Brake-by-wire and steering-by-wire dual-redundancy system

Abstract

The invention relates to the technical field of automobile electronic control, and discloses a brake-by-wire and steering-by-wire dual-redundancy system, the system comprises a brake-by-wire system and a steering-by-wire system, the brake-by-wire system comprises an electrical layer redundancy unit, an electrical layer redundancy unit and a control layer redundancy unit, the electromechanical cooperative backup unit comprises a ball screw, a servo motor and a pressure sensor, and the mechanical locking unit outputs axial locking force during power failure; the steering-by-wire system comprises a double-winding redundancy unit and a double-MCU redundancy unit, the double-winding redundancy unit adopts a parallel-type double-winding direct-current brushless motor, the double-MCU redundancy unit adopts a double-MCU control chip framework, and the steering-by-wire system adopts a three-layer progressive redundancy framework of electric appliance layer redundancy, electromechanical collaborative backup and mechanical locking, so that complex scenes such as single-winding failure and the like are covered; the brake capacity meeting the brake requirement still can be ensured under the extreme condition, the drive-by-wire steering system adopts double-winding redundancy and double-MCU redundancy, it is ensured that the basic steering capacity is kept, and safe and reliable guarantee is provided.

Description

Technical Field

[0001] The present invention relates to the field of automotive electronic control technology, and particularly to a dual-redundancy system for brake-by-wire and steer-by-wire. Background Art

[0002] With the continuous development of automotive technology, the Electromechanical Brake System (EMB) has gradually replaced the traditional hydraulic brake system with high precision and fast response. As an advanced steering technology, the steer-by-wire system controls steering through electrical signals, cancels the traditional mechanical connection, and improves the flexibility and precision of steering.

[0003] However, the existing EMB system relies on a single electric motor braking unit, which has a risk of single-point failure. The existing steer-by-wire system lacks an effective redundancy design and cannot guarantee the basic steering ability of the vehicle when a key component fails, posing a safety hazard. Summary of the Invention

[0004] In view of this, the present invention provides a dual-redundancy system for brake-by-wire and steer-by-wire to solve the problems that the existing brake-by-wire system relies on a single electric motor braking unit with a risk of single-point failure, and the existing steer-by-wire system lacks an effective redundancy design with a safety hazard.

[0005] In a first aspect, the present invention provides a dual-redundancy system for brake-by-wire and steer-by-wire. The system includes a brake-by-wire system and a steer-by-wire system. The brake-by-wire system includes an electrical layer redundancy unit, an electromechanical collaborative backup unit, and a mechanical locking unit. The steer-by-wire system includes a dual-winding redundancy unit and a dual-MCU redundancy unit. Among them,

[0006] The electrical layer redundancy unit uses a main-backup dual-mode EMB motor. The stator of the main-backup dual-mode EMB motor is embedded with two physically isolated independent windings, and each winding is controlled by an independent H-bridge drive circuit to achieve the switching of the braking function;

[0007] The electromechanical collaborative backup unit includes a ball screw, a servo motor, and a piezoelectric pressure sensor, and is decoupled from the main EMB through an electromagnetic clutch to achieve emergency pressure build-up;

[0008] The mechanical locking unit includes a locking pin structure based on nickel-titanium alloy SMA and a three-stage lever amplification structure, which is used to output an axial locking force when powered off to achieve pure mechanical braking retention;

[0009] The main and backup power supplies of the brake-by-wire system are independently powered, and the main EMB, the electromechanical collaborative backup unit, and the mechanical locking unit adopt a non-similar actuator design;

[0010] The dual-winding redundant unit uses a parallel dual-winding brushless DC motor and a Y-shaped three-phase concentrated winding. The two sets of windings are independent and physically isolated, and each has an independent drive circuit.

[0011] The dual MCU redundant unit adopts a dual MCU control chip architecture to achieve controller switching;

[0012] The steer-by-wire system uses position sensors and current sensors to construct position loops and current loops to achieve dual closed-loop control, detect faults in real time, and use dual winding redundant units and dual MCU redundant units to switch working modes.

