Smooth fault-tolerant takeover and degraded operation control method of electric power steering system

Abstract

The invention discloses a smooth fault-tolerant takeover and degraded operation control method for an electric power steering system, which relates to the technical field of automobile electric power steering control and comprises the following steps of: acquiring a homologous torque sensor signal, calculating a target power torque, and driving a double-power board and a double-motor winding to cooperatively output power. Judging whether the electric power steering system is in an abnormal working mode state or not; local self-inspection is executed, a multi-level verification process is started, a fault unit is locked, and a fault isolation instruction is output; cutting off a control channel and power supply of a fault unit, starting a virtual torque buffer at the same time, and performing slope gradual change control on a current instruction output to a normal side power board; and acquiring a corresponding amplitude limiting proportion value, performing amplitude limiting processing on a current instruction output to a normal side power board, driving a normal side motor winding to output degradation assisting power, and transmitting fault information to a whole vehicle control unit ECU at the same time. According to the invention, power-assisted output is smoothly switched from double-winding cooperation to single-winding independent.

Description

Technical Field

[0001] This invention relates to the field of automotive electric power steering control technology, and in particular to a smooth fault-tolerant takeover and degraded operation control method for an electric power steering system. Background Technology

[0002] With the development of automotive intelligence and electrification, electric power steering (EPS) systems are gradually replacing traditional hydraulic power steering systems, becoming the mainstream configuration for modern passenger cars and intelligent driving vehicles. This system provides steering assistance through an electric motor drive mechanism, not only reducing energy consumption but also enabling advanced driver assistance functions such as variable power assist, active self-centering, and lane keeping. However, in practical applications, the safety and reliability of EPS systems remain key design considerations. Since the system typically consists of a control board, power module, and motor, its operation involves multiple layers of control logic, including signal acquisition, torque calculation, and power output. A single point of failure in any module can lead to power assist interruption or even steering failure. To address this issue, the industry has proposed various redundant architecture solutions, including a single control board single-motor architecture, a dual-motor redundancy scheme, and a dual-controller single-motor scheme. The former has a simple structure but poor fault tolerance; the latter two, while improving system reliability to some extent, suffer from high cost, large size, control switching delays, and momentary power assist interruptions, especially in high-speed or sharp-turn scenarios, where the smoothness and continuity of power assist output cannot be guaranteed. Furthermore, existing redundancy control systems mostly employ a "fault-based switchover" logic, lacking predictive and smooth takeover mechanisms before fault evolution, making it difficult to achieve truly seamless fault tolerance and degradation control. Therefore, how to maintain high system safety while simultaneously considering real-time performance, smoothness, and cost control has become a key challenge in the technological evolution of electric power steering systems.

[0003] CN106020078B discloses a redundancy controller circuit for a dual-redundant steering system, belonging to the field of automotive electrical control technology. The circuit consists of a first, second, and third sub-controller. The first and second sub-controllers have identical structures and are used to control one motor in the dual-redundant steering system, achieving fault isolation through mutual monitoring. The third sub-controller supervises and manages the first two, cutting off signal transmission to the other sub-controller when a fault is detected in any of them, preventing accidental disconnection. The three sub-controllers communicate and monitor each other through a redundant drive-by-wire network, thereby improving system safety and reliability while ensuring basic steering functionality. This technical solution can maintain the system's steering capability even in the event of a single-path fault, improving the fault tolerance of the steering control system. However, the redundancy mechanism of this solution mainly relies on a "fault detection-cutoff-switching" logic flow, which is still a passive fault-tolerance method and lacks a smooth control mechanism for the power assist output process. While it can maintain single-motor operation even after a control unit or power module failure, the switching process suffers from intermittent power assist and sudden torque changes, resulting in inconsistent driving feel and failing to meet the real-time and comfort requirements of intelligent driving and advanced steering assistance systems. Furthermore, the solution lacks an adaptive limiting strategy for different vehicle speeds and power assist demands, hindering dynamic power assist matching and safe output adjustment under degraded operating conditions, thus limiting the system's applicability in complex driving situations.

[0004] Existing electric power steering technologies generally suffer from problems such as redundancy switching delays, sudden power assist changes, and unsmooth degraded operation. To address these shortcomings, this invention proposes a smooth fault-tolerant takeover and degraded operation control method for electric power steering systems, effectively solving problems such as unsmooth fault-tolerant takeover, inconsistent degraded output, and sudden power assist changes in existing redundant steering systems. Summary of the Invention

[0005] The purpose of this section is to outline some aspects of the embodiments of the present invention and to briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section, as well as in the abstract and title of the present application, to avoid obscuring the purpose of this section, the abstract and title of the invention. Such simplifications or omissions shall not be used to limit the scope of the present invention.

[0006] In view of the problems of unsmooth fault-tolerant takeover, discontinuous power assist output, and insufficient stability of degraded operation in existing electric power steering systems during redundancy switching, this invention is proposed.

[0007] Therefore, the problem to be solved by this invention is how to achieve smooth fault-tolerant takeover and adaptive degradation control of the electric power steering system under a dual-control redundancy architecture, so as to improve the safety and steering continuity of the system under fault conditions.

[0008] To solve the above-mentioned technical problems, the present invention provides the following technical solution: This invention provides a method for smooth fault-tolerant takeover and degraded operation control of an electric power steering system, comprising: The two control boards perform hardware self-test and program loading respectively, synchronously collect signals from the same torque sensor, calculate the target assist torque, drive the dual power board and dual motor windings to output assist, and exchange working status parameters and control commands through CAN-FD bus to monitor each other and determine whether the electric power steering system is in an abnormal working mode. Based on the abnormal operating mode state, the dual control boards perform local self-tests, initiate multi-level verification processes to lock the faulty unit, and output fault isolation commands. Based on the fault isolation command, the normal side control board cuts off the control channel and power supply of the faulty unit, and at the same time activates the virtual torque buffer to perform ramp-gradual control on the current command output to the normal side power board. Based on the real-time vehicle speed query, the preset vehicle speed limit ratio mapping relationship is obtained, the corresponding limit ratio value is obtained, the current command output to the normal side power board is limited, the normal side motor winding output is driven to reduce the power output, and the fault information is transmitted to the vehicle control unit (ECU).

