An EMB system takeover control method for an intelligent driving scene, an EMB system and a vehicle

Abstract

The application provides an EMB system takeover control method, an EMB system and a vehicle in an intelligent driving scene, relates to the technical field of automobile braking, and ensures that the master control unit responds to a braking request only when communication is normal, there is no fault and both sides are ready for cooperation, thereby improving the safety of system starting; meanwhile, when the master control unit fails, the auxiliary control unit is not immediately passively taken over, but continuously verifies the EMC state of the master control through multiple cycles, effectively avoids misjudgment and mis-takeover caused by instantaneous communication jitter or signal interference, and significantly enhances the reliability and stability of system decision-making. Finally, when the master control fails, the auxiliary control timely and accurately takes over the braking function, thereby guaranteeing the continuous braking capability of the vehicle in the intelligent driving mode and meeting the stringent requirements of high-level automatic driving on functional safety. Therefore, the application realizes the orderly transition of the EMB system from normal operation to redundant takeover in the intelligent driving scene.

Description

Technical Field

[0001] This invention relates to the field of automotive braking technology, and in particular to an EMB system takeover control method, an EMB system, and a vehicle for intelligent driving scenarios. Background Technology

[0002] As the global automotive industry moves towards electrification, intelligence, connectivity, and sharing, intelligent driving technology is maturing, and automobiles are gradually evolving from traditional transportation tools into intelligent mobile terminals. Against this backdrop, Level 3 and above autonomous driving systems place higher demands on functional safety, making redundancy technology a key means to ensure reliable system operation. Most existing technologies improve system reliability and optimize diagnostic and response efficiency through the collaborative work of the main control unit and auxiliary control units. However, this approach primarily focuses on diagnostic communication mechanisms and lacks design for systematic takeover control strategies for typical intelligent driving scenarios. Furthermore, when the main controller experiences ECU failure or actuator malfunction, existing single-controller or simple redundancy solutions struggle to achieve safe and orderly braking function takeover, potentially leading to loss of vehicle braking capability and serious safety accidents. Summary of the Invention

[0003] This invention aims to solve the technical problems existing in the above-mentioned related technologies, and proposes an EMB system takeover control method, EMB system and vehicle for intelligent driving scenarios. When the main control unit fails, the auxiliary control unit can safely and reliably take over the driving or parking braking function through state interaction and multi-cycle verification between the main control and auxiliary control units, so as to ensure the continuous availability and functional safety of the braking system in intelligent driving scenarios.

[0004] The solution to the technical problem of this invention is as follows: This invention provides an EMB system takeover control method for intelligent driving scenarios, applied to an EMB system including a main control unit and an auxiliary control unit, the method comprising the following steps: When the EMB system is powered on and initialized, and the main control unit and auxiliary control unit communicate normally with the autonomous driving system and there is no controller or actuator failure, the EMC status of the main control unit and auxiliary control unit changes from unavailable to available. When receiving external request signals from the autonomous driving system, if the external request signal is a driving request or a parking request, the main control unit and the auxiliary control unit receive multiple cycles of request signals, and their EMC status synchronously changes from the available state to the ready state. The main control unit and the auxiliary control unit verify each other and confirm that the other has entered the ready state. Then, the main control unit responds to the corresponding braking request and its EMC state enters the active state. If the main control unit malfunctions during the process of responding to a braking request, the auxiliary control unit will take over the braking control after confirming that the EMC status of the main control unit is unavailable through multiple cycles of verification, and its EMC status will enter the active state.

[0005] Furthermore, the external request signals include driving requests and parking requests, and the method further includes: When the autonomous driving system stops sending driving or parking requests, if the main control unit is normal, the main control unit will no longer respond to braking requests, and its EMC status will change from active to deactivated. The EMC status of the auxiliary control unit will also change to deactivated simultaneously. If the auxiliary control unit takes over the control, the auxiliary control unit will no longer respond to the braking request after the request ends, and its EMC status will change from active to deactivated.

[0006] Furthermore, the method also includes mutual exclusion control logic, specifically including: when the service brake EMC is in an active state, the parking brake EMC must be deactivated and cannot issue a parking request; when the parking brake EMC is in an active state, the service brake EMC must be deactivated and cannot issue a driving request.

[0007] Furthermore, the main control unit maintains two independent communication links with the autonomous driving system, and the auxiliary control unit maintains two independent communication links with the autonomous driving system. If one of the communication links is lost during the process of issuing a driving request or parking request, the main control unit can still respond to the request and maintain the EMC active state. If both communication links are lost, the EMC status of both the main control unit and the auxiliary control unit will enter an unavailable state.

[0008] Furthermore, the main control unit and the auxiliary control unit maintain two independent communication links; If one of the communication links is lost during the process of the main control unit sending the EMC status signal, the main control unit can still respond to the request and maintain the EMC active state. If both communication links are lost, the EMC status of both the main control unit and the auxiliary control unit will enter an unavailable state.

