Intelligent drive-by-wire chassis redundancy architecture and failure processing method

Abstract

The invention discloses an intelligent drive-by-wire chassis redundancy architecture and a failure processing method, and belongs to the technical field of intelligent drive-by-wire chassis. The intelligent drive-by-wire chassis redundancy architecture comprises an ADS main controller, an ADS safety controller, an automatic driving system sensor, a chassis central domain controller, a chassis redundancy controller, a chassis actuator, a low-voltage power supply 1, a low-voltage power supply 2 and a central gateway. Automatic driving controller redundancy, chassis controller redundancy, power supply redundancy, actuator redundancy and communication redundancy can be realized. According to different levels of automatic driving, rapid switching of schemes can be achieved only by increasing and decreasing an ADS safety controller, a chassis redundancy controller, a chassis redundancy actuator and a low-voltage power source 2, the whole electrical architecture is kept unchanged, and rapid adaptation of a software interface is achieved through calibration. The invention further provides a corresponding failure processing method for failure of key components and failure of main communication links of the safety redundancy architecture of the intelligent drive-by-wire chassis, and reliability and safety of the chassis are effectively guaranteed.

Description

Technical Field

[0001] This invention relates to the field of intelligent drive-by-wire chassis technology, and more specifically to an intelligent drive-by-wire chassis redundancy architecture and failure handling method. Background Technology

[0002] With the development trend of vehicle electrification and intelligence, autonomous driving technology has developed rapidly and been widely applied. As an important carrier of autonomous driving functions, the intelligent drive-by-wire chassis plays an important role in vehicle driving safety. Safe and reliable drive-by-wire chassis and its control system directly affect the application and further promotion of higher-level autonomous driving technology.

[0003] Currently, some intelligent drive-by-wire chassis electrical architecture designs, redundancy schemes, and control logics for autonomous vehicles have emerged on the market. For example, Chinese utility model patent CN219122584U discloses a redundant autonomous driving control system and an autonomous vehicle; invention patent CN119511895A discloses a multi-mode redundant integrated control system for an automotive drive-by-wire chassis and its application; and invention patent CN111427367A discloses a vehicle redundancy control system. However, these existing solutions still have shortcomings in terms of the coverage of redundancy in intelligent drive-by-wire chassis, the completeness of the solution, and safety strategies, and they cannot achieve platformization and universality. Summary of the Invention

[0004] This invention provides a redundant architecture and failure handling method for intelligent drive-by-wire chassis, aiming to address the shortcomings of existing intelligent drive-by-wire chassis redundancy in terms of coverage, completeness, and security strategies, which prevent them from achieving platformization and universality.

[0005] The present invention adopts the following technical solution: A redundant architecture for a smart drive-by-wire chassis is characterized by comprising an ADS main controller, an ADS safety controller, autonomous driving system sensors, a chassis central domain controller, a chassis redundancy controller, chassis actuators, a low-voltage power supply 1, a low-voltage power supply 2, and a central gateway. The ADS main controller possesses complete functions for achieving autonomous driving. The ADS safety controller, in addition to its complete autonomous driving functions, also performs safety monitoring of the ADS main controller. When the ADS main controller fails or the ADS safety controller determines that the ADS main controller has experienced an unexpected safety anomaly, it will take over vehicle control and complete the safe parking of the vehicle. The chassis central domain controller possesses functions including basic functions, diagnostic protection, and safety control. The basic functions include information interaction, modal management, state prediction, and chassis cooperative control. The chassis redundancy controller, in addition to its basic functions, diagnostic protection, and safety control, also performs safety monitoring of the chassis central domain controller. The chassis actuators include the drive system, main braking system, backup braking system, steering system, and EPB parking system, capable of responding to lateral and longitudinal control commands from the chassis central domain controller or chassis redundancy controller and providing feedback on actuator status information. The central gateway, as the core hub of the automotive electronic architecture, possesses functions including cross-domain communication, protocol conversion, data security, and network management. The redundancy scheme of the intelligent drive-by-wire chassis redundancy architecture includes: (1) adopting a dual ADS controller scheme. Under normal circumstances, the software algorithms of the two ADS controllers run synchronously and issue the same chassis lateral and longitudinal control commands at the same time. The valid bit of the ADS main controller command is 1, and the valid bit of the ADS safety controller command is 0. The two ADS controllers interact with the chassis main controller through ECAN1, and the two ADS controllers interact with the chassis redundancy controller through ECAN2. The two ADS controllers communicate internally and monitor safety through Ethernet. Effective control commands are output through information communication and real-time monitoring; (2) adopting a dual chassis controller. The scheme is as follows: the chassis central domain controller is the main controller, the chassis redundant controller is the backup controller, the chassis central domain controller interacts with the ADS main controller and the ADS safety controller through ECAN1, the chassis redundant controller interacts with the ADS main controller and the ADS safety controller through ECAN2, the two chassis controllers interact with the chassis actuators through VCAN1 and VCAN2 respectively, and the two chassis controllers interact with each other through heterogeneous communication and safety monitoring; (3) adopt a redundant chassis actuator scheme, in which the drive system adopts a dual-channel CAN and dual-power redundant form, when the chassis domain control command is lost If the drive system fails to validate the control command, it will actively initiate a torque cancellation action. The braking system employs a full-redundancy braking scheme, with both the main and backup braking systems using dual-channel CAN and dual-power redundancy. The two braking systems are interconnected via VCAN1 and VCAN2. In addition to performing braking tasks in case of main braking system failure, the backup braking system can actively compensate for lost braking force if the main braking capacity is insufficient or braking force is lost, ensuring braking safety and smoothness. The steering system uses a full-redundancy scheme with dual motors or dual windings, including dual-channel CAN, dual power supply, dual motors, dual electronic controls, and dual sensors. When the chassis domain control... If the command is lost and the autonomous driving mode is completely unmanned, the steering system will maintain the angle at the last moment. If the autonomous driving mode is manned, the steering system will switch to manual assistance mode. The EPB electronic parking brake system adopts a redundant form of dual CAN, dual power supply, and dual control board. When the chassis domain control command is lost in the online control mode and the vehicle speed is zero, the EPB will automatically execute parking until it is released by the switch and exits the online parking state. (4) A redundant low-voltage power supply scheme is adopted, including two independent low-voltage power supply systems. Each low-voltage power supply system includes a high-voltage to low-voltage DC-DC converter and a low-voltage battery. The two low-voltage power supply systems supply power to the main redundant system of the autonomous driving intelligent online control chassis.(5) A redundant communication architecture is adopted. The autonomous driving domain and the intelligent chassis domain use two communication links, ECAN1 and ECAN2. The intelligent chassis domain and the chassis actuators use two communication links, VCAN1 and VCAN2. Information is transmitted between the autonomous driving domain and the chassis actuators via two links: gateway forwarding and chassis controller forwarding.