[0009] As a preferred embodiment of the smooth fault-tolerant takeover and degraded operation control method for the electric power steering system of the present invention, wherein: the method for obtaining and processing the limiting ratio value is as follows: Based on the single-winding independent power assist working mode, the vehicle speed signal is received from the vehicle control unit (ECU), the real-time vehicle speed signal is digitally filtered, and the filtered vehicle speed signal is used as the real-time vehicle speed value. The system queries a preset speed-limit ratio mapping table based on the real-time vehicle speed value to determine the speed range to which the real-time vehicle speed value belongs, and reads the steering wheel angle signal and steering wheel angular velocity signal. The working condition compensation coefficient is obtained by querying the preset working condition compensation coefficient table based on the absolute value of the steering wheel angle signal and the absolute value of the steering wheel angular velocity signal. Multiply the limiting ratio value by the operating condition compensation coefficient to obtain the final limiting ratio value, and calculate the limiting current threshold based on the rated maximum current of the normal side motor winding and the final limiting ratio value. Calculate the original current command value in the degraded mode and determine whether the original current command value is greater than the limiting current threshold.

[0010] Compared with existing technologies, the advantages of this invention are as follows: By exchanging working status parameters in real time and executing multi-level verification processes through dual control boards, the faulty unit can be accurately located and the fault channel can be quickly isolated, effectively avoiding system failure caused by fault propagation and improving the accuracy and response speed of fault diagnosis; By using a virtual torque buffer to perform ramp-gradient control on the output current command, a gradual current command sequence is generated based on the current snapshot before the fault, the target current after degradation, and the adaptive transition time parameters of vehicle speed, realizing a smooth and shock-free switch from dual-winding coordinated assistance to single-winding independent assistance, eliminating the sudden change in steering torque caused by the traditional hard switching method, and significantly improving the driver's handling perception and vehicle driving stability; By using a dynamic compensation algorithm to monitor the current tracking deviation in real time... The system calculates the incremental compensation current and performs feedforward compensation for tracking errors exceeding the threshold, effectively suppressing the current response lag caused by the reduced load capacity in the single-winding degraded operating mode, ensuring the speed and accuracy of the degraded power steering. By establishing a vehicle speed-limit ratio mapping relationship and introducing a working condition compensation coefficient for steering wheel angle and angular velocity, the system dynamically adjusts the current limit threshold and applies a rate of change constraint according to real-time driving conditions. This ensures the safe operation of the normal side winding within the rated current range in degraded mode, while also taking into account the differentiated matching of power steering requirements for different vehicle speeds and steering conditions. Under the premise of ensuring system reliability, the system maximizes the retention of power steering function, achieving the optimal balance between fault tolerance and performance degradation, and providing the driver with sufficient emergency control time window. Attached Figure Description

[0011] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein: Figure 1 A flowchart of a smooth fault-tolerant takeover and degraded operation control method for an electric power steering system; Figure 2 The system structure for a smooth fault-tolerant takeover and degraded operation control method for electric power steering systems. Detailed Implementation

[0012] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0013] Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without inventive effort should fall within the scope of protection of this invention.

[0014] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0015] As mentioned in the background section, while existing electric power steering systems possess a certain degree of fault tolerance under redundant control architectures, they generally rely on passive switching mechanisms after a fault occurs, lacking continuous and smooth control over the power steering output process. When the control unit or power module fails, the system experiences sudden torque fluctuations and short-term power steering interruptions during the "cut-off-switching" process, resulting in discontinuous driving feel and affecting vehicle handling and safety. Furthermore, existing degraded operation control often employs a fixed power steering output strategy, failing to adaptively adjust based on real-time vehicle speed and driving conditions. This makes it difficult to maintain reasonable steering assist matching while ensuring safety, reducing the system's reliability and comfort under complex operating conditions. To address these issues, this invention provides a smooth fault-tolerant takeover and degraded operation control method for electric power steering systems.

[0016] Reference Figures 1-2 , Figure 1 This is a flowchart illustrating a smooth fault-tolerant takeover and degraded operation control method for an electric power steering system according to an embodiment of the present invention. Figure 1 As shown, a smooth fault-tolerant takeover and degraded operation control method for an electric power steering system includes: S1: The two control boards perform hardware self-test and program loading respectively, synchronously collect signals from the same torque sensor, calculate the target assist torque, drive the dual power board and dual motor windings to output assist in a coordinated manner, and monitor and determine in real time whether the electric power steering system is in an abnormal working mode. S2: Based on the abnormal working mode state, the dual control boards perform local self-test, start a multi-level verification process to lock the faulty unit and output a fault isolation command. S3: Based on the fault isolation command, the normal side control board cuts off the control channel and power supply of the fault unit, and at the same time activates the virtual torque buffer to perform ramp-gradual control on the current command output to the normal side power board. S4: Based on the real-time vehicle speed query, the preset vehicle speed limit ratio mapping relationship is obtained, the corresponding limit ratio value is obtained, the current command output to the normal side power board is limited, the normal side motor winding output is degraded to assist, and the fault information is transmitted to the vehicle control unit ECU.

[0017] Preferred, such as Figure 2As shown, the redundant electric power steering system of this invention adopts a dual-path parallel, cross-monitoring architecture. Its core components and connections can be divided into four levels. In the signal acquisition layer, the driver torque / steering wheel angle sensor serves as the common signal source of the system, sending the acquired steering signals in parallel to the first control board MCU1 and the second control board MCU2. Simultaneously, the vehicle controller ECU provides real-time vehicle speed signals to the two control boards via the CAN bus. In the control and communication layer, the first control board MCU1 and the second control board MCU2 serve as equivalent processing cores, independently performing signal processing and torque calculation. Furthermore, they establish bidirectional real-time communication via the high-speed CAN-FD bus, continuously exchanging acquired data, calculation results, and system status parameters. This achieves strict synchronization and cross-monitoring. The drive and execution layers constitute the physical redundancy path of the system. The first power board PWB1 specifically receives instructions from the first control board MCU1 and independently drives the motor winding A, while the second power board PWB2 specifically receives instructions from the second control board MCU2 and independently drives the motor winding B. These two sets of power drives and motor windings are electrically and physically isolated from each other. At the vehicle interaction layer, when the system determines a fault and enters a degraded operation mode, the control board in normal working condition will report detailed fault information and system status to the vehicle controller ECU via the CAN bus, thereby triggering instrument panel warnings or activating vehicle-level safety strategies, completing a closed loop from internal system fault management to vehicle coordinated response.