[0009] Furthermore, the method also includes an arbitration order mechanism, specifically comprising: Real-time assessment of the service brake EMC status and parking brake EMC status of the auxiliary control unit; If the service brake EMC is active, the service brake status output is available. If the parking brake EMC is active, the parking brake status output is available. If neither the service brake EMC nor the parking brake EMC is activated, the output EMC braking status is unavailable.

[0010] Furthermore, the failure of the main control unit includes ECU failure or actuator servo cylinder failure.

[0011] Furthermore, during the power-on initialization phase of the EMB system, the main control unit and the auxiliary control unit need to complete the self-test of the communication link with the autonomous driving system, and only after confirming that the external communication status is normal and there are no ECU or actuator fault flags can the EMC status be changed from unavailable to available.

[0012] On the other hand, this application provides an EMB system for executing the aforementioned EMB system takeover control method for intelligent driving scenarios, the EMB system comprising: The main control unit is used to receive external requests and execute braking control. The auxiliary control unit is used to monitor the status of the main control unit and take over the braking control when the main control unit fails. The main control unit and the auxiliary control unit continuously interact with each other regarding EMC status, and execute takeover control logic based on external request signals, the EMC status of the main control unit, and the communication status between the main control and auxiliary control units.

[0013] On the other hand, this application provides a vehicle that includes the aforementioned EMB system.

[0014] The beneficial effects of this invention are as follows: This application provides an EMB system takeover control method for intelligent driving scenarios. Through a complete process of system power-on initialization self-test, multi-cycle synchronization requests, mutual calibration of main and auxiliary control unit states, and multi-cycle confirmation of takeover after a fault, it achieves an orderly transition of the braking system from normal operation to redundant takeover in intelligent driving scenarios. This method ensures that the main control unit only responds to braking requests when communication is normal, fault-free, and both parties are ready, improving the safety of system startup. Simultaneously, when the main control unit fails, the auxiliary control unit does not immediately and passively take over, but continuously verifies the EMC status of the main control unit over multiple cycles, effectively avoiding misjudgments and mistakeovers caused by instantaneous communication jitter or signal interference, significantly enhancing the reliability and stability of system decisions. Finally, when the main control unit fails, the auxiliary control unit promptly and accurately takes over the braking function, ensuring the vehicle's continuous braking capability in intelligent driving mode and meeting the stringent functional safety requirements of high-level autonomous driving. This application also provides a corresponding EMB system and vehicle. The beneficial effects of the EMB system and vehicle are the same as those of the above method, and will not be elaborated upon here.

[0015] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the description, claims and drawings. Attached Figure Description

[0016] The accompanying drawings are provided to further understand the technical solutions of the present invention and constitute a part of the specification. They are used together with the embodiments of the present invention to explain the technical solutions of the present invention, and do not constitute a limitation on the technical solutions of the present invention.

[0017] Figure 1 This is a flowchart of the sleep control method of the EMB control system provided in this application. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0019] The present application will be further described below with reference to the accompanying drawings and specific embodiments. The described embodiments should not be considered as limitations on the present application, and all other embodiments obtained by those skilled in the art without inventive effort are within the scope of protection of the present application.

[0020] In the following description, references are made to “some embodiments,” which describe a subset of all possible embodiments. However, it is understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0021] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0022] Currently, the global automotive industry is undergoing profound transformation, with electrification, intelligentization, connectivity, and sharing deeply converging and driving the evolution of automobiles from traditional mechanically driven transportation tools to highly intelligent mobile terminals. In this transformation, intelligent driving technology, as a core development direction, has gradually moved from assisted driving (L1-L2) to conditional automated driving (L3) and even highly automated driving (L4-L5). With the advancement of automated driving levels, the driving role of the vehicle is shifting from the human driver to the vehicle's own control system. At L3 and above, the system needs to independently complete all dynamic driving tasks under specific conditions and take over when necessary.

[0023] This shift places unprecedented demands on the functional safety of critical vehicle systems. According to the ISO 26262 functional safety standard, high-level automated driving systems must possess extremely high reliability to ensure that the vehicle remains in a "Minimum Risk State" (MRS) even in the event of a primary system failure, preventing dangerous events such as collisions and loss of control. Therefore, redundancy design has become a core technological approach to ensuring system safety. Redundancy technology involves configuring backup systems or components for critical functions, allowing the backup system to take over when the primary system fails, thereby ensuring the continuous availability of vehicle functions.