[0006] Specifically, the aforementioned information interaction involves receiving, sending, validating, detecting disconnections, filtering, unit conversion, and assigning initial values ​​to input and output signals; modal management involves comprehensively managing autonomous driving mode, manual mode, controller mode, remote mode, and emergency stop mode, and selecting and outputting modal requests based on operating conditions and scenarios; state prediction involves estimating important parameters, including vehicle state parameters and road environment information; chassis collaborative control involves comprehensively coordinating lateral and longitudinal control commands under different modes to ensure vehicle driving safety and tracking control accuracy; and diagnostic protection involves performing safety diagnostics on the control commands of the chassis central domain controller and the actual execution feedback and actual state of the chassis actuators.

[0007] The aforementioned chassis redundancy controller specifically monitors the chassis central controller's safety by monitoring the chassis central domain controller's downtime status and control command output, and takes over and safely shuts down the chassis when it determines that the chassis central domain controller is down or the control output is abnormal.

[0008] When using a redundant chassis actuator scheme, if the braking system determines that the chassis domain control command has been lost, the backup braking system will actively apply braking force to gradually bring the vehicle to a stop.

[0009] The present invention also provides a method for handling failures of an intelligent drive-by-wire chassis, based on the above-mentioned redundant architecture of an intelligent drive-by-wire chassis, including a method for handling failures of key components and a method for handling failures of main communication links; The specific failure handling methods for key components are as follows: S11, ADS main controller failure handling: After the ADS safety controller detects a failure of the ADS main controller, its control command validity setting is set to 1, and the system function is degraded. The chassis central domain controller responds to the valid commands of the ADS safety controller to control the chassis actuators. The chassis redundancy controller, as a backup of the chassis central domain controller, is responsible for control redundancy and safety monitoring. The chassis actuators respond to the control commands of the chassis central domain controller; S12, ADS safety controller failure handling: After the ADS main controller detects a failure of the ADS safety controller, it continues to maintain the control command validity setting at 1, and simultaneously issues a system alarm, but does not degrade the function. The chassis central domain controller responds to the valid commands of the ADS main controller to control the chassis actuators. The chassis redundancy controller, as a backup of the chassis central domain controller, is responsible for control redundancy and safety monitoring. Redundancy and safety monitoring are implemented. The chassis actuators respond to the control commands of the chassis central domain controller. S13, Chassis Central Domain Controller Failure Handling: After the ADS main controller detects the failure of the chassis central domain controller, it continues to maintain the control command valid position 1, while degrading the system functions. After the chassis redundancy controller detects the failure of the chassis central domain controller, it takes over the control authority of the chassis and responds to the valid commands of the ADS main controller to control the chassis. The chassis actuators respond to the control commands of the chassis redundancy controller. S14, Chassis Redundancy Controller Failure Handling: After the ADS main controller detects the failure of the chassis redundancy controller, it continues to maintain the control command valid position 1, while issuing a system alarm, but does not degrade the functions. The chassis central domain controller responds to the valid commands of the ADS main controller to control the chassis actuators, and the chassis actuators respond to the control commands of the chassis central domain controller. The main communication link failure handling methods are as follows: S21, ADS controller inter-controller communication link failure: After the ADS master controller detects the loss of connection with the ADS safety control, it degrades the system's function, and both ADS controllers set their control command valid bits to 1. The chassis central domain controller prioritizes responding to the valid control commands of the ADS master controller. The chassis redundant controller, as a backup of the chassis central domain controller, is responsible for control redundancy and safety monitoring. The chassis actuators respond to the control commands of the chassis central domain controller; S22, Chassis central domain controller and two ADS controller communication link failure: After the ADS master controller detects the loss of connection with the chassis central domain controller, it degrades the system's function and communicates with the ADS controllers. The DS safety controller transfers system control through information exchange. The ADS safety controller's control command validity setting is set