[0018] In this embodiment of the application, step S1 includes: Specifically, the dual control boards include a first control board MCU1 and a second control board MCU2; the same torque sensor signals include the driver torque signal and the steering wheel angle signal; the dual power boards include a first power board PWB1 and a second power board PWB2; the dual motor windings include a dedicated drive motor winding A and a dedicated drive motor winding B; the operating status parameters include processor load, watchdog status, and instruction output frequency.

[0019] S1.1: The dual control boards execute the power-on initialization process, performing hardware self-tests on the core processor chip MCU, analog-to-digital converter ADC, power board driver chip interface, and motor winding connection interface.

[0020] Furthermore, the hardware self-test includes checking whether the chip's operating voltage is within the rated range, whether the memory CRC check passes, and whether the watchdog function is started normally; the two control boards store their respective self-test results in local registers and generate hardware status codes.

[0021] Furthermore, the first control board MCU1 and the second control board MCU2 establish a bidirectional communication connection through the CAN-FD bus, exchange hardware status codes and initialization results, and synchronously load pre-stored calibration parameters to verify the consistency of the calibration parameters. The calibration parameters include torque gain coefficient, vehicle speed compensation coefficient, damping coefficient, and current threshold range.

[0022] S1.2: Simultaneously acquire the driver torque signal and steering wheel angle signal output by the same torque sensor, and receive the vehicle speed signal from the vehicle control unit (ECU); It should be noted that the same torque sensor includes the driver torque sensor and the steering wheel angle sensor; Specifically, the first control board MCU1 records the acquired driver torque signal as the first driver torque raw value, the steering wheel angle signal as the first steering wheel angle raw value, and the vehicle speed signal as the first vehicle speed raw value; the second control board MCU2 records the acquired driver torque signal as the second driver torque raw value, the steering wheel angle signal as the second steering wheel angle raw value, and the vehicle speed signal as the second vehicle speed raw value.

[0023] S1.3: Exchange and collect data via CAN-FD bus, calculate the first target assist torque and the second target assist torque respectively, and calculate the relative deviation of the target assist torque; Furthermore, the first control board MCU1 calculates the first target assist torque based on the first driver torque raw value, the first steering wheel angle raw value, the first vehicle speed raw value, as well as the torque gain coefficient, vehicle speed compensation coefficient, and damping coefficient; the second control board MCU2 calculates the second target assist torque based on the second driver torque raw value, the second steering wheel angle raw value, the second vehicle speed raw value, as well as the torque gain coefficient, vehicle speed compensation coefficient, and damping coefficient.

[0024] Furthermore, the specific formula for the target assist torque is as follows: ; in, To provide torque to achieve the primary objective, The torque that assists the primary objective includes: ; in, For the vehicle's real-time speed, The damping coefficient is... The first torque gain coefficient, Input torque to the first driver, The first vehicle speed compensation coefficient, The first steering wheel angular velocity, This is the second torque gain coefficient. Input torque to the second driver, This is the second speed compensation coefficient. This is the second steering wheel angular velocity.

[0025] It should be noted that: the target assist torque (unit: N·m) is the collaborative output target value calculated synchronously by the dual MCUs; the torque gain coefficient (unit: dimensionless) is calibrated according to the vehicle model, ranging from 1.2 to 2.5, to match the driver's steering feel; the driver input torque (unit: N·m) is directly collected by the TSenser; the vehicle speed compensation coefficient (unit: N·m / (km·h·rad)) decreases with increasing vehicle speed, ranging from 0.01 to 0.05, to achieve stable steering characteristics at high speeds and light steering characteristics at low speeds; the real-time vehicle speed (unit: km / h) is provided by the vehicle ECU; the steering wheel angle (unit: rad) is converted to radians after being collected by the TSenser; the damping coefficient (unit: N·m·s / rad) suppresses steering oscillations, ranging from 0.8 to 1.5; and the steering wheel angular velocity (unit: rad / s) is calculated by differentiating the steering angle signal.

[0026] Specifically, the first control board MCU1 generates a first current command based on the first target assist torque and outputs the first current command to the first power board PWB1; the first power board PWB1 drives the three-phase winding of the dedicated drive motor winding A to output assist torque according to the first current command; the second control board MCU2 generates a second current command based on the second target assist torque and outputs the second current command to the second power board PWB2; the second power board PWB2 drives the three-phase winding of the dedicated drive motor winding B to output assist torque according to the second current command; the dedicated drive motor winding A and the dedicated drive motor winding B work together to output the total assist torque, which is stored in the data buffer area.

[0027] Preferably, the first control board MCU1 calculates the first relative deviation value between the first target assist torque and the second target assist torque; the second control board MCU2 calculates the second relative deviation value between the second target assist torque and the first target assist torque.

[0028] S1.4: Dual control boards monitor working status parameters and identify internal hardware and software faults of the control boards through real-time mutual monitoring and abnormal flag exchange mechanisms. Furthermore, the first control board MCU1 monitors its own first processor load, first watchdog state, and first instruction output frequency in real time, and sends the first operating status parameters to the second control board MCU2 via the CAN-FD bus; the second control board MCU2 monitors its own second processor load, second watchdog state, and second instruction output frequency in real time, and sends the second operating status parameters to the first control board MCU1 via the CAN-FD bus; the first power board PWB1 collects the first winding current of the dedicated drive motor winding A and feeds the first winding current back to the first control board MCU1; the second power board PWB2 collects the second winding current of the dedicated drive motor winding B and feeds the second winding current back to the second control board MCU2.

[0029] Furthermore, the dual control boards determine whether the processor load exceeds a preset load threshold, whether the watchdog state is reset, whether the command output frequency deviation exceeds a preset frequency deviation threshold, whether the target assist torque relative deviation exceeds a preset deviation threshold and whether the duration exceeds a preset duration threshold; when any of the above judgment conditions are met, the electric power steering system is marked as being in an abnormal working mode.

[0030] In an optional embodiment, if the processor load of the first control board MCU1 exceeds a preset load threshold of 80% or the processor load of the second control board MCU2 exceeds a preset load threshold of 80%, the electric power steering system is marked as being in an abnormal operating mode. If the watchdog timer state of the first control board MCU1 or the second control board MCU2 resets, the electric power steering system is marked as being in an abnormal operating mode. If the deviation of the command output frequency of the first control board MCU1 from the standard frequency of 100Hz exceeds a preset frequency deviation threshold of 5Hz, or the second control board MCU... 2. If the deviation of the command output frequency of the first control board MCU1 from the standard frequency of 100Hz exceeds the preset frequency deviation threshold of 5Hz, and the deviation lasts for more than 5ms, the electric power steering system is marked as being in an abnormal working mode. If the relative deviation between the first target assist torque and the second target assist torque exceeds the preset deviation threshold of 5%, and the relative deviation lasts for more than the preset duration threshold of 10ms, the electric power steering system is marked as being in an abnormal working mode. If any of the above judgment conditions are met, the normally functioning control board of the first control board MCU1 will mark the faulty control board as being in an abnormal state pending confirmation, and initiate a three-step fault confirmation process.