[0024] In intelligent driving vehicles, the braking system is one of the most crucial actuators for achieving vehicle deceleration, stopping, and dynamic control. Traditional hydraulic braking systems (such as ESP / ESC) rely on complex hydraulic lines and vacuum assistance, and their response speed and control precision are insufficient to meet the demands of advanced intelligent driving. Electromechanical Brake (EMB), as a brake-by-wire technology, eliminates traditional hydraulic lines and mechanical connections. It directly controls the motor-driven brake pads on each wheel via electronic signals, offering significant advantages such as fast response speed, high control precision, high integration, and ease of functional expansion. It is considered an ideal braking solution for future intelligent electric vehicles.

[0025] However, as an "all-electric" system, the EMB system is extremely vulnerable to malfunctions in its controller (ECU) and actuators, which could lead to a complete loss of braking capability and pose a significant safety risk. Therefore, the EMB system must employ a highly reliable redundant architecture. The current mainstream redundancy solution is a dual-controller architecture, consisting of a master control unit (Master Control Unit) and a slave / redundant control unit (Slave / Redundant Control Unit), which function as backups for each other. When the master control unit is functioning normally, it is responsible for executing braking commands; when the master control unit fails, the slave control unit should be able to detect the failure promptly and take over control to ensure uninterrupted braking.

[0026] In existing technologies, control systems employing a redundant architecture consisting of a main control unit and an auxiliary control unit already exist. For example, patent CN117008575A discloses a diagnostic information control method for a redundant control system. This method improves diagnostic efficiency and shortens response time by setting master chips in both the main and auxiliary control units and using a single diagnostic ID to achieve synchronous diagnosis of the two chips. Furthermore, it reduces maintenance frequency by pre-setting replacement cycles. These technical solutions primarily focus on optimizing diagnostic communication within the redundant system, achieving a basic dual-controller structure and integrated diagnostic functions. Some systems also employ a dual communication link design to improve communication reliability, but in terms of functionality, the core remains the independent operation of the main controller. The auxiliary controller often exists as a passive backup, only activating and taking over after the main controller completely fails, lacking proactive and deep state coordination and control logic interaction.

[0027] Existing technologies suffer from several key shortcomings, making it difficult to meet the stringent functional safety requirements of advanced autonomous driving systems (EMBs). First, they primarily focus on diagnostic efficiency, lacking systematic takeover control strategies for specific autonomous driving scenarios such as driving and parking, thus failing to achieve refined state management and mode switching. Second, fault detection mechanisms are simplistic, often employing a "one-off" approach, lacking multi-cycle verification and continuous monitoring of the main control unit's state. This makes them susceptible to false takeovers due to momentary communication interference or missed faults due to physical failures of actuators (such as servo cylinders). Third, the lack of continuous interaction and mutual verification mechanisms for multi-level EMC states (such as available, ready, activated) between the main and auxiliary control units may lead to state asynchrony and control conflicts. Furthermore, existing solutions do not adequately consider the fault tolerance of communication links; the loss of a single link may directly terminate the function, reducing system availability. Additionally, the lack of mutual exclusion control logic between driving and parking modes and an arbitration mechanism for the final state poses a risk of control chaos due to multiple concurrent requests. Finally, the system initialization process is incomplete. It does not clearly require that the system can only enter the working state after communication is normal, there are no faults, multiple periodic synchronization requests are made, and the master and slave control systems have successfully calibrated each other. As a result, the overall security and reliability are insufficient.

[0028] To address the aforementioned issues, this application proposes an EMB system takeover control method for intelligent driving scenarios. Its core lies in constructing a complete, layered, and highly robust redundant control architecture. This technology achieves refined state management by continuously exchanging multi-level EMC status signals (including unavailable, available, ready, activated, and deactivated) between the main and auxiliary control units, combined with external request signals, the main-auxiliary control communication status, and the Highly Automated Driving (HAD) system communication status for comprehensive judgment. After power-on, the system must complete an initialization self-test, entering the "available" state only when communication is normal and fault-free. Upon receiving a driving or parking request, the main and auxiliary control units must simultaneously enter the "ready" state and confirm their collaborative readiness through mutual verification before the main control can respond to the request and enter the "activated" state, ensuring the safety of control initiation. When the main control experiences an ECU or actuator failure during operation, the auxiliary control does not immediately take over. Instead, it continuously verifies the main control's EMC status over multiple cycles, only taking over the braking function after confirming a genuine failure, effectively avoiding malfunctions caused by momentary interference. Meanwhile, the system is designed with a dual communication link fault tolerance mechanism, which can maintain functionality when a single link is lost and exit only when both links are interrupted, thus improving system availability. It also introduces a mutual exclusion control and arbitration command mechanism for driving and parking modes to ensure that only one braking mode is activated at any given time, and finally outputs a unified and clear EMC status, which comprehensively protects the safety, reliability and controllability of the braking system under intelligent driving conditions.

[0029] First, the EMB system takeover control method for intelligent driving scenarios provided in this application will be described in detail below with reference to the accompanying drawings. This method is applied to an EMB system including a main control unit and an auxiliary control unit.