to 1. After the chassis central domain controller detects the loss of connection with the ADS controller, it exchanges information with the chassis redundancy controller and transfers chassis control. The chassis redundancy controller responds to the valid control commands of the ADS safety controller, and the chassis actuators respond to the control commands of the chassis redundancy controller. S23, Communication link between the chassis redundancy controller and the two ADS controllers fails: After the ADS main controller detects the loss of connection with the chassis redundancy controller, it issues a system alarm but does not degrade functionality. The chassis central domain controller responds to the valid control commands of the ADS main controller, and the chassis actuators respond to the chassis central domain controller. The chassis redundancy controller acts as a backup chassis controller, only responsible for safety monitoring of the chassis central domain controller; S24, failure of the communication link between chassis controllers: After the chassis central domain controller detects the loss of connection with the chassis redundancy controller, it feeds back the result to the ADS main controller. The ADS main controller degrades the system's functions. The chassis central domain controller and the chassis redundancy controller simultaneously respond to the valid control commands of the ADS main controller. The chassis actuators prioritize responding to the control commands of the main CAN. The main braking system and the backup braking system have a braking anti-overlap function to avoid unexpected excessive braking; S25, failure of the communication link between the chassis central domain controller and the chassis actuators: After the chassis central domain controller detects a loss of connection with the chassis actuators, it feeds back the result to the ADS main controller and the chassis redundancy controller. The ADS main controller performs a safe shutdown of the system, the chassis redundancy controller responds to the valid control commands of the ADS main controller, and the chassis actuators respond to the control commands of the chassis redundancy controller; S26, Communication link between the chassis redundancy controller and the chassis actuators fails: After the chassis redundancy controller detects a loss of connection with the chassis actuators, it feeds back the result to the ADS main controller and the chassis central domain controller. The ADS main controller performs a function degradation of the system, the chassis central domain controller responds to the valid control commands of the ADS main controller, and the chassis actuators respond to the control commands of the chassis central domain controller.

[0010] In S11, the switching time between the ADS main controller and the ADS safety controller is completed within 100ms; in S13, the switching time between the chassis central domain controller and the chassis redundant controller is also completed within 100ms.

[0011] As can be seen from the above description of the present invention, compared with the prior art, the present invention has the following advantages: 1. The intelligent drive-by-wire chassis redundancy architecture of this invention can meet the technical requirements of platformization and universalization, and can quickly adapt to different levels of autonomous driving solutions. When facing high-level autonomous driving (L4 and above), this architecture can achieve the technical requirement of full redundancy. When the autonomous driving level is L3 and below, this architecture can achieve low-cost, non-redundant solution switching through quick plug-and-play. Based on the platform characteristics of this architecture, different levels of autonomous driving can be quickly switched by simply adding or removing the ADS safety controller, chassis redundancy controller, chassis redundancy actuator, and low-voltage power supply 2, while the entire electrical architecture remains unchanged, and the software interface can be quickly adapted through calibration.

[0012] 2. This invention proposes single-point failure handling measures for key components and communication networks in the redundant architecture of the entire intelligent drive-by-wire chassis, avoiding common-cause failures, greatly improving the safety and smoothness of chassis control, and ensuring the intelligent driving safety and comfort requirements of the vehicle in all scenarios. Attached Figure Description

[0013] Figure 1 This is a schematic diagram of the redundant architecture of the intelligent drive-by-wire chassis of the present invention.

[0014] Figure 2 This is a schematic diagram illustrating the failure of a key component in the redundant architecture of the intelligent drive-by-wire chassis of this invention.

[0015] Figure 3 This is a schematic diagram illustrating the failure of the communication link in the redundant architecture of the intelligent drive-by-wire chassis of this invention. Detailed Implementation

[0016] Specific embodiments of the present invention will now be described with reference to the accompanying drawings. Many details are described below to provide a comprehensive understanding of the invention; however, those skilled in the art will not need these details to implement the invention. Well-known components, methods, and processes will not be described in detail below.