[0031] It should be noted that the three-step fault confirmation process includes a partial self-test, signal cross-comparison, and vehicle signal verification. The preset load threshold of 80% is set based on the real-time requirements and computational margin of the MCU processor. The MCU of the electric power steering system needs to complete signal acquisition, torque calculation, current control, and communication tasks within a 10ms control cycle. During normal operation, the processor load is maintained at 50%-70%, with a 30%-50% margin reserved to handle instantaneous fluctuations and interruptions. When the load consistently exceeds 80%, it indicates a possible program abnormality or peripheral failure in the MCU, and the real-time performance and accuracy of control commands cannot be guaranteed. Therefore, 80% is used as the critical threshold for anomaly detection. The preset frequency deviation threshold of 5Hz is set based on the EPS system's standard 100Hz control frequency and the continuity requirements of power steering. When the command output frequency deviation exceeds ±5Hz, the actual control cycle will deviate from the normal range of 10ms ± 0.5ms, resulting in uneven current loop sampling intervals, causing power steering torque fluctuations and steering wheel vibration. The 5Hz deviation threshold can tolerate short-term MCU jitter and can trigger fault detection in a timely manner when the control cycle is continuously abnormal. This threshold meets the tolerance requirements of the ISO 26262 functional safety standard for periodic tasks of real-time systems.

[0032] Preferably, the preset deviation threshold of 5% is set based on the consistency of dual MCU calculations and the accuracy of sensor acquisition. During normal operation, due to the accumulation of ADC quantization error (0.5%-1%), signal transmission delay, floating-point rounding error (0.1%-0.3%), and CAN-FD clock deviation, the relative deviation of the target torque calculated by the dual MCUs is usually 1%-3%. Setting the threshold to 5% can cover the accumulation of normal errors and also reserve about 2% safety margin to tolerate instantaneous interference. When the deviation exceeds 5%, it indicates that the acquisition or calculation process of at least one MCU is abnormal, and the fault confirmation process needs to be initiated. The preset duration threshold of 10ms is set based on the balance between the EPS system control cycle and the real-time performance of fault detection; a single deviation may be caused by instantaneous electromagnetic interference or communication conflict, requiring the deviation to last for more than 10ms (two consecutive control cycles) to effectively filter out occasional interference and avoid false triggering. Meanwhile, the 10ms decision window ensures that fault identification is completed and the confirmation process is initiated within 20ms, with the total response time controlled within 30-50ms, meeting the ISO 26262 standard requirement that the fault detection time for ASIL-D level systems be less than 100ms.

[0033] For example, after the system is powered on, the first control board MCU1 and the second control board MCU2 simultaneously start a self-test program to verify the chip voltage (which should be within the range of 4.75V-5.25V), memory integrity, and watchdog function. After the self-test passes, the two MCUs exchange status codes and load calibration parameters (such as torque gain coefficient 2.0 and vehicle speed compensation coefficient 0.03) via the CAN-FD bus. The two control boards synchronously acquire the 3.2 N·m driver torque signal, 45° steering wheel angle signal, and 60 km / h vehicle speed signal output by the torque sensor. The two control boards calculate the first target assist torque as 4.8 N·m, and the second target assist torque as 4.9 N·m for the second control board MCU2, with a relative deviation of 2.1% (below the 5% threshold). At this time, the processor load of the first control board MCU1 is 65%, and the instruction output frequency is 100 Hz, which is considered normal operating mode. If the load of the first control board MCU1 suddenly rises to 85% and lasts for 15 ms, it is marked as an abnormal operating mode and the fault confirmation process is initiated.

[0034] In this embodiment of the application, step S2 includes: S2.1: If the first control board MCU1 or the second control board MCU2 detects an abnormal working mode, the abnormal control board is marked as the faulty control board, and a local self-test process is started to mark the fault type. It should be noted that the control board without marked abnormalities is the normal side control board.

[0035] Specifically, the local self-test process includes: detecting the sampling accuracy error of the analog-to-digital converter (ADC), the operating voltage fluctuation range of the core processor, the CRC check result of the memory, and the number of CAN-FD bus communication error frames; detecting the on-state voltage drop of the field-effect transistors, the gate drive voltage, the power supply voltage range, and the temperature sensor readings of the corresponding power board; and detecting the phase-to-phase resistance, phase-to-phase inductance, back electromotive force coefficient, and three-phase current symmetry deviation of the corresponding motor windings.

[0036] In an optional embodiment, the fault-side control board determines whether the sampling accuracy error exceeds the full-scale accuracy threshold, whether the operating voltage fluctuation range exceeds the rated voltage fluctuation range, whether the memory CRC check result shows a checksum deviation, and whether the number of CAN-FD bus communication error frames exceeds a preset error frame threshold. When any of the above determination conditions are met, the fault-side control board marks the fault type as a control board hardware fault.

[0037] In an optional embodiment, the fault-side control board determines whether the on-state voltage drop of the field-effect transistor exceeds the normal on-state voltage drop range, whether the gate drive voltage is lower than the preset gate drive voltage threshold, whether the power supply voltage range exceeds the rated power supply voltage range, and whether the temperature sensor reading exceeds the preset temperature upper limit. When any of the above determination conditions are met, the fault-side control board marks the fault type as a power board hardware fault.

[0038] In an optional embodiment, the fault-side control board determines whether the phase-to-phase resistance value deviates from the nominal resistance value by more than a preset resistance deviation threshold, whether the phase-to-phase inductance value deviates from the nominal inductance value by more than a preset inductance deviation threshold, and whether the three-phase current symmetry deviation exceeds a preset symmetry deviation threshold. When any of the above determination conditions are met, the fault-side control board marks the fault type as a motor winding fault.

[0039] S2.2: Send the partial self-test results and fault type to the normal side control board, exchange the original collected data, calculate the relative deviation, and determine whether the relative deviation is less than the preset signal verification deviation threshold. It should be noted that relative deviation includes relative deviation of driver torque signal, relative deviation of steering wheel angle signal, and relative deviation of vehicle speed signal.