[0030] Reference Figure 1 The implementation process of the EMB system takeover control method for intelligent driving scenarios provided in this application embodiment includes, but is not limited to, the following steps.

[0031] Step S110: Power on and initialize the EMB system. When the main control unit and auxiliary control unit communicate normally with the autonomous driving system and there is no controller or actuator failure, the EMC status of the main control unit and auxiliary control unit changes from unavailable to available.

[0032] Step S110 defines the initial self-test and state establishment process of the EMB system after the vehicle is powered on and started. After the system is powered on, the main control unit and the auxiliary control unit first perform internal self-diagnostics and simultaneously check whether the communication link with the high-level automated driving system (HAD) is successfully established and whether data interaction is normal. At the same time, the two control units also need to confirm that there are no hardware or software fault indicators in themselves and related actuators (such as servo motors, pressure-building mechanisms, etc.). Only when all the above conditions—that is, normal communication with HAD, no ECU faults, and no actuator faults—are met simultaneously, will the main control and auxiliary control units change their EMC (electromechanical control) status from the initial "unavailable" to "available". This mechanism ensures that the system only enters the working state when the basic operating conditions are met, preventing erroneous responses to subsequent requests when communication is interrupted or potential faults exist, and laying the foundation for the safe operation of the entire takeover control logic.

[0033] Step S120: Receive an external request signal from the autonomous driving system. When the external request signal is a driving request or a parking request, after the main control unit and the auxiliary control unit receive multiple cycles of request signals, their EMC status synchronously changes from the available state to the ready state.

[0034] In step S120, when the EMB system receives an external request signal from the HAD system, and the signal is clearly a "driving request" or "parking request," the main control unit and the auxiliary control unit will continuously listen for and receive the request signal. The system requires that the request signal be received continuously and stably for multiple communication cycles (e.g., 5 or 10 consecutive CAN message cycles) to eliminate the possibility of momentary signal interference or false triggering. Only after confirming that the request signal is continuously valid will the main control and auxiliary control units synchronously change their EMC status from "available" to "ready." This "multi-cycle confirmation" mechanism enhances the reliability of the system's judgment of external commands, avoids entering the preparation process due to brief signal jitter, and ensures the consistency of the dual-control system's status in subsequent operations through the synchronous transition of the main and auxiliary control units' states.

[0035] In step S130, the main control unit and the auxiliary control unit verify each other and confirm that both have entered the ready state. Then, the main control unit responds to the corresponding braking request and its EMC status enters the activated state.

[0036] In step S130, a collaborative verification and master control activation mechanism is implemented between the master control and auxiliary control units. After both units enter the "ready" state, the master control unit and the auxiliary control unit exchange status information through a dedicated communication link to perform mutual verification. The master control unit needs to confirm that the auxiliary control unit has indeed entered the "ready" state, and the auxiliary control unit also needs to confirm the status of the master control unit. Only when both units confirm that the other is in the "ready" state will the master control unit officially respond to the driving or parking braking request issued by the HAD system, begin to execute the braking control function, and upgrade its own EMC status from "ready" to "activated," signifying that the master control has officially taken over the braking task. This mutual verification mechanism ensures that the two key units in the redundant system reach a state consensus before entering the core control stage, improving the overall system coordination and safety.

[0037] In step S140, if the main control unit malfunctions during the process of the main control unit responding to the braking request, after the auxiliary control unit confirms that the EMC status of the main control unit is unavailable through multiple cycles of verification, the auxiliary control unit takes over the braking control and its EMC status enters the active state.

[0038] In step S140, when the main control unit is performing braking control (i.e., its EMC state is "active"), if it cannot continue to work normally due to ECU failure, actuator failure, or other reasons, it will update its EMC state to "unavailable" and broadcast it to the auxiliary control unit via the communication link. The auxiliary control unit continuously monitors the EMC state of the main control unit. Once it detects that the main control unit has become "unavailable," it will not immediately take over, but will initiate a multi-cycle verification mechanism to confirm that the main control unit's state remains "unavailable" for multiple consecutive communication cycles to rule out the possibility of temporary communication interruption or false status alarms. After completing the multi-cycle confirmation, the auxiliary control unit determines that the main control unit has truly failed, and then takes over the braking control function, switching its own EMC state from the current state (usually "ready" or "available") to the "active" state, thereby ensuring that the vehicle's braking capability is not interrupted and achieving safety redundancy.

[0039] In some embodiments of this application, the external request signals include driving requests and parking requests. The method further includes: when the autonomous driving system no longer sends driving requests or parking requests, if the main control unit is normal, the main control unit no longer responds to braking requests, and its EMC state changes from active state to deactivated state, and the EMC state of the auxiliary control unit changes to deactivated state simultaneously; if the auxiliary control unit takes over control, the auxiliary control unit no longer responds to braking requests after the request ends, and its EMC state changes from active state to deactivated state.