[0017] This embodiment provides a smart drive-by-wire chassis safety redundancy architecture, including an autonomous driving system main controller (hereinafter referred to as the ADS main controller), an autonomous driving system safety controller (hereinafter referred to as the ADS safety controller), autonomous driving system sensors, a chassis central domain controller, a chassis redundancy controller, chassis actuators, low-voltage power supply 1 (DCDC1 + low-voltage battery 1), low-voltage power supply 2 (DCDC2 + low-voltage battery 2), and a central gateway.

[0018] The ADS main controller can realize the complete functions of autonomous driving, including: perception fusion, vehicle localization, trajectory planning, chassis control, safety diagnostics, and communication.

[0019] In addition to enabling full autonomous driving functions, the ADS safety controller can also perform safety monitoring of the ADS main controller (time-sequence monitoring, function monitoring, etc.). When the ADS main controller fails or the ADS safety controller determines that the ADS main controller has an unexpected safety anomaly, it will take over the vehicle control authority and complete the safe parking of the vehicle.

[0020] The main functions of the chassis central domain controller include basic functions (information interaction, modal management, state prediction, chassis collaborative control, etc.), diagnostics and protection, and safety control. Information interaction specifically involves receiving, sending, validating, detecting disconnections, filtering, unit conversion, and initializing input and output signals. Modal management comprehensively manages autonomous driving modes, manual modes, controller modes, remote modes, and emergency stop modes, selecting and outputting modal requests based on operating conditions and scenarios. State prediction estimates important parameters such as vehicle state parameters and road environment information. Chassis collaborative control comprehensively coordinates lateral and longitudinal control commands under different modes to ensure vehicle driving safety and tracking control accuracy. Diagnostics and protection perform safety diagnostics on the control commands of the chassis central domain controller and the actual execution feedback and actual state of the chassis actuators, detecting abnormalities in the chassis actuator execution results. In the event of a chassis actuator malfunction, safety procedures and protection should be implemented according to the corresponding fault level. In addition, the effectiveness of ADS control commands and operating status information should be diagnosed. When the ADS controller (ADS main controller or ADS safety controller) malfunctions, safety procedures and protection should be implemented according to the corresponding fault level. Safety procedures and protection include, but are not limited to, alarms, speed limits, torque limits, gentle braking, and emergency braking. Specifically, safety control involves monitoring and controlling the ADS controller (ADS main controller or ADS safety controller), chassis actuator failures, shutdowns, and unexpected chassis responses (unexpected acceleration, unexpected braking, unexpected lack of braking force, unexpected steering, unexpected loss of steering ability) to bring the vehicle into a safe state.

[0021] In addition to basic functions (information interaction, modal management, status prediction, chassis collaborative control, etc.), diagnostic protection, and safety control, the chassis redundancy controller also has the capability to monitor the safety of the chassis central domain controller. Specifically, safety monitoring involves monitoring the chassis central domain controller's downtime status and control command output, and taking over and safely shutting down the system when the chassis central domain controller is determined to be down or its control output is abnormal.

[0022] The chassis actuators include a drive system, a main braking system, a backup braking system, a steering system (including a dual-motor / dual-winding steering system), and an EPB parking system. They are capable of responding to lateral and longitudinal control commands from the chassis central domain controller or the chassis redundant controller and providing feedback on the status information of the actuators.

[0023] As the core hub of the automotive electronic architecture, the central gateway has functions such as cross-domain communication, protocol conversion, data security, and network management.

[0024] like Figure 1 The above-described intelligent drive-by-wire chassis redundancy architecture enables redundancy in autonomous driving control, chassis control, braking, steering, communication, and power supply for autonomous driving functions. Specific safety redundancy schemes are as follows: (1) A dual ADS controller (ADS main controller and ADS safety controller) scheme is adopted. Under normal circumstances, the software algorithms of the ADS main controller and the ADS safety controller run synchronously and issue the same chassis lateral and longitudinal control commands simultaneously. The valid bit of the ADS main controller command is 1, and the valid bit of the ADS safety controller command is 0. The two ADS controllers interact with the chassis main controller through the ECAN1 communication link, and the two ADS controllers interact with the chassis redundant controller through the ECAN2 communication link. The ADS main controller and the ADS safety controller exchange internal information and conduct safety monitoring through Ethernet, and output effective control commands through information exchange and real-time monitoring.

[0025] (2) A dual chassis controller scheme (chassis central domain controller and chassis redundancy controller) is adopted. Among them, the chassis central domain controller is the main controller, and the chassis redundancy controller is the backup controller. The chassis central domain controller communicates with the ADS main controller and the ADS safety controller through ECAN1, and the chassis redundancy controller communicates with the ADS main controller and the ADS safety controller through ECAN2. The two chassis controllers communicate with the chassis actuators through VCAN1 and VCAN2, respectively. The two chassis controllers communicate and monitor each other through heterogeneous communication via CAN and serial ports. Through information exchange and real-time monitoring, it is ensured that the vehicle can still be safely controlled even if any chassis controller fails.