[0040] In an optional embodiment, the driver torque signal, steering wheel angle signal, and vehicle speed signal collected by the device are sent to the fault-side control board via the CAN-FD bus; the driver torque signal, steering wheel angle signal, and vehicle speed signal collected by the device are compared item by item with the signals sent by the normal-side control board, and the relative deviations of the driver torque signal, steering wheel angle signal, and vehicle speed signal are calculated; when the relative deviations of the driver torque signal, steering wheel angle signal, and vehicle speed signal are all less than the preset signal verification deviation threshold, the sensor signal is determined to be normal, and the fault type excludes sensor abnormality factors.

[0041] Specifically, when any one of the signals is greater than or equal to the preset signal verification deviation threshold, an auxiliary signal request command is sent to the vehicle control unit (ECU). The ECU receives the four-wheel speed signals, yaw rate signals, and brake pedal signals collected by the wheel speed sensors, calculates the vehicle speed signal verification deviation and the steering wheel angle verification deviation, and confirms whether the signal acquisition is abnormal or normal.

[0042] Furthermore, the average wheel speed value of the four wheel speed signals is calculated, and the average wheel speed value is compared with the vehicle speed signal collected by itself to calculate the vehicle speed signal whole-vehicle verification deviation; the expected steering wheel angle value is calculated based on the yaw rate signal and the vehicle speed signal, and the expected steering wheel angle value is compared with the steering wheel angle signal collected by itself to calculate the steering wheel angle whole-vehicle verification deviation; it is then determined whether the vehicle speed signal whole-vehicle verification deviation exceeds the preset whole-vehicle verification deviation threshold and whether the steering wheel angle whole-vehicle verification deviation exceeds the preset whole-vehicle verification deviation threshold.

[0043] Furthermore, if the vehicle speed signal deviation exceeds the preset vehicle deviation threshold or the steering wheel angle deviation exceeds the preset vehicle deviation threshold, the signal acquisition is confirmed to be abnormal, and the fault type is corrected to sensor signal abnormality. If both the vehicle speed signal deviation and the steering wheel angle deviation are less than the preset vehicle deviation threshold, the signal acquisition is confirmed to be normal, and the fault type is maintained as control board hardware fault, power board hardware fault, or motor winding fault. The final fault type sent by the faulty control board is received via the CAN-FD bus, and a three-step confirmation and verification process is executed. The three-step confirmation and verification process includes verifying the consistency of locally acquired data, verifying the abnormality of the working status parameters of the faulty control board, and requesting auxiliary signals from the vehicle control unit (ECU) for independent verification.

[0044] It should be noted that the preset vehicle calibration deviation threshold is set based on the principle of vehicle dynamics consistency and the accuracy of sensor measurements. This threshold needs to cover the reasonable difference between the average vehicle speed calculated from wheel speed signals and the vehicle speed collected by the EPS system under normal driving conditions, while also considering the physical correlation between yaw rate and steering wheel angle. Under typical operating conditions, the instantaneous deviation between the vehicle speed calculated from wheel speed and the vehicle speed received by the CAN bus is usually less than 3 km / h, while the dynamic deviation between the steering wheel angle estimated based on yaw rate and vehicle speed and the actual steering angle measured by the sensor is generally less than 5%. Therefore, the preset vehicle calibration deviation threshold is often set to a speed deviation ≤ 5 km / h and an angle deviation ≤ 8%, ensuring that signal anomalies can be effectively identified while avoiding misjudgments caused by noise or short delays. The vehicle calibration deviation of the steering wheel angle is based on the vehicle's two-degree-of-freedom dynamic model, and is obtained by inversely calculating the theoretical steering wheel angle from the yaw rate and real-time vehicle speed, and then comparing it with the sensor-collected values.

[0045] S2.3: The normal side control board locks the faulty unit based on the three-step verification results, determines the fault level, and generates a fault isolation command; Specifically, if all three verification results point to the first control board MCU1, the faulty unit is identified as the first control board MCU1; if all three verification results point to the first power board PWB1, the faulty unit is identified as the first power board PWB1; if all three verification results point to the dedicated drive motor winding A, the faulty unit is identified as the dedicated drive motor winding A; if all three verification results point to the second control board MCU2, the faulty unit is identified as the second control board MCU2; if all three verification results point to the second power board PWB2, the faulty unit is identified as the second power board PWB2; if all three verification results point to the dedicated drive motor winding B, the faulty unit is identified as the dedicated drive motor winding B; if the fault type is a control board hardware fault, a power board hardware fault, or a motor winding fault, the fault level is determined to be a Level 1 fault; if the fault type is an abnormal sensor signal and the vehicle speed signal calibration deviation or the steering wheel angle calibration deviation is less than the preset Level 2 fault deviation threshold, the fault level is determined to be a Level 2 fault.

[0046] Furthermore, if the fault level is Level 1, a fault isolation command is generated. This command includes an isolation target unit identifier, an isolation action type, and a switching time marker. The isolation target unit identifier points to the locked fault unit. The isolation action type includes a control channel cut-off command and a power supply cut-off command. The normal side control board sends the fault isolation command to the fault side control board via the CAN-FD bus and stores it in the local fault log. If the fault level is Level 2, a fault alarm command is generated. The current dual-control board dual-winding collaborative working mode is maintained, and the fault alarm command is reported to the vehicle control unit (ECU) via the CAN bus, increasing the monitoring frequency in subsequent control cycles.

[0047] S2.4: Confirmation of fault isolation command execution and status synchronization; Furthermore, after receiving the fault isolation command, the fault-side control board determines whether to cut off the control channel of its corresponding power board based on the isolation target unit identifier. When the isolation target unit identifier points to the first control board MCU1, the first power board PWB1, or the dedicated drive motor winding A, the first control board MCU1 stops outputting the first current command to the first power board PWB1 and sends a power board shutdown signal to turn off all MOSFET drive signals, cutting off the power supply to the dedicated drive motor winding A. When the isolation target unit identifier points to the second control board MCU2, the second power board PWB2, or the dedicated drive motor winding B, the second control board MCU2 stops outputting the second current command to the second power board PWB2 and sends a power board shutdown signal to turn off all MOSFET drive signals, cutting off the power supply to the dedicated drive motor winding B. The fault-side control board feeds back the isolation execution completion status to the normal-side control board via the CAN-FD bus. After receiving the isolation execution completion status, the normal-side control board initiates the redundancy switching process.