[0040] Specifically, when the intelligent driving task ends and the external request is withdrawn, the main control and auxiliary control units of the EMB system have an orderly exit mechanism. When the autonomous driving system (HAD) stops sending driving or parking requests, it indicates that the current intelligent driving braking task has ended and the system needs to exit the active state. If the main control unit is working normally at this time, it will stop responding to braking commands and change its EMC state from "active" to "deactivated". At the same time, the auxiliary control unit will also update its own EMC state to "deactivated" through the state synchronization mechanism, realizing the coordinated exit of the dual control system under the leadership of the main control unit. If a main control failure has occurred and the auxiliary control unit has taken over control, then after the request ends, the auxiliary control unit, as the current control subject, will stop responding to braking requests and autonomously change its EMC state from "active" to "deactivated", completing the safe exit from the redundancy mode. This mechanism ensures that regardless of whether the control is in the primary or secondary control, the system can exit the active state in a timely and orderly manner after the request ends, avoiding the safety hazards caused by the continuous activation of the braking function, while maintaining the consistency of the primary and secondary control states, and providing a clear and controllable exit path for the system to re-enter the working state or enter the standby mode.

[0041] In some embodiments of this application, the method further includes mutual exclusion control logic, specifically including: when the service brake EMC is in an active state, the parking brake EMC must be deactivated and cannot issue a parking request. When the parking brake EMC is in an active state, the service brake EMC must be deactivated and cannot issue a driving request.

[0042] Specifically, the mutual exclusion control logic between the service braking and parking braking modes aims to prevent control conflicts or functional malfunctions caused by the simultaneous activation of both braking requests. When the system detects that the service braking EMC is active, it will force the parking braking EMC to deactivate and prohibit issuing new parking requests, ensuring that the parking braking function is not accidentally triggered during vehicle operation. Conversely, when the parking braking EMC is active, the service braking EMC must deactivate and cannot issue driving requests, preventing accidental activation of the service braking during parking operations. This mutual exclusion mechanism, through state linkage and request disabling, ensures that only one braking mode is active at any given time, effectively isolating the control logic of the two different operating conditions of driving and parking, improving system safety and control determinism, and preventing actuator malfunctions or control command conflicts caused by multi-mode concurrency.

[0043] In some embodiments of this application, two independent communication links are maintained between the main control unit and the autonomous driving system, and between the auxiliary control unit and the autonomous driving system. If one of the communication links is lost during the issuance of a driving request or parking request, the main control unit can still respond to the request and maintain the EMC active state. If both communication links are lost, the EMC state of both the main control unit and the auxiliary control unit will enter an unavailable state.

[0044] Specifically, a dual-redundant communication architecture was constructed to achieve high availability and fault tolerance for receiving commands from the Autonomous Driving System (HAD). The main control unit and the auxiliary control unit each maintain two independent communication links with the HAD system, forming physical or logical redundancy. During driving or parking requests, if one communication link is lost due to interference, disconnection, or other reasons, the system can still continuously receive HAD commands through the other normal link. The main control unit can continue to respond to braking requests and maintain EMC activation, ensuring that the intelligent driving function is not interrupted due to a single point of communication failure, thus improving the system's robustness and continuous operation capability. However, if both communication links are lost, it indicates that the EMB system is completely unable to obtain valid control commands from the HAD, posing a serious risk of communication failure. To ensure safety, the EMC status of both the main control unit and the auxiliary control unit immediately enters an "unavailable" state, proactively exiting the intelligent driving braking mode to avoid malfunctions in the absence of commands. This mechanism, through a tiered response strategy of "single-link failure sustains operation, dual-link failure only exits," ensures system availability while strictly adhering to the bottom line of functional safety.

[0045] In some embodiments of this application, the main control unit and the auxiliary control unit maintain two independent communication links. During the process of the main control unit issuing an EMC status signal, if one of the communication links is lost, the main control unit can still respond to requests and maintain the EMC active state; if both communication links are lost, the EMC status of both the main control unit and the auxiliary control unit enters an unavailable state.

[0046] Specifically, by establishing two independent communication links between the main control unit and the auxiliary control unit, the reliability of internal state information exchange within the redundant control system is enhanced. The main control unit continuously sends its EMC status signals (such as available, ready, active, unavailable, etc.) to the auxiliary control unit through these two links, enabling the auxiliary control unit to monitor the main control unit's operating status in real time. When one communication link fails or is interrupted, the system can still transmit EMC status signals through the other normal link, and the auxiliary control unit can still obtain the main control unit's status. Therefore, the main control unit can continue to respond to braking requests and maintain its EMC active state, and the system function is unaffected, demonstrating the fault tolerance capability of internal communication. However, if both links are lost, the main control and auxiliary control units completely lose their state synchronization capability. The auxiliary control unit cannot confirm whether the main control unit is normal, posing a safety hazard of undetected main control unit failure. In this case, to ensure the overall safety of the system, the EMC status of both the main control unit and the auxiliary control unit is set to "unavailable," actively exiting the intelligent driving braking mode to prevent the risk of loss of control due to complete communication interruption. This mechanism ensures high reliability of status monitoring between the master and slave controllers and adopts a conservative strategy under extreme failure conditions, balancing system availability and functional safety.