[0026] (3) A redundant chassis actuator scheme is adopted. The drive system adopts a redundant form with dual CAN and dual power supply. When the chassis domain control command is lost or the drive system fails to verify the validity of the control command, the drive system actively performs a torque cancellation action; the braking system adopts a main redundant full backup braking scheme. Both the main braking system and the backup braking system adopt a redundant form with dual CAN and dual power supply, and the two braking systems are interconnected through VCAN1 and VCAN2. In addition to performing braking tasks when the main braking system fails, the backup braking system can actively compensate for the lost braking force after judging that the main braking capacity is insufficient or the braking force is lost, so as to ensure braking safety and braking smoothness. In addition, if the braking system determines that the chassis domain control command is lost, it can actively apply braking force. Apply braking force to gently bring the vehicle to a stop; the steering system adopts a fully redundant scheme with dual motors or dual windings, including dual CAN, dual power supply, dual motors, dual electronic control, dual sensors, etc. When the chassis domain control command is lost and the autonomous driving mode is fully unmanned, the steering system maintains the angle at the last moment. If the autonomous driving mode is manned, the steering system switches to manual assistance mode; the EPB electronic parking brake system adopts a redundant form with dual CAN, dual power supply, and dual control boards. When the chassis domain control command is lost in the online control mode and the vehicle speed is zero, the EPB automatically executes parking until it is released by the switch, thus exiting the online parking state.

[0027] (4) A redundant low-voltage power supply scheme is adopted. Two independent low-voltage power supply systems are adopted. Each low-voltage power supply system includes a high-voltage to low-voltage DC-DC converter and a low-voltage battery. The two low-voltage power supply systems supply power to the main redundant system of the autonomous driving intelligent drive-by-wire chassis.

[0028] (5) A redundant communication architecture is adopted. The autonomous driving domain and the intelligent chassis domain use two communication links, ECAN1 and ECAN2. The intelligent chassis domain and the chassis actuator use two communication links, VCAN1 and VCAN2. The autonomous driving domain and the chassis actuator transmit information through two links, namely gateway forwarding and chassis controller forwarding, to ensure the integrity of all communication links after a single point of failure.

[0029] The intelligent drive-by-wire chassis redundancy architecture of this invention can meet the technical requirements of platformization and universality, and can quickly adapt to different levels of autonomous driving solutions. When facing high-level autonomous driving (L4 and above), this architecture can achieve the technical requirement of full redundancy. When the autonomous driving level is L3 and below, this architecture can achieve low-cost, non-redundant solution switching through quick plug-and-play. Based on the platform characteristics of this architecture, different levels of autonomous driving can be quickly switched by simply adding or removing the ADS safety controller, chassis redundancy controller, chassis redundancy actuator, and low-voltage power supply 2 (dashed box in the architecture diagram), while the entire electrical architecture remains unchanged, and the software interface can be quickly adapted through calibration.

[0030] This invention also provides a failure handling method for an intelligent drive-by-wire chassis, including analyzing failures of key components and main communication links of the intelligent drive-by-wire chassis and providing corresponding failure handling methods. Only a single fault is described here. Failures in this invention include, but are not limited to, system crashes, disconnections, signal verification errors, and signals exceeding normal ranges.

[0031] (1) Methods for handling failures of critical components The failure of key components in the redundant architecture of the intelligent drive-by-wire chassis, such as... Figure 2 As shown, the specific failure handling methods are as follows: ①ADS Master Controller Failure Handling: After the ADS safety controller detects the failure of the ADS master controller, its control command validity set is set to 1, and the system functions are degraded. The chassis central domain controller responds to the valid commands of the ADS safety controller to control the chassis actuators. The chassis redundancy controller acts as a backup for the chassis central domain controller and is responsible for control redundancy and safety monitoring. The chassis actuators respond to the control commands of the chassis central domain controller. The entire master-redundancy switchover is completed within 100ms.

[0032] ②ADS Safety Controller Failure Handling: After the ADS main controller detects a failure of the ADS safety controller, it continues to maintain the control command valid position 1 and issues a system alarm, but does not degrade the function. The chassis central domain controller responds to the valid commands of the ADS main controller and controls the chassis actuators. The chassis redundancy controller, as a backup of the chassis central domain controller, is responsible for control redundancy and safety monitoring. The chassis actuators respond to the control commands of the chassis central domain controller.

[0033] ③ Chassis Central Domain Controller Failure Handling: After the ADS main controller detects the failure of the chassis central domain controller, it continues to maintain the control command valid position 1, while degrading the system function. After the chassis redundant controller detects the failure of the chassis central domain controller, it takes over the control authority of the chassis and responds to the valid commands of the ADS main controller to control the chassis. The chassis actuators respond to the control commands of the chassis redundant controller. The switching time between the chassis central domain controller and the chassis redundant controller is completed within 100ms.