[0048] For example, if the first control board MCU1 is marked as faulty, it immediately performs a partial self-test: if the ADC sampling error reaches 0.8% (exceeding the 0.5% full-scale accuracy threshold) and the CAN-FD error frame count accumulates to 12 frames (exceeding the 10-frame threshold), it is determined to be a hardware fault of the control board; the second control board MCU2, as the normal side, receives the self-test result of the first control board MCU1, compares its own collected torque signal of 3.2 N·m with the 3.3 N·m collected by the first control board MCU1, and the relative deviation is 3.1% (less than the 5% verification threshold), thus ruling out sensor abnormality; then the second control board MCU2 requests wheel speed sensor data from the ECU, calculates the deviation between the average wheel speed of 59.8 km / h and its own vehicle speed signal of 60 km / h, and finds it to be 0.3% (less than the 2% vehicle verification threshold), thus confirming that the signal acquisition is normal. After three verification steps (local data consistency, abnormal operating parameters of the first control board MCU1, and independent verification of the ECU passed), the second control board MCU2 identified the faulty unit as the first control board MCU1, determined it to be a level one fault, and generated a fault isolation command including "isolate the first control board MCU1", "cut off the power supply of PWB1", and "time mark T0+25ms".

[0049] In this embodiment of the application, step S3 includes: S3.1: The normal side control board reads the current value output by the normal side power board and stores the current value as a current snapshot before the fault; at the same time, it reads the fault side current value output by the fault side control board before the fault occurred and calculates the total current of the dual windings working together. It should be noted that the current value is the actual drive current being output by the normal side motor winding at the moment the fault occurred; the current snapshot before the fault includes the instantaneous values ​​of the three-phase current; the total current of the dual windings working together is equal to the sum of the current value and the fault side current value; the normal side power board is either the first power board PWB1 or the second power board PWB2; the normal side motor winding is either the dedicated drive motor winding A or the dedicated drive motor winding B.

[0050] S3.2: Based on the total current of the dual-winding cooperative assistance, the target current after degradation is calculated in combination with the preset degradation coefficient. At the same time, the corresponding transition time parameter is obtained by querying the preset vehicle speed-transition time mapping table according to the real-time vehicle speed value. It should be noted that the preset degradation current calculation rules are queried based on the current driving condition parameters; the driving condition parameters include vehicle speed signal and steering wheel angle signal; the preset degradation coefficient is determined based on the ratio of the maximum carrying current of a single winding to the rated current of a dual winding; the transition time parameter is set to a longer time value under low-speed conditions and a shorter time value under high-speed conditions, and the range of the longer and shorter time values ​​is within the preset transition time interval.

[0051] S3.3: Based on the current snapshot before the fault, the target current after degradation, and the transition time parameters, start the virtual torque buffer and calculate the current change and current command slope; Furthermore, the virtual torque buffer determines the sign of the current change. When the target current after degradation is greater than the current snapshot before the fault, the current command slope is positive; when the target current after degradation is less than the current snapshot before the fault, the current command slope is negative.

[0052] Furthermore, a final cut-off command is sent to the fault-side control board via the CAN-FD bus, and the current command output to the fault-side power board is forced to zero. The fault-side power board receives the current command after it is reduced to zero and gradually reduces the drive current of the corresponding motor winding until the output stops completely. The fault-side control board sends a power board disconnect command to the fault-side power board, and the fault-side power board cuts off the main power supply channel to the fault-side motor winding. The normal-side control board monitors the power disconnect status feedback signal of the fault-side power board to confirm that the control channel and power supply of the fault unit are completely cut off.

[0053] It should be noted that the current change is equal to the target current after degradation minus the current snapshot before the fault; the current command slope is equal to the current change divided by the transition time parameter; the final cut-off command includes the command to immediately stop current output and the command to disconnect power board.

[0054] S3.4: Calculate the single-step current increment based on the current command slope and control cycle time. Using the current snapshot before the fault as the starting value, the single-step current increment is superimposed in each control cycle to generate a ramp-gradual current command sequence. Preferably, the single-step current increment is equal to the current command slope multiplied by the control cycle time; the ramp-gradient current command sequence contains multiple discrete current command values ​​that linearly transition from the pre-fault current snapshot to the target current after degradation; the virtual torque buffer assigns a corresponding output time marker to each current command value in the ramp-gradient current command sequence, and the output time marker corresponds one-to-one with the control cycle number.

[0055] S3.5: Extract the current command value corresponding to the current cycle from the ramp-variable current command sequence and output the current command value to the normal side power board; Specifically, the current command value is converted into a power board drive signal and output to the normal side power board to adjust the conduction time and conduction phase sequence of the field effect transistor; the normal side power board drives the normal side motor winding to output the actual current corresponding to the current command value; the actual output current of the normal side motor winding is collected through the current sampling resistor and fed back to the normal side control board.

[0056] It should be noted that the power board drive signals include pulse width modulation (PWM) duty cycle and switching frequency parameters.

[0057] S3.6: Calculate the current tracking deviation through the normal side control board and determine whether the absolute value of the current tracking deviation exceeds the preset current tracking deviation threshold. Specifically, when the absolute value of the current tracking deviation exceeds the preset current tracking deviation threshold, the normal-side control board initiates a dynamic compensation algorithm to calculate the compensation current increment. It then adds the compensation current increment to the current command value of the next control cycle to generate a compensated current command value, which is output to the normal-side power board. When the absolute value of the current tracking deviation is less than the preset current tracking deviation threshold, the normal-side control board maintains the normal output rhythm of the ramp-gradual current command sequence.

[0058] It should be noted that the current tracking deviation is equal to the current command value minus the actual output current; the compensation current increment is proportional to the current tracking deviation.

[0059] S3.7: Accumulate the number of control cycles that have been executed, calculate the transition process time, determine whether the transition process time has reached the transition time parameter, and at the same time determine whether the current output current command value has reached the target current after degradation. It should be noted that the transition process time is equal to the number of control cycles executed multiplied by the control cycle time; Furthermore, when the transition process time reaches the transition time parameter and the current command value reaches the target current after degradation, the normal side control board marks the smooth switching process as complete, the virtual torque buffer stops generating the ramp-gradient current command sequence, and switches to the single-winding independent assist working mode; in the single-winding independent assist working mode, the normal side control board continuously outputs the target current after degradation to the normal side power board, driving the normal side motor winding to provide steering assistance independently; the normal side control board reports the smooth switching completion status information to the vehicle control unit ECU via the CAN bus.