[0013] The present invention adopts a dual-redundancy design for the brake-by-wire system and the steering-by-wire system. The brake-by-wire system adopts a three-layer progressive redundancy architecture of electrical layer redundancy, electromechanical coordinated backup and mechanical locking, covering complex scenarios such as single winding failure, main EMB crash, communication interruption, controller failure and vehicle power outage, to ensure that the braking system still has the braking capacity to meet the braking requirements under extreme conditions. The steering-by-wire system adopts dual winding redundancy and dual MCU redundancy. The dual winding redundancy allows the steering-by-wire motor to still output a certain power when a single winding fails. The dual MCU redundancy improves the reliability of the controller, ensures that the steering system maintains basic steering capability, and provides safe and reliable protection for automatic driving of vehicles.

[0014] In an optional embodiment, the stator winding spacing of the main-standby dual-mode EMB motor is greater than 3 mm, the dual-winding redundant unit includes a main winding and a standby burning group, and is equipped with a dual-winding temperature sensor. When the main winding temperature sensor detects that the temperature difference is greater than the preset temperature difference, or the current harmonic distortion rate is greater than the preset distortion rate, the three-out-of-two voting logic is triggered to switch to the standby burning group.

[0015] The present invention sets the stator winding spacing to avoid magnetic circuit coupling. The dual-winding redundant design enables the wire-controlled steering motor to still output a certain power in the event of a single winding failure. A dual-winding temperature sensor is configured to switch to the spare burning group in time when an abnormality occurs to avoid motor shutdown or damage.

[0016] In an optional embodiment, a dual-winding temperature sensor is cross-validated, and when the measurement value error of the dual-winding temperature sensor is greater than a preset error, fault diagnosis is triggered; the clamping force sensor has a built-in temperature compensation chip, which calculates and compensates for the temperature measurement value drift caused by temperature according to the temperature characteristics of the strain gauge, and dynamically corrects the temperature measurement value; the ball screw preload force is monitored in real time through the strain gauge, and the electromechanical collaborative backup unit is determined to have failed when the displacement exceeds the limit.

[0017] The present invention adopts a dual-winding temperature sensor for cross-verification to improve the accuracy of fault detection. A temperature compensation chip is built into the clamping force sensor to provide more accurate measurement results in different temperature environments. The pre-tightening force of the ball screw is monitored by strain gauges, and when an abnormality occurs, it is determined that the electromechanical collaborative backup unit fails, so as to facilitate the operator to take timely measures.

[0018] In an alternative embodiment, the planetary reducer ratio of the ball screw of the electromechanical collaborative backup unit is 10:1, the lead of the ball screw is 5 mm, the rated power of the servo motor is 200 W, and the measuring range of the piezoelectric pressure sensor is 0 - 20 MPa.

[0019] The present invention sets the planetary reducer ratio to amplify the output torque of the servo motor, so that the ball screw obtains a greater driving force and improves the load capacity. The lead of the ball screw is set to achieve precise displacement control. The rated power of the servo motor is set to provide appropriate power support. The measuring range of the pressure sensor is set to accurately measure the pressure value, providing data support for system control and monitoring.

[0020] In an alternative embodiment, the pre-deformed SMA wire of the mechanical locking unit is in the form of a spring with a diameter of 1 mm. After triggering, the contraction force is greater than 200 N. The transmission ratio of the three-stage lever is 8:1, and the taper of the locking pin is 1:10. Self-locking is achieved after inserting into the groove of the ball screw.

[0021] The present invention adopts SMA to quickly generate a contraction action when the triggering condition is met, providing sufficient locking force. Through the transmission of the three-stage lever and setting the transmission ratio, the contraction force is further amplified. The taper of the locking pin is set to ensure self-locking and improve safety.