[0034] ④ Chassis Redundancy Controller Failure Handling: After the ADS main controller detects the failure of the chassis redundancy controller, it continues to maintain the control command valid position 1 and issues a system alarm, but does not degrade the function. The chassis central domain controller responds to the valid command of the ADS main controller and controls the chassis actuators. The chassis actuators respond to the control commands of the chassis central domain controller.

[0035] (2) Methods for handling failures of major communication links The communication link of the intelligent drive-by-wire chassis system fails, such as... Figure 3 As shown, the specific failure handling methods are as follows: ① Failure of the interaction link between the ADS main controller and the ADS safety controller: After the ADS main controller detects that it has lost contact with the ADS safety controller, it degrades the system's functions and sets the valid control command bits of both ADS controllers to 1. The chassis central domain controller responds to the valid control commands of the ADS main controller first. The chassis redundancy controller acts as a backup for the chassis central domain controller and is responsible for control redundancy and safety monitoring. The chassis actuators respond to the control commands of the chassis central domain controller.

[0036] ② Communication link failure between the chassis central domain controller and the two ADS controllers: After the ADS master controller detects the loss of connection with the chassis central domain controller, it degrades the system's functions and exchanges information with the ADS safety controller to transfer system control. The ADS safety controller sets the control command validity setting to 1. After the chassis central domain controller detects the loss of connection with the ADS controller, it exchanges information with the chassis redundancy controller and transfers chassis control. The chassis redundancy controller responds to the valid control commands of the ADS safety controller, and the chassis actuators respond to the control commands of the chassis redundancy controller. The transfer and switching of control authority between the ADS master controller and the ADS safety controller, as well as between the chassis central domain controller and the chassis redundancy controller, is completed within 100ms.

[0037] ③ Communication link failure between the chassis redundancy controller and the two ADS controllers: After the ADS main controller detects the loss of connection with the chassis redundancy controller, it will issue a system alarm, but will not degrade the function. The chassis central domain controller responds to the valid control commands of the ADS main controller, and the chassis actuators respond to the control commands of the chassis central domain controller. The chassis redundancy controller, as a backup chassis controller, is only responsible for the safety monitoring of the chassis central domain controller.

[0038] ④ Failure of the interaction link between the chassis central domain controller and the chassis redundant controller: After the chassis central domain controller detects that it has lost contact with the chassis redundant controller (both CAN and serial ports are invalid), it feeds back the result to the ADS main controller. The ADS main controller degrades the system's functions. The chassis central domain controller and the chassis redundant controller respond to the valid control commands of the ADS main controller at the same time. The chassis actuators respond to the control commands of the main CAN (VCAN1) first. The main braking system and the backup braking system have a braking anti-overlap function to avoid unexpected excessive braking.

[0039] ⑤ Communication link failure between chassis central domain controller and chassis actuator: After the chassis central domain controller detects the loss of connection with the chassis actuator, it feeds back the result to the ADS main controller and the chassis redundancy controller. The ADS main controller performs a safe shutdown of the system, the chassis redundancy controller responds to the valid control commands of the ADS main controller, and the chassis actuators respond to the control commands of the chassis redundancy controller. The entire failure control switching process is completed within 100ms.

[0040] ⑥ Communication link failure between chassis redundant controller and chassis actuator: After the chassis redundant controller detects that it has lost contact with the chassis actuator, it feeds back the result to the ADS main controller and the chassis central domain controller. The ADS main controller degrades the system function, the chassis central domain controller responds to the valid control commands of the ADS main controller, and the chassis actuators respond to the control commands of the chassis central domain controller.

[0041] This invention is applicable to different vehicle types, without distinguishing between passenger cars, commercial vehicles, special vehicles, etc.

[0042] The above are merely specific embodiments of the present invention, but the design concept of the present invention is not limited thereto. Any non-substantial modifications made to the present invention using this concept shall be considered as infringing upon the protection scope of the present invention.