[0060] For example, after receiving the isolation command, the second control board MCU2 reads the current output of the second power board PWB2 (8.5A) as a snapshot before the fault, and simultaneously obtains the output of the first power board PWB1 (8.2A) before the fault, resulting in a total dual-winding current of 16.7A. Based on a degradation factor of 0.65, the target degradation current is calculated to be 10.9A (16.7A × 0.65). The vehicle speed-transition time mapping table is consulted, showing a transition time of 150ms for 60km / h. The virtual torque buffer calculates the current change as 2.4A (10.9A - ...). The current command slope is 16A / s (2.4A ÷ 0.15s), and the single-step increment is 0.16A (16A / s × 10ms control cycle). Starting from the pre-fault 8.5A, a ramp sequence is generated by adding 0.16A in each cycle: 8.66A, 8.82A, 8.98A... which are output sequentially to the second power board PWB2. When the actual output current of 8.70A deviates from the command of 8.66A by 0.04A, exceeding the 0.03A threshold, the dynamic compensation algorithm calculates a compensation increment of 0.04A and adds it to the command of the next cycle. After 15 control cycles (150ms), the current smoothly reaches the target value of 10.9A, and the second control board MCU2 marks the switching as complete and switches to the single-winding independent boost mode.

[0061] In this embodiment of the application, step S4 includes: It should be noted that in the speed limit ratio mapping relationship, the speed limit ratio value corresponding to the low speed range is higher than the speed limit ratio value corresponding to the high speed range; after receiving fault information, the vehicle controller triggers the instrument panel to display a fault prompt.

[0062] S4.1: Based on the single-winding independent power assist working mode, the vehicle speed signal is received from the vehicle control unit (ECU), the real-time vehicle speed signal is digitally filtered, and the filtered vehicle speed signal is used as the real-time vehicle speed value. It should be noted that the digital filtering process includes removing abnormal values ​​of sudden speed changes and smoothing speed fluctuation noise; the update frequency of the real-time speed value is synchronized with the control cycle time; it determines whether the real-time speed value is within the effective speed range, and when the real-time speed value exceeds the effective speed range, the speed value of the previous control cycle is used as the current real-time speed value.

[0063] S4.2: Based on the real-time vehicle speed value, query the preset vehicle speed-limit ratio mapping table to determine the vehicle speed range to which the real-time vehicle speed value belongs, and read the steering wheel angle signal and steering wheel angular velocity signal: It should be noted that the vehicle speed-limit ratio mapping table contains multiple vehicle speed ranges and their corresponding limit ratio values; the vehicle speed-limit ratio mapping table divides the vehicle speed range into low-speed range, medium-speed range, and high-speed range; the low-speed range corresponds to a higher limit ratio value; the high-speed range corresponds to a lower limit ratio value; the medium-speed range corresponds to an intermediate limit ratio value between the higher and lower limit ratio values; the linear interpolation algorithm calculates a weighted average of the limit ratio values ​​of adjacent vehicle speed ranges based on the position ratio of the real-time vehicle speed value between the boundary values ​​of two adjacent vehicle speed ranges, thus obtaining the transition limit ratio value.

[0064] Preferably, when the real-time vehicle speed value is located at the boundary value of two vehicle speed intervals, a linear interpolation algorithm is used to calculate the transition limit ratio value. The linear interpolation algorithm calculates the weighted average of the limit ratio values ​​of adjacent vehicle speed intervals based on the position ratio of the real-time vehicle speed value between the boundary values ​​of two adjacent vehicle speed intervals to obtain the transition limit ratio value.

[0065] S4.3: Query the preset working condition compensation coefficient table based on the absolute values ​​of the steering wheel angle signal and the steering wheel angular velocity signal to obtain the working condition compensation coefficient: Specifically, the steering angle level is determined based on the absolute value of the steering wheel angle signal. When the absolute value of the steering wheel angle signal exceeds the preset large steering angle threshold, it is marked as a large steering angle condition. When the absolute value of the steering wheel angle signal is less than the preset large steering angle threshold, it is marked as a small steering angle condition.

[0066] Furthermore, the steering speed level is determined based on the absolute value of the steering wheel angular velocity signal. When the absolute value of the steering wheel angular velocity signal exceeds the preset fast steering threshold, it is marked as a fast steering condition; when the absolute value of the steering wheel angular velocity signal is less than the preset fast steering threshold, it is marked as a slow steering condition. Furthermore, based on the steering radius level and steering speed level, the preset working condition compensation coefficient table is consulted to obtain the corresponding working condition compensation coefficient; if it is a large steering angle working condition or a fast steering working condition, the working condition compensation coefficient is greater than the reference compensation coefficient; if it is a small steering angle working condition and a slow steering working condition, the working condition compensation coefficient is equal to the reference compensation coefficient.

[0067] It should be noted that the preset large steering angle threshold is set based on the statistical characteristics of typical vehicle steering conditions and driver steering intentions. This threshold is used to distinguish between regular fine-tuning steering and aggressive steering or low-speed parking conditions requiring significant power assist. Generally, when the absolute value of the steering wheel angle exceeds 120° to 150° (approximately 2 to 2.6 radians), it is considered to have entered a large steering angle condition. The main consideration for setting this threshold is that when the steering angle is below this value, the steering resistance is mainly composed of stability damping at high speeds; while when the steering angle exceeds this threshold, it often corresponds to scenarios such as low-speed maneuvering, U-turns, or emergency obstacle avoidance, where the system needs to provide a greater assist current. Setting the threshold within this range ensures that the system can identify the driver's strong power assist demand in advance and supplement the assist in a timely manner through the condition compensation coefficient in degraded mode, preventing the steering feel from suddenly becoming heavy. The preset rapid steering threshold is set based on the angular velocity characteristics of the driver's steering wheel rotation during normal and emergency steering operations. This threshold is used to determine the urgency of the steering, distinguishing between normal, gentle steering and rapid steering behaviors such as emergency obstacle avoidance. Typically, a steering wheel angular velocity absolute value exceeding 300° / s to 500° / s (approximately 5.2 to 8.7 radians / second) is defined as a rapid steering condition. The rationale is that in daily driving, the driver's steering angular velocity is mostly below 300° / s; however, when emergency avoidance is required, the angular velocity will momentarily exceed this value. In degraded operation mode, once rapid steering is detected, the system will temporarily increase the amplitude limit ratio through a condition compensation coefficient to ensure sufficient transient assist torque is provided even when single-winding assist is insufficient, maintaining vehicle handling stability and avoiding safety risks caused by delayed assist response.