[0022] In an alternative embodiment, the triggering condition for the main and backup power supply switching is that the voltage continuously remains less than 9 V for 500 ms, and electrical isolation between the super capacitor and the main power supply is achieved through an opto-isolator.

[0023] The present invention sets the triggering condition for the main and backup power supply switching to avoid mis-switching caused by situations such as instantaneous voltage fluctuations, ensuring the stability of the system. Electrical isolation is achieved through an opto-isolator, effectively preventing electrical interference and leakage between the main power supply and the super capacitor, and improving safety.

[0024] In an alternative embodiment, when the parallel dual-winding DC brushless motor is operating normally, both sets of windings are energized simultaneously to generate torque. When a set of windings fails, it switches to the single-winding operating mode.

[0025] The present invention sets both sets of windings to be energized simultaneously to generate torque during normal operation to enhance the torque output capacity of the motor and cope with various working loads. When a winding fails, the operating mode is switched to ensure the normal operation of the motor.

[0026] In an alternative embodiment, when the dual MCU control chip is operating normally, it adopts a master-slave backup working mode. The dual MCU redundancy unit includes a main controller and a standby controller. When any one of the MCUs fails, the other MCU takes over the control task.

[0027] In the present invention, the dual MCUs adopt a master-slave backup working mode to improve the reliability of the controller. By setting a main controller and a standby controller, when an MCU fails, the other MCU takes over the control task, and the redundant switch continues to operate, thereby improving the reliability of the system.

[0028] In an alternative embodiment, the main controller and the standby controller synchronize data in real time through an SPI communication link and transmit heartbeat signals to monitor the working status of the MCU.

[0029] In the present invention, the main controller and the standby controller synchronize data, perform fault monitoring based on the heartbeat signal, and monitor the working status of the MCU, thereby improving the stability and reliability of the system.

[0030] In an alternative embodiment, the position sensor is a Hall sensor, and the electronic commutator switches the current direction of the winding according to the position of the motor rotor indicated by the Hall sensor to ensure continuous torque output of the motor.

[0031] In the present invention, the Hall sensor utilizes the Hall effect to provide accurate position information, and the electronic commutator switches the current direction of the winding to adapt to different operating states and meet the requirements of the scenario. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following will briefly introduce the drawings required for the description of the specific embodiments or the prior art. Obviously, the following drawings are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0033] Figure 1 is a schematic diagram of a dual redundant system for brake-by-wire and steer-by-wire according to an embodiment of the present invention;

[0034] Figure 2 is a schematic diagram of a brake-by-wire system according to an embodiment of the present invention;

[0035] Figure 3 is a schematic diagram of a steer-by-wire system according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0036] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Apparently, the described embodiments are some, but not all, of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0037] Existing redundant architectures mostly adopt similar redundancy solutions, such as a dual-motor parallel structure, where the primary and backup systems share a power supply, sensors, or control logic, resulting in a high risk of common-cause failure. Mechanical backup solutions (such as spring accumulators) rely on complex transmission chains, with a response delay exceeding 500 ms, making it difficult to meet the real-time requirements of emergency braking for autonomous driving (the ASIL D requirement for fault switching time ≤ 150 ms).

[0038] Traditional EMB systems rely on the vehicle's main power supply and cannot activate the backup braking function when power is cut off. The reliability of mechanical locking devices (such as ratchet mechanisms) is limited by the transmission chain and is prone to failure due to wear, vibration, or environmental deformation, making it difficult to adapt to the harsh vehicle environment (-40°C to 125°C).

[0039] The embodiments of the present invention provide a dual-redundancy system for brake-by-wire and steer-by-wire. The brake-by-wire dual-redundancy system is based on an "electric - electro-mechanical - mechanical" three-level progressive redundant architecture, and the steer-by-wire dual-redundancy system is based on a multiple redundant architecture of "dual-winding - dual-MCU - dual closed-loop control". Through redundant design, the reliability and safety of the system are improved, ensuring that when the primary system fails, the redundant system can take over in time and maintain the normal driving of the vehicle.