Claims

1. A redundant architecture for an intelligent drive-by-wire chassis, characterized in that: It includes the ADS main controller, ADS safety controller, autonomous driving system sensors, chassis central domain controller, chassis redundancy controller, chassis actuators, low-voltage power supply 1, low-voltage power supply 2 and central gateway; The ADS main controller has complete functions for realizing autonomous driving; in addition to having complete functions for realizing autonomous driving, the ADS safety controller can also perform safety monitoring of the ADS main controller. When the ADS main controller fails or the ADS safety controller determines that the ADS main controller has an unexpected safety anomaly, it will take over the vehicle control authority and complete the safe parking of the vehicle; the chassis central domain controller has functions including basic functions, diagnostic protection and safety control. The basic functions include information interaction, modal management, state prediction and chassis cooperative control. In addition to basic functions, diagnostic protection, and safety control, the chassis redundancy controller also has the ability to monitor the chassis central domain controller. The chassis actuators include the drive system, main braking system, backup braking system, steering system, and EPB parking system, and are capable of responding to lateral and longitudinal control commands from the chassis central domain controller or chassis redundancy controller and providing feedback on actuator status information. The central gateway, as the core hub of the automotive electronic architecture, has functions including cross-domain communication, protocol conversion, data security, and network management. The redundancy scheme of the intelligent drive-by-wire chassis redundancy architecture includes: (1) adopting a dual ADS controller scheme. Under normal circumstances, the software algorithms of the two ADS controllers run synchronously and issue the same chassis lateral and longitudinal control commands at the same time. The valid bit of the ADS main controller command is 1, and the valid bit of the ADS safety controller command is 0. The two ADS controllers interact with the chassis main controller through ECAN1, and the two ADS controllers interact with the chassis redundancy controller through ECAN2. The two ADS controllers communicate internally and monitor safety through Ethernet. Effective control commands are output through information communication and real-time monitoring; (2) adopting a dual chassis controller. The scheme is as follows: the chassis central domain controller is the main controller, the chassis redundant controller is the backup controller, the chassis central domain controller interacts with the ADS main controller and the ADS safety controller through ECAN1, the chassis redundant controller interacts with the ADS main controller and the ADS safety controller through ECAN2, the two chassis controllers interact with the chassis actuators through VCAN1 and VCAN2 respectively, and the two chassis controllers interact with each other through heterogeneous communication and safety monitoring; (3) adopt a redundant chassis actuator scheme, in which the drive system adopts a dual-channel CAN and dual-power redundant form, when the chassis domain control command is lost If the drive system fails to validate the control command, it will actively initiate a torque cancellation action. The braking system employs a full-redundancy braking scheme, with both the main and backup braking systems using dual-channel CAN and dual-power redundancy. The two braking systems are interconnected via VCAN1 and VCAN2. In addition to performing braking tasks in case of main braking system failure, the backup braking system can actively compensate for lost braking force if the main braking capacity is insufficient or braking force is lost, ensuring braking safety and smoothness. The steering system uses a full-redundancy scheme with dual motors or dual windings, including dual-channel CAN, dual power supply, dual motors, dual electronic controls, and dual sensors. When the chassis domain control... If the command is lost and the autonomous driving mode is completely unmanned, the steering system will maintain the angle at the last moment. If the autonomous driving mode is manned, the steering system will switch to manual assistance mode. The EPB electronic parking brake system adopts a redundant form of dual CAN, dual power supply, and dual control board. When the chassis domain control command is lost in the online control mode and the vehicle speed is zero, the EPB will automatically execute parking until it is released by the switch and exits the online parking state. (4) A redundant low-voltage power supply scheme is adopted, including two independent low-voltage power supply systems. Each low-voltage power supply system includes a high-voltage to low-voltage DC-DC converter and a low-voltage battery. The two low-voltage power supply systems supply power to the main redundant system of the autonomous driving intelligent online control chassis.(5) A redundant communication architecture is adopted. The autonomous driving domain and the intelligent chassis domain use two communication links, ECAN1 and ECAN2. The intelligent chassis domain and the chassis actuators use two communication links, VCAN1 and VCAN2. Information is transmitted between the autonomous driving domain and the chassis actuators via two links: gateway forwarding and chassis controller forwarding.

2. The intelligent drive-by-wire chassis redundancy architecture as described in claim 1, characterized in that: The information interaction specifically involves receiving, sending, validating, determining disconnection status, filtering, unit conversion, and initializing input and output signals; the modal management specifically involves comprehensively managing autonomous driving mode, manual mode, controller mode, remote mode, and emergency stop mode, and selecting and outputting modal requests based on operating conditions and scenarios; the state prediction specifically involves estimating important parameters including vehicle state parameters and road environment information; the chassis collaborative control specifically involves comprehensively coordinating lateral and longitudinal control commands under different modes to ensure vehicle driving safety and tracking control accuracy; and the diagnostic protection specifically involves performing safety diagnostics on the control commands of the chassis central domain controller and the actual execution feedback and actual state of the chassis actuators.

3. The intelligent drive-by-wire chassis redundancy architecture as described in claim 1, characterized in that: The chassis redundancy controller specifically monitors the chassis central controller's safety by monitoring the chassis central domain controller's downtime status and control command output, and takes over and safely shuts down the chassis when it determines that the chassis central domain controller is down or the control output is abnormal.

4. The intelligent drive-by-wire chassis redundancy architecture as described in claim 1, characterized in that: When using a redundant chassis actuator scheme, if the braking system determines that the chassis domain control command has been lost, the backup braking system will actively apply braking force to gradually bring the vehicle to a stop.