[0047] In some embodiments of this application, the method further includes an arbitration command mechanism, specifically including: real-time determination of the service brake EMC status and parking brake EMC status of the auxiliary control unit; if the service brake EMC is active, the service brake status is output as available; if the parking brake EMC is active, the parking brake status is output as available; if neither the service brake EMC nor the parking brake EMC is active, the EMC braking status is output as unavailable.

[0048] Specifically, by introducing an arbitration command mechanism, the driving and parking braking states managed by the auxiliary control unit are uniformly judged and output to the outside world. The system monitors the driving and parking braking EMC states within the auxiliary control unit in real time and executes logical arbitration based on their activation status: when the driving braking EMC is active, the system outputs "driving braking status available," indicating that the vehicle is in driving braking control mode; when the parking braking EMC is active, the system outputs "parking braking status available," indicating that the vehicle is in parking braking control mode; if neither the driving nor parking braking EMC is active, the system outputs "EMC braking status unavailable," indicating that no intelligent driving-related braking functions are currently activated. This arbitration mechanism ensures that the system's externally presented state is clear, unique, and has clear priorities and mutual exclusivity, avoiding misjudgments by upper-level systems (such as HAD) caused by parallel output of multiple modes, providing reliable and consistent state feedback for vehicle control, and improving the stability and security of system integration.

[0049] In some embodiments of this application, a failure of the main control unit includes ECU failure or actuator servo cylinder failure.

[0050] Specifically, identifying the specific type of fault in the main control unit provides an accurate basis for determining when the system will trigger the redundancy takeover mechanism. Faults in the main control unit include not only hardware or software failures in its electronic control unit (ECU), such as processor malfunctions, program crashes, or memory errors leading to loss of control function, but also actuator failures directly related to braking execution, particularly critical physical faults such as the failure of servo cylinder pressure build-up. By including these two typical types of faults in the fault determination scope, the system can comprehensively identify possible failure modes of the main control unit at both the control and execution levels. This ensures that if the main control unit cannot effectively complete the braking task under any circumstances, the auxiliary control unit can be correctly triggered to enter the takeover process, thereby guaranteeing the continuity and safety of the braking function and improving the coverage integrity and practical response capability of the redundant system.

[0051] In some embodiments of this application, during the power-on initialization phase of the EMB system, the main control unit and the auxiliary control unit need to complete the self-test of the communication link with the autonomous driving system, and only after confirming that the external communication status is normal and there are no ECU or actuator fault flags can the EMC status be changed from an unavailable state to an available state.

[0052] Specifically, the EMB system's power-on initialization phase requires a safety verification process that clarifies the prerequisites for the main control unit and auxiliary control unit to enter the "available" state. After the system is powered on, the main and auxiliary control units must actively perform a self-check of the communication link with the Automated Autopilot (HAD) system, verifying whether the two independent communication links with HAD are properly connected and whether data transmission and reception are reliable, ensuring that the external control command reception channel is unobstructed. Simultaneously, the two control units must also complete internal self-diagnosis, confirming that their own ECUs have no hardware or software faults and checking that relevant actuators (such as servo cylinders) have no fault signs, eliminating potential functional problems. Only when the external communication status is normal and there are no ECU or actuator faults can the main and auxiliary control units change their EMC status from the initial "unavailable" to the "available" state. This mechanism establishes a strict entry threshold, ensuring that the system only enters a working state under safe conditions of reliable communication and intact hardware, effectively preventing the risk of starting with a fault or mistakenly entering subsequent control processes under abnormal communication conditions, laying a solid foundation for the reliable operation of the entire takeover control logic.

[0053] Secondly, this application provides an EMB system for executing the aforementioned EMB system takeover control method for intelligent driving scenarios. The EMB system includes: The main control unit (MCU) is used to receive external requests and execute braking control. Specifically, the MCU is the core control module of the EMB system under normal operating conditions. It is responsible for receiving external request signals (such as driving or parking braking requests) from the High-Level Automated Driving (HAD) system and executing corresponding braking control functions according to the instructions. Under normal communication, fault-free conditions, and permissible system status, the MCU leads the response and execution of braking tasks, pushing its EMC state to the active state, realizing direct control of vehicle braking, and is the main bearer of braking function in intelligent driving mode.