[0040] The embodiments of the present invention provide a dual-redundancy system for brake-by-wire and steer-by-wire. The system includes a brake-by-wire system and a steer-by-wire system, as Figure 1 shown, adopting a brake system redundant architecture and a steering system redundant architecture. The brake system redundant architecture includes electrical redundancy, electro-mechanical collaborative backup, mechanical locking, non-similar redundancy, and physical isolation. The steering system redundant architecture includes dual-winding redundancy, dual-MCU redundancy, and dual closed-loop detection coverage.

[0041] Among them, the brake-by-wire system includes an electrical layer redundant unit. The primary-backup dual-mode EMB motor serves as the electrical layer redundant unit of the brake-by-wire system. Two physically isolated independent windings are embedded in the stator, and each winding is controlled by an independent H-bridge drive circuit. The drive signal is transmitted through an opto-isolator to ensure electrical isolation, and a 5-ms-level brake function switching is achieved through a hot backup strategy.

[0042] The electronic-hydraulic braking system further includes an electro-mechanical collaborative backup unit, which includes a ball screw, a servo motor, and a piezoelectric pressure sensor. It is decoupled from the main EMB through an electromagnetic clutch to achieve emergency pressure build-up within 150 ms.

[0043] The electronic-hydraulic braking system also includes a mechanical locking unit. The mechanical locking unit is based on a locking pin structure of nickel-titanium alloy shape memory alloy (SMA). Through a three-stage lever amplification and taper self-locking design, it outputs an axial locking force of ≥2 kN when power is off or the first two levels fail, realizing pure mechanical braking retention.

[0044] The main and backup power supplies of the electronic-hydraulic braking system are independently powered (the super capacitor is separated from the main power supply), and the control logics are decoupled. The main EMB, the electro-mechanical collaborative backup unit, and the mechanical locking unit adopt dissimilar actuator designs. The common cause failure factor β≤0.1 (that is, the probability of the main and backup systems failing simultaneously due to the same reason ≤10%), and the fault detection coverage rate >99%, meeting the strict requirements of ISO26262 ASIL D for redundant systems.

[0045] As Figure 2 shown, the electronic-hydraulic braking system is a three-stage progressive redundant architecture, including an electrical redundancy layer, an electro-mechanical collaborative layer, and a mechanical protection layer. The three-layer redundant design is progressive. When failures such as main motor failure, low brake pipeline pressure, and communication timeout occur in the electrical layer redundancy, it switches to electro-mechanical collaborative backup to ensure that the system still has 70% braking capacity. When the electro-mechanical collaborative backup fails, or when the vehicle is completely powered off and the first two layers both fail, it switches to mechanical protection redundancy to ensure that the system maintains a deceleration of ≥0.3g.

[0046] The steer-by-wire system includes a dual-winding redundant unit. The parallel dual-winding DC brushless motor is used as the drive motor of the steer-by-wire system. The two sets of three-phase concentrated windings arranged in a Y shape are independent and physically isolated, and each has an independent drive circuit. As Figure 3 shown, they are drive circuit 1 and drive circuit 2 respectively, with an electrical angle difference of 30° between them.

[0047] The steer-by-wire system also includes a dual-MCU redundant unit. As Figure 3 shown, it includes MCU1 and MCU2, adopting a dual-MCU control chip architecture, which is a dual-MCU redundant controller to achieve controller switching.

[0048] The steer-by-wire system uses a position sensor and a current sensor to construct a position loop and a current loop to achieve dual closed-loop control, control the steer-by-wire system, and detect the occurrence of faults in real time, so as to switch the working mode in time using the dual redundant architecture.