5. A method for handling failures of an intelligent drive-by-wire chassis, based on the redundant architecture of an intelligent drive-by-wire chassis as described in claim 1, characterized in that: This includes methods for handling failures of critical components and major communication links; The specific failure handling methods for key components are as follows: S11, ADS main controller failure handling: After the ADS safety controller detects a failure of the ADS main controller, its control command validity setting is set to 1, and the system function is degraded. The chassis central domain controller responds to the valid commands of the ADS safety controller to control the chassis actuators. The chassis redundancy controller, as a backup of the chassis central domain controller, is responsible for control redundancy and safety monitoring. The chassis actuators respond to the control commands of the chassis central domain controller; S12, ADS safety controller failure handling: After the ADS main controller detects a failure of the ADS safety controller, it continues to maintain the control command validity setting at 1, and simultaneously issues a system alarm, but does not degrade the function. The chassis central domain controller responds to the valid commands of the ADS main controller to control the chassis actuators. The chassis redundancy controller, as a backup of the chassis central domain controller, is responsible for control redundancy and safety monitoring. Redundancy and safety monitoring are implemented. The chassis actuators respond to the control commands of the chassis central domain controller. S13, Chassis Central Domain Controller Failure Handling: After the ADS main controller detects the failure of the chassis central domain controller, it continues to maintain the control command valid position 1, while degrading the system functions. After the chassis redundancy controller detects the failure of the chassis central domain controller, it takes over the control authority of the chassis and responds to the valid commands of the ADS main controller to control the chassis. The chassis actuators respond to the control commands of the chassis redundancy controller. S14, Chassis Redundancy Controller Failure Handling: After the ADS main controller detects the failure of the chassis redundancy controller, it continues to maintain the control command valid position 1, while issuing a system alarm, but does not degrade the functions. The chassis central domain controller responds to the valid commands of the ADS main controller to control the chassis actuators, and the chassis actuators respond to the control commands of the chassis central domain controller. The main communication link failure handling methods are as follows: S21, ADS controller inter-controller communication link failure: After the ADS master controller detects the loss of connection with the ADS safety control, it degrades the system's function, and both ADS controllers set their control command valid bits to 1. The chassis central domain controller prioritizes responding to the valid control commands of the ADS master controller. The chassis redundant controller, as a backup of the chassis central domain controller, is responsible for control redundancy and safety monitoring. The chassis actuators respond to the control commands of the chassis central domain controller; S22, Chassis central domain controller and two ADS controller communication link failure: After the ADS master controller detects the loss of connection with the chassis central domain controller, it degrades the system's function and communicates with the ADS controllers. The DS safety controller transfers system control through information exchange. The ADS safety controller's control command validity setting is set to 1. After the chassis central domain controller detects the loss of connection with the ADS controller, it exchanges information with the chassis redundancy controller and transfers chassis control. The chassis redundancy controller responds to the valid control commands of the ADS safety controller, and the chassis actuators respond to the control commands of the chassis redundancy controller. S23, Communication link between the chassis redundancy controller and the two ADS controllers fails: After the ADS main controller detects the loss of connection with the chassis redundancy controller, it issues a system alarm but does not degrade functionality. The chassis central domain controller responds to the valid control commands of the ADS main controller, and the chassis actuators respond to the chassis central domain controller. The chassis redundancy controller acts as a backup chassis controller, only responsible for safety monitoring of the chassis central domain controller; S24, failure of the communication link between chassis controllers: After the chassis central domain controller detects the loss of connection with the chassis redundancy controller, it feeds back the result to the ADS main controller. The ADS main controller degrades the system's functions. The chassis central domain controller and the chassis redundancy controller simultaneously respond to the valid control commands of the ADS main controller. The chassis actuators prioritize responding to the control commands of the main CAN. The main braking system and the backup braking system have a braking anti-overlap function to avoid unexpected excessive braking; S25, failure of the communication link between the chassis central domain controller and the chassis actuators: After the chassis central domain controller detects a loss of connection with the chassis actuators, it feeds back the result to the ADS main controller and the chassis redundancy controller. The ADS main controller performs a safe shutdown of the system, the chassis redundancy controller responds to the valid control commands of the ADS main controller, and the chassis actuators respond to the control commands of the chassis redundancy controller; S26, Communication link between the chassis redundancy controller and the chassis actuators fails: After the chassis redundancy controller detects a loss of connection with the chassis actuators, it feeds back the result to the ADS main controller and the chassis central domain controller. The ADS main controller performs a function degradation of the system, the chassis central domain controller responds to the valid control commands of the ADS main controller, and the chassis actuators respond to the control commands of the chassis central domain controller.

6. The method for handling failures of an intelligent drive-by-wire chassis as described in claim 5, characterized in that: The switching time between the ADS main controller and the ADS security controller in S11 is completed within 100ms; the switching time between the chassis central domain controller and the chassis redundant controller in S13 is also completed within 100ms.

Images