[0054] The auxiliary control unit (ADC) monitors the status of the main control unit (MCU) and takes over braking control in the event of MCU failure. Specifically, as a redundant backup of the MCU, its core responsibility is to continuously monitor the MCU's operational status, particularly its EMC status signals and communication health. When the MCU loses braking capability due to ECU failure or actuator malfunction, the ADC, after confirming the fault according to a preset multi-cycle verification mechanism, immediately takes over braking control, performs the same braking functions as the MCU, and activates its own EMC status. This ensures the vehicle retains continuous and reliable braking capability even in the event of MCU failure, achieving safety redundancy.

[0055] The main control unit and the auxiliary control unit continuously interact with each other regarding EMC status, and execute takeover control logic based on external request signals, the EMC status of the main control unit, and the communication status between the main control and auxiliary control units.

[0056] Specifically, the main control unit and the auxiliary control unit continuously exchange EMC status information (including multiple levels of status such as unavailable, available, ready, and activated) through two independent communication links to achieve status synchronization and mutual verification. The system comprehensively executes takeover control logic based on external request signals, the EMC status reported by the main control unit, and the communication status between the main and auxiliary control units. This mechanism ensures the consistency of the dual-control system's status and the reliability of its decisions at each stage, including initialization, preparation, activation, and fault takeover. Multiple conditional judgments prevent malfunctions, ensuring the safe, orderly, and controllable switching of the braking system in intelligent driving scenarios.

[0057] Furthermore, embodiments of this application provide a vehicle that includes the aforementioned EMB system.

[0058] In summary, the EMB system takeover control method, EMB system, and vehicle for intelligent driving scenarios provided in this application have the following technical effects.

[0059] This application embodiment achieves refined control throughout the entire lifecycle of the system, from power-on initialization, request response, state coordination to fault takeover, by constructing a dual-redundant architecture of main and auxiliary control and introducing a multi-level EMC state management mechanism. After power-on, the system must complete communication self-checks and fault diagnosis to ensure it only enters the "available" state under safe conditions. Through multi-cycle confirmation of external requests and execution of mutual verification between the main and auxiliary control units, the reliability of control startup and state consistency are guaranteed. When the main control unit is working normally, it dominates the braking response, improving system efficiency. When the main control unit loses function due to ECU failure or actuator malfunction, the auxiliary control unit seamlessly takes over after multi-cycle continuous verification, avoiding malfunctions caused by momentary interference and ensuring uninterrupted braking function. Simultaneously, the system adopts a dual communication link design, possessing single-link fault tolerance capabilities between the main control unit and HAD, and between the main control unit and auxiliary control unit, significantly improving communication reliability. By introducing mutually exclusive control logic for driving and parking modes, control conflicts caused by multi-mode concurrency are prevented. Furthermore, by using an arbitration command mechanism to output a unique and clear braking state, the system's coordination with the upper-level autonomous driving system is enhanced. While ensuring high availability, the overall solution strictly adheres to functional safety principles, effectively improving the braking reliability, system robustness, and operational safety of intelligent driving vehicles under complex operating conditions, and meeting the stringent requirements of L3 and above levels of autonomous driving for redundant control of critical execution systems.

[0060] In some alternative embodiments, the functions / operations mentioned in the block diagrams may not occur in the order shown in the operation diagrams. For example, depending on the functions / operations involved, two consecutively shown blocks may actually be executed substantially simultaneously, or the blocks may sometimes be executed in reverse order. Furthermore, the embodiments presented and described in the flowcharts of this application are provided by way of example to provide a more comprehensive understanding of the technology. The disclosed methods are not limited to the operations and logic flows presented herein. Alternative embodiments are contemplated in which the order of various operations is changed and sub-operations described as part of a larger operation are executed independently.

[0061] Furthermore, although this application is described in the context of functional modules, it should be understood that, unless otherwise stated, one or more of the functions and / or features may be integrated into a single physical device and / or software module, or one or more functions and / or features may be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding this application. Rather, given the properties, functions, and internal relationships of the various functional modules in the apparatus disclosed herein, the actual implementation of the module will be understood within the scope of ordinary skill of an engineer. Therefore, those skilled in the art can implement the application set forth in the claims using ordinary skill. It is also understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of this application, which is determined by the full scope of the appended claims and their equivalents.

[0062] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several programs to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0063] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequential list of executable programs for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, a program execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can retrieve and execute a program from or in conjunction with such a program execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can mean any means that can contain, store, communicate, propagate, or transmit a program for use by or in conjunction with a program execution system, apparatus, or device.

[0064] More specific examples (a non-exhaustive list) of computer-readable media include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Additionally, computer-readable media can even be paper or other suitable media on which programs can be printed, for example, by optically scanning the paper or other media, then editing, interpreting, or, if necessary, processing it in a suitable manner to obtain the program electronically, and then storing it in computer memory.