[0049] As Figure 3As shown in the figure, the steer-by-wire system adopts a multi-redundancy coverage architecture, including dual-winding redundancy, dual-MCU redundancy, and dual closed-loop control coverage. The dual-winding redundancy enables the steer-by-wire motor to still output a certain amount of power in the case of a single-winding fault. The dual-MCU redundancy adopts a master-slave backup working mode to improve the reliability of the controller. The dual closed-loop control system of the position loop and the current loop detects faults in real time, combines the position information fed back by the position sensor and the current information fed back by the current sensor, and timely switches the working mode using the dual-redundancy architecture.

[0050] The dual-redundancy system of the electro-hydraulic brake and the steer-by-wire provided in this embodiment designs the dual redundancy of the electro-hydraulic brake system and the steer-by-wire system. The electro-hydraulic brake system adopts a three-layer progressive redundancy architecture of electrical layer redundancy, electro-mechanical collaborative backup, and mechanical locking, covering complex scenarios such as single-winding failure, main EMB downtime, communication interruption, controller failure, and vehicle-wide power-off, ensuring that the brake system still has the braking ability to meet the braking requirements under extreme conditions. The steer-by-wire system adopts dual-winding redundancy and dual-MCU redundancy. The dual-winding redundancy enables the steer-by-wire motor to still output a certain amount of power in the case of a single-winding fault. The dual-MCU redundancy improves the reliability of the controller, ensuring that the steering system maintains the basic steering ability and providing a safe and reliable guarantee for vehicle autonomous driving.

[0051] Specifically, as Figure 3 shown, the master-slave dual-mode EMB motor is embedded with two independent windings (wire diameter 0.5mm, number of turns 200). The winding spacing is ≥3mm to avoid magnetic circuit coupling, and the magnetic circuit is completely decoupled. The dual-winding redundancy unit includes a main winding and a spare winding, namely winding 1 and winding 2. The two sets of windings share a permanent magnet rotor. When working normally, they are energized simultaneously to generate torque, and in case of a fault, they can be switched to the single-winding working mode. The Hall current sensor detects the current of each winding in real time. Each group of windings is independently configured with two temperature sensors to monitor over-temperature failure through cross-verification.

[0052] By setting the stator winding spacing to avoid magnetic circuit coupling, the dual-winding redundancy design enables the steer-by-wire motor to still output a certain amount of power in the case of a single-winding fault. By configuring dual-winding temperature sensors, when an abnormality occurs, it can be timely switched to the spare winding to avoid motor shutdown or damage.

[0053] The master-slave switching logic is as follows:

[0054] S1: When the main winding temperature sensor (PT100) detects that the temperature difference > 10°C, or the current harmonic distortion rate > 5%, trigger the two-out-of-three voting logic to switch to the spare winding;

[0055] S2: If the MCU two-out-of-three voting determines that the main EMB fails (such as a short circuit in the H-bridge IGBT) or the braking pipeline pressure < 80% of the rated value for 50 ms (collected by the dual-redundancy piezoelectric sensor), the electromagnetic clutch engages, and the electromechanical backup layer starts to build pressure;

[0056] S3: When the main and backup power supply voltages < 9V for 500 ms, or the communication is interrupted (the CAN heartbeat packet is lost > 3 times), the super capacitor activates the SMA lock, and the travel of the lock pin ≥ 5 mm.

[0057] Among them, the safety verification mechanism is as follows:

[0058] S1: The dual-winding temperature sensors cross-verify. If the measured values of the dual-winding temperature sensors > 5°C, trigger fault diagnosis;

[0059] S2: The clamping force sensor is built-in with a temperature compensation chip (accuracy ±0.1°C), calculates and compensates for the measurement value drift caused by temperature according to the temperature characteristics of the strain gauge, and dynamically corrects the temperature measurement value;

[0060] S3: The preload force of the ball screw is monitored in real time through the strain gauge. When the displacement exceeds the limit (±0.2 mm), it is determined that the electromechanical collaborative backup unit fails.

