utilization of the ground adhesion coefficient for deceleration braking).

[0058] Obviously, the specific implementation of the present invention is not limited by the above methods. As long as various non-substantive improvements are made by adopting the method concept and technical solution of the present invention, they are all within the protection scope of the present invention.

Claims

1. A redundant and safe EMB control system, characterized by: The control system includes a central control unit CCU and a wheel control unit DCS; wherein: the central control unit CCU is used to receive a request signal from a host computer, the central control unit CCU processes the request signal to output a corresponding clamping force instruction to the wheel control unit DCS, and the wheel control unit DCS is used to control the drive motor to output a braking force; The central control unit CCU includes a main control system and an auxiliary control system, which back up each other. When one of them fails or fails, the other system takes over the startup work.

2. A redundant and safe EMB control system as claimed in claim 1, characterized in that: The host computer request signal includes one or more of human-driven, vehicle-driven, external request, and device request signals.

3. A redundant and safe EMB control system as claimed in claim 1, characterized in that: The control system includes a dual redundant power supply, which includes an on-board power supply 1 and an on-board power supply 2. The dual redundant power supplies are respectively connected to a central control unit CCU and a wheel-side control unit DCS to provide power redundancy for the EMB system.

4. A redundant and safe EMB control system as claimed in claim 3, characterized in that: The power supply end of the human-driven electronic brake pedal is connected to the power supply end of the central control unit CCU and is connected to the dual redundant power supply through a hard line.

5. A redundant and safe EMB control system according to any one of claims 1 to 4, characterized in that: The CCU control function is backed up in the wheel-side control unit DCS, and the host computer request signal is respectively connected to the central control unit CCU and the wheel-side control unit; wherein the wheel-side control unit executes the backup CCU control function to achieve braking control after the central control unit CCU fails or malfunctions; and or the CCU control function is backed up in the pedal control unit PCU, and the host computer request signal is respectively connected to the central control unit CCU and the pedal control unit PCU, the pedal control unit PCU is communicatively connected with the wheel-side control unit DCS to output the corresponding braking signal to the DCS, and the pedal control unit PCU executes the backup CCU control function to achieve braking control after the central control unit CCU fails or malfunctions.

6. A redundant and safe EMB control system according to any one of claims 1 to 4, characterized in that: The wheel-side control unit DCS includes four brake unit ECUs, namely: left front brake unit, right front brake unit, left rear brake unit, right rear brake unit, which are used to control the braking of one wheel respectively; one or more backup CCU control functions in the four brake unit ECUs.

7. A redundant and safe EMB control system according to any one of claims 1 to 4, characterized in that: The human driving request signal, vehicle driving request signal and external request signal in the external request signal are all connected to the CCU, DCS and PCU through at least one of CAN, CANFD, Ethernet and hard wire; the CCU and DCS are connected through one private CAN and one public CAN; the PCU and DCS are connected through a signal private CAN.

8. A redundant and safe EMB control system as claimed in claim 6, characterized in that: The four brake unit ECUs in the DCS are all connected to the four-wheel speed sensors through hard wires, and the four-wheel speed sensors are dual-chip redundant sensor assemblies.

9. A redundant and safe EMB control system as claimed in claim 6, characterized in that: At least one of the four brake unit ECUs in the DCS serves as the master control, and the other brake unit ECUs are controlled by the master control, and the brake unit ECUs are connected to each other; the backup CCU function is set in the master control or the CCU function is backed up by the PCU, and the master control ECU is controlled by the PCU. When there are multiple master control ECUs, one of the master control ECUs is selected in order of priority to execute the backup CCU function.

10. A redundant and safe EMB control system according to any one of claims 1 to 9, characterized in that: When the central control unit CCU is in a normal state, it receives the request signal and converts it into a clamping force instruction and inputs it into the wheel-side control unit DCS, and the wheel-side control unit DCS executes and controls braking; when it monitors that the central control unit CCU fails or malfunctions, the wheel-side control unit DCS takes over the control function of the EMB system, and the DCS obtains the request signal and processes and calculates the control instruction according to its pre-backed-up CCS function and executes output control.

Images