[0065] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable program execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0066] In the foregoing description of this specification, the reference to terms such as "one embodiment / implementation," "another embodiment / implementation," or "certain embodiments / implementations," etc., indicates that a specific feature, structure, material, or characteristic described in connection with an embodiment or example is included in an embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0067] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

[0068] The above is a detailed description of the preferred embodiments of the present invention. However, the present invention is not limited to the embodiments. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the present invention. All such equivalent modifications or substitutions are included within the scope defined by the claims of the present invention.

Claims

1. A method for EMB system takeover control in an intelligent driving scenario, characterized in that, Applied to an EMB system including a main control unit and an auxiliary control unit, the method includes the following steps: When the EMB system is powered on and initialized, and the main control unit and auxiliary control unit communicate normally with the autonomous driving system and there is no controller or actuator failure, the EMC status of the main control unit and auxiliary control unit changes from unavailable to available. When receiving external request signals from the autonomous driving system, if the external request signal is a driving request or a parking request, the main control unit and the auxiliary control unit receive multiple cycles of request signals, and their EMC status synchronously changes from the available state to the ready state. The main control unit and the auxiliary control unit verify each other and confirm that the other has entered the ready state. Then, the main control unit responds to the corresponding braking request and its EMC state enters the active state. If the main control unit malfunctions during the process of responding to a braking request, the auxiliary control unit will take over the braking control after confirming that the EMC status of the main control unit is unavailable through multiple cycles of verification, and its EMC status will enter the active state.

2. The EMB system takeover control method for intelligent driving scenarios according to claim 1, characterized in that, The external request signals include driving requests and parking requests, and the method further includes: When the autonomous driving system stops sending driving or parking requests, if the main control unit is normal, the main control unit will no longer respond to braking requests, and its EMC status will change from active to deactivated. The EMC status of the auxiliary control unit will also change to deactivated simultaneously. If the auxiliary control unit takes over the control, the auxiliary control unit will no longer respond to the braking request after the request ends, and its EMC status will change from active to deactivated.

3. The EMB system takeover control method for intelligent driving scenarios according to claim 1, characterized in that, The method also includes mutual exclusion control logic, specifically including: when the service brake EMC is in an active state, the parking brake EMC must be deactivated and cannot issue a parking request; when the parking brake EMC is in an active state, the service brake EMC must be deactivated and cannot issue a driving request.

4. The EMB system takeover control method for intelligent driving scenarios according to claim 1, characterized in that, The main control unit maintains two independent communication links with the autonomous driving system, and the auxiliary control unit maintains two independent communication links with the autonomous driving system. If one of the communication links is lost during the process of issuing a driving request or parking request, the main control unit can still respond to the request and maintain the EMC active state. If both communication links are lost, the EMC status of both the main control unit and the auxiliary control unit will enter an unavailable state.

5. The EMB system takeover control method for intelligent driving scenarios according to claim 1, characterized in that, The main control unit and the auxiliary control unit maintain two independent communication links; If one of the communication links is lost during the process of the main control unit sending the EMC status signal, the main control unit can still respond to the request and maintain the EMC active state. If both communication links are lost, the EMC status of both the main control unit and the auxiliary control unit will enter an unavailable state.

6. The EMB system takeover control method for intelligent driving scenarios according to claim 1, characterized in that, The method also includes an arbitration order mechanism, specifically including: Real-time assessment of the service brake EMC status and parking brake EMC status of the auxiliary control unit; If the service brake EMC is active, the service brake status output is available. If the parking brake EMC is active, the parking brake status output is available. If neither the service brake EMC nor the parking brake EMC is activated, the output EMC braking status is unavailable.

7. The EMB system takeover control method for intelligent driving scenarios according to claim 1, characterized in that, The main control unit malfunction includes ECU failure or actuator servo cylinder failure.

8. The EMB system takeover control method for intelligent driving scenarios according to claim 1, characterized in that, During the power-on initialization phase of the EMB system, the main control unit and the auxiliary control unit need to complete the self-test of the communication link with the autonomous driving system. Only after confirming that the external communication status is normal and there are no ECU or actuator fault flags can the EMC status be changed from unavailable to available.

9. An EMB system, characterized in that, An EMB system takeover control method for executing any one of claims 1 to 8 intelligent driving scenarios, wherein the EMB system comprises: The main control unit is used to receive external requests and execute braking control. The auxiliary control unit is used to monitor the status of the main control unit and take over the braking control when the main control unit fails. The main control unit and the auxiliary control unit continuously interact with each other regarding EMC status, and execute takeover control logic based on external request signals, the EMC status of the main control unit, and the communication status between the main control and auxiliary control units.

10. A vehicle, characterized in that, The vehicle includes the EMB system as described in claim 9.

Images