[0061] By using the dual-winding temperature sensors for cross-verification to improve the accuracy of fault detection, a temperature compensation chip is built into the clamping force sensor to provide more accurate measurement results in different temperature environments, and the preload force of the ball screw is monitored through the strain gauge. When an abnormality occurs, it is determined that the electromechanical collaborative backup unit fails, so that the operator can take timely measures.

[0062] Specifically, the speed ratio of the planetary reducer of the ball screw of the electromechanical collaborative backup unit is 10:1, the lead of the ball screw is 5 mm, the rated power of the servo motor is 200 W, the range of the piezoelectric pressure sensor is 0 - 20 MPa, and it is decoupled from the main EMB through the electromagnetic clutch under normal conditions, and the pressure build-up response time ≤ 150 ms.

[0063] By setting the speed ratio of the planetary reducer, the output torque of the servo motor is amplified, so that the ball screw obtains a greater driving force and the load capacity is improved. By setting the lead of the ball screw, precise displacement control is achieved. By setting the rated power of the servo motor, appropriate power support is provided. By setting the range of the pressure sensor, the pressure value is accurately measured, providing data support for system control and monitoring.

[0064] Specifically, the pre-deformed SMA wire of the mechanical lock unit is in the shape of a spring with a diameter of 1 mm. After being triggered by the super capacitor, the contraction force > 200 N, which is transmitted to the tungsten carbide lock pin through a three-stage lever. The transmission ratio of the three-stage lever is 8:1, and the taper of the lock pin is 1:10. After being inserted into the groove of the ball screw, self-locking is achieved.

[0065] By adopting SMA, a rapid contraction action is generated quickly when the triggering condition is met to provide sufficient locking force. Through a three-stage lever drive, the transmission ratio is set to further amplify the contraction force, and the taper of the locking pin is set to ensure self-locking and improve safety.

[0066] Specifically, in the independent power supply of the main and backup power supplies, the supercapacitor capacity ≥ 100F. The triggering condition for the main and backup power supply switching is that the voltage continuously < 9V and reaches 500ms. Electrical isolation between the supercapacitor and the main power supply is achieved through an opto-isolator.

[0067] By setting the triggering condition for the main and backup power supply switching, false switching caused by situations such as instantaneous voltage fluctuations is avoided, ensuring the stability of the system. Electrical isolation is achieved through an opto-isolator, effectively preventing electrical interference and leakage between the main power supply and the supercapacitor, and improving safety.

[0068] Specifically, the electromagnetic clutch is mechanically decoupled from the main EMB under normal conditions. The triggering conditions include: IGBT short circuit in the main EMB drive circuit, brake pipeline pressure < 80% of the rated value for 50ms, and the loss of the main and backup CAN communication heartbeat packets > 3 times.

[0069] Specifically, when the parallel dual-winding DC brushless motor is working normally, both sets of windings are energized simultaneously to generate torque, and due to the electrical angle difference, the torque ripple can be reduced. When one set of windings fails, it can quickly switch to the single-winding working mode, and the switching time reaches the microsecond level.

[0070] By setting both sets of windings to be energized simultaneously to generate torque during normal operation to enhance the motor's output torque capacity and cope with various working loads, and switching the working mode when the windings fail to ensure the normal operation of the motor.

[0071] Specifically, when the dual-MCU control chip is working normally, it adopts the master-slave backup working mode. The MCU controller is switched through the logic arbitration unit, and one MCU controls the drivers of the two windings. When any one of the MCUs fails, the other MCU can quickly take over the control task to ensure the stable operation of the system.

[0072] By adopting the master-slave backup working mode for the dual-MCU, the reliability of the controller is improved. When an MCU fails, the other MCU takes over the control task, and the redundant switching continues to run, improving the reliability of the system.

[0073] Specifically, in the master-slave backup working mode, the dual-MCUs are divided into a main controller and a backup controller, as Figure 3As shown, MCU1 is the main controller and MCU2 is the standby controller. During normal operation, both the main controller and the standby controller are in the running state, and they synchronize data in real time through the SPI (Serial Peripheral Interface Communication Link) communication link and transmit heartbeat signals to monitor the working status of the MCU. They verify whether each other is in the normal working state by whether normal data and periodic heartbeat signals are received.

[0074] The main controller and the standby controller send the working status characterization signals to the logic decision-making unit. When the main controller is working normally, the output signal of the main controller is adopted. When the main controller fails and the backup controller is working normally, the output signal of the backup controller is adopted. In this way, the working mode is switched through the logic decision-making unit, and a smooth transition can be ensured when the controller is switched.

[0075] By synchronizing data between the main controller and the standby controller, monitoring for faults based on heartbeat signals, and monitoring the working status of the MCU, the stability and reliability of the system are improved.

[0076] Specifically, the Hall sensor is used as a position sensor, and the electronic commutator switches the current direction of the winding according to the position of the motor rotor indicated by the Hall sensor to ensure continuous torque output of the motor. Moreover, by combining and comparing the data of two groups of Hall sensors and the data of the end angle sensor of the commutator, the measurement accuracy of the rotor position and the fault detection ability are improved.

[0077] The Hall sensor uses the Hall effect to provide accurate position information, and the electronic commutator switches the current direction of the winding to adapt to different operating states and meet the requirements of the scenario.

[0078] Specifically, the current loop can effectively regulate the winding current, optimize the torque output of the motor, and monitor abnormal conditions such as open circuit, overcurrent, and short circuit of the winding in real time. When an abnormal current measurement value is detected, the system can perform corresponding processing according to the preset logic, including stopping the operation of the abnormal winding and switching to the single-winding working mode to ensure the safe operation of the system.

[0079] For the double closed-loop control and detection coverage of the position loop and the current loop, the inner and outer loops form a cascade control architecture. The position loop (outer loop) takes the position of the motor rotor as the control target and adopts PI control (Proportional-Integral Control). It drives the current loop (inner loop) control through position feedback to adjust the position of the motor rotor in real time. The current loop (inner loop) takes the three-phase concentrated winding current as the control target and adopts PID control (Proportional-Integral-Derivative Control) to adjust the winding current, optimize the motor torque output, and simultaneously monitor abnormal conditions such as open circuit, overcurrent, and short circuit in real time. Through the comparison of Hall sensor data and current monitoring, faults are detected and processed in a timely manner to ensure the stable operation of the system.

[0080] It should be noted that for the electrical faults that the dual-winding redundant architecture may face, the following treatments are as follows: When the measured current value in a certain winding is abnormally zero, it is judged that the winding may be open-circuited or the current sensor is damaged. If it is still abnormal after observing for a certain period of time (millisecond level), immediately stop the operation of the corresponding winding and switch to the single-winding operation mode; When the measured current value in a certain winding is too large, it is judged that the winding may be overcurrent, short-circuited or the current sensor is damaged. Temporarily stop the operation of the corresponding winding and conduct three power-on tests to observe whether there is still an abnormal measured current value to exclude the interference of current measurement errors. If the abnormal condition is still found after three power-on tests, stop the operation of the corresponding winding and switch to the single-winding operation mode.

[0081] Through the above implementation methods, the single-point fault switching time ≤ 5ms, the electromechanical backup voltage build-up time ≤ 150ms, and the mechanical lock trigger delay ≤ 300ms can be achieved, comprehensively covering the ASIL D safety scenario.

[0082] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations all fall within the scope of this application.

Claims

1. A dual redundant system of wire control braking and steer-by-wire, characterized in that, The system includes a brake-by-wire system and a steering-by-wire system. The brake-by-wire system includes an electrical layer redundancy unit, an electromechanical coordination backup unit, and a mechanical locking unit. The steering-by-wire system includes a dual winding redundancy unit and a dual MCU redundancy unit. The electrical layer redundant unit adopts a main-standby dual-mode EMB motor, the stator of which is embedded with two sets of physically isolated independent windings, each set of windings is controlled by an independent H-bridge drive circuit to achieve braking function switching; The electromechanical coordination backup unit includes a ball screw, a servo motor and a piezoelectric pressure sensor, which is decoupled from the main EMB through an electromagnetic clutch to achieve emergency pressure build-up; The mechanical locking unit includes a locking pin structure based on nickel-titanium alloy SMA and a three-stage lever amplification structure, which is used to output an axial locking force when the power is off to achieve pure mechanical brake retention; The main and backup power supplies of the wire control brake system are independently powered, and the main EMB, electromechanical coordinated backup unit and mechanical locking unit adopt a non-similar actuator design; The dual-winding redundant unit adopts a parallel dual-winding brushless DC motor, adopts a Y-shaped three-phase concentrated winding, and the two sets of windings are independent and physically isolated, and each has an independent drive circuit; The dual MCU redundant unit adopts a dual MCU control chip architecture to achieve controller switching; The wire-controlled steering system uses a position sensor and a current sensor to construct a position loop and a current loop to achieve dual closed-loop control, detect faults in real time, and use a dual winding redundant unit and a dual MCU redundant unit to switch working modes.

2. The system according to claim 1, characterized in that, The stator winding spacing of the main-standby dual-mode EMB motor is greater than 3mm. The dual-winding redundant unit includes a main winding and a standby burning group, and is equipped with a dual-winding temperature sensor. When the main winding temperature sensor detects that the temperature difference is greater than the preset temperature difference, or the current harmonic distortion rate is greater than the preset distortion rate, the three-out-of-two voting logic is triggered to switch to the standby burning group.

3. The system according to claim 2, wherein The dual-winding temperature sensor is cross-validated, and when the measurement value error of the dual-winding temperature sensor is greater than the preset error, fault diagnosis is triggered; the clamping force sensor has a built-in temperature compensation chip, which calculates and compensates for the temperature measurement value drift caused by temperature according to the temperature characteristics of the strain gauge, and dynamically corrects the temperature measurement value; the ball screw preload force is monitored in real time through the strain gauge, and the electromechanical collaborative backup unit is determined to have failed when the displacement exceeds the limit.

4. The system according to claim 1, characterized in that, The planetary reducer speed ratio of the ball screw of the electromechanical coordinated backup unit is 10:1, the ball screw lead is 5mm, the rated power of the servo motor is 200W, and the piezoelectric pressure sensor has a range of 0-20MPa.

5. The system according to claim 1, wherein The SMA wire of the mechanical locking unit is pre-deformed into a spring shape with a diameter of 1 mm. The contraction force after triggering is greater than 200N. The transmission ratio of the three-stage lever is 8:1, the taper of the locking pin is 1:10, and self-locking is achieved after being inserted into the ball screw groove.

6. The system according to claim 1, wherein The trigger condition for switching the main power supply to the standby power supply is that the voltage is continuously less than 9V for 500ms, and the super capacitor and the main power supply are electrically isolated by an optocoupler isolator.

7. The system according to claim 1, wherein When the parallel dual-winding brushless DC motor is operating normally, two sets of windings are energized simultaneously to generate torque. When one set of windings fails, the motor switches to a single-winding operating mode.

8. The system according to claim 1, wherein When the dual MCU control chip is working normally, it adopts a master-slave backup working mode. The dual MCU redundancy unit includes a main controller and a standby controller. When any one of the MCUs fails, the other MCU takes over the control task.

9. The system according to claim 8, wherein The main controller and the standby controller synchronize data in real time through an SPI communication link and transmit heartbeat signals to monitor the working state of the MCU.

10. The system according to claim 1, wherein The position sensor is a Hall sensor. The electronic commutator switches the current direction of the winding according to the position of the motor rotor indicated by the Hall sensor to ensure that the motor continuously outputs torque.

Images