[0068] S4.4: Multiply the limiting ratio value by the operating condition compensation coefficient to obtain the final limiting ratio value, and calculate the limiting current threshold based on the rated maximum current of the normal side motor winding and the final limiting ratio value. It should be noted that the current limiting threshold is equal to the rated maximum current multiplied by the final limiting ratio.

[0069] Specifically, the normal side control board determines whether the limiting current threshold exceeds the upper limit of the safe current of a single winding of the normal side motor winding. When the limiting current threshold exceeds the upper limit of the safe current of a single winding, the limiting current threshold is corrected to the upper limit of the safe current of a single winding and stored in the local cache for use in the current limiting processing of the current control cycle.

[0070] S4.5: Calculate the original current command value in the degradation mode and determine whether the original current command value is greater than the limiting current threshold. Furthermore, the normal side control board calculates the target assist torque based on the current driver torque signal, steering wheel angle signal, real-time vehicle speed value, torque gain coefficient, vehicle speed compensation coefficient, and damping coefficient; and calculates the original current command value in the degraded mode based on the target assist torque and the current-torque conversion coefficient.

[0071] Furthermore, when the original current command value is greater than the current limiting threshold, the output current command value is trimmed to the current limiting threshold; when the original current command value is less than or equal to the current limiting threshold, the output current command value is kept as the original current command value, and the current command change rate is constrained on the output current command value, and the current command change rate between adjacent control cycles is calculated; if the current command change rate exceeds the preset current change rate upper limit, the output current command value is segmented and limited.

[0072] S4.6: The normal side control board converts the output current command value into the corresponding pulse width modulation (PWM) signal and outputs it to the normal side power board. Based on the PWM signal, it controls the on / off state of the MOSFETs of the three-phase bridge arm and drives the three-phase winding output current of the normal side motor winding. It should be noted that the pulse width modulation (PWM) signal includes the three-phase PWM duty cycle and switching timing parameters; Specifically, the output current of the three-phase winding generates a rotating magnetic field to drive the motor rotor to rotate. The motor rotor outputs a reduced-range assist torque through a reduction mechanism. The normal-side power board collects the actual value of the output current of the three-phase winding in real time through a current sampling resistor and feeds the actual value back to the normal-side control board to calculate the deviation between the output current command value and the actual value. When the deviation exceeds the preset current feedback deviation threshold, the pulse width modulation (PWM) signal parameters for the next control cycle are adjusted.

[0073] S4.7: The normal side control board generates a fault information data packet and records the system time when the fault was detected to be in an abnormal working mode. It should be noted that the fault information data packet includes a fault type code, a fault unit identifier, a fault occurrence timestamp, a current operating mode identifier, and limiting status parameters; a control board hardware fault corresponds to the first fault type code; a power board hardware fault corresponds to the second fault type code; a motor winding fault corresponds to the third fault type code; the first control board MCU1 corresponds to the first unit number; the second control board MCU2 corresponds to the second unit number; the first power board PWB1 corresponds to the third unit number; the second power board PWB2 corresponds to the fourth unit number; dedicated drive motor winding A corresponds to the fifth unit number; dedicated drive motor winding B corresponds to the sixth unit number; the fault type code is generated according to the fault type and a preset coding rule; the fault unit identifier indicates the specific unit number where the fault occurred; the limiting status parameters include the final limiting ratio value, the limiting current threshold, and the current real-time vehicle speed value.

[0074] S4.8: Transmits fault information data packets to the vehicle control unit (ECU) via the CAN bus, parses the fault type code and fault unit identifier, and determines the severity level of the fault; Furthermore, the vehicle control unit (ECU) sends a fault display command to the instrument panel control unit according to the severity of the fault, illuminates the steering system fault warning light on the instrument panel, and displays fault message text; based on the current operating mode indicator, it is determined that the electric power steering system is in a degraded operating state, and the vehicle safety strategy is activated.

[0075] It should be noted that the CAN bus transmission uses high-priority message identifiers to ensure the real-time transmission of fault information data packets; the vehicle safety strategy includes limiting the vehicle's maximum speed, enhancing the sensitivity of the braking system, and sending voice prompts to the driver; the normal side control board continuously updates the limiting status parameters to the vehicle control unit (ECU) at a preset reporting cycle; the preset reporting cycle is shorter than the fault status monitoring cycle; the vehicle control unit (ECU) judges the stability of degraded operation based on the changing trend of the limiting status parameters.

[0076] For example, after entering degraded mode, the second control board MCU2 receives a real-time vehicle speed signal of 65 km / h. After digital filtering, it queries the vehicle speed-limit ratio mapping table. 65 km / h falls within the medium speed range, corresponding to a limit ratio value of 0.72. Simultaneously, it detects a steering wheel angle of 90° (exceeding the 80° large steering angle threshold) and an angular velocity of 150° / s (exceeding the 120° / s rapid steering threshold), and queries the operating condition compensation coefficient table to obtain a coefficient of 1.15. The final limit ratio value is calculated to be 0.828 (0.72 × 1.15). Based on the rated maximum winding current of 20A, the limit threshold is 16.56A, but it is corrected to 15A because it exceeds the single winding safety limit of 15A. The second control board MCU2 calculates the original current command based on the current 3.5 N·m driver torque and calibration parameters. 17.2A, determined to exceed the amplitude limit threshold, the output is cut to 15A and converted into a PWM signal (75% duty cycle, 20kHz switching frequency) to drive the motor winding B output for degraded assist; at the same time, a fault information data packet is generated (fault code 0x01, unit identifier MCU1, timestamp T0+175ms, amplitude limit ratio 0.828, amplitude limit threshold 15A), and reported to the ECU via the CAN bus at 100ms intervals. After parsing, the ECU illuminates the turn signal malfunction warning light on the instrument panel and limits the maximum vehicle speed to 80km / h.

[0077] In summary, this invention, through real-time exchange of operating status parameters and execution of multi-level verification processes via dual control boards, can accurately pinpoint faulty units and quickly isolate faulty channels, effectively preventing system failures caused by fault propagation and improving the accuracy and response speed of fault diagnosis. By using a virtual torque buffer to perform ramp-gradient control on the output current command, and generating a gradual current command sequence based on the pre-fault current snapshot, the target current after degradation, and the adaptive transition time parameters of vehicle speed, it achieves a smooth, shock-free switch from dual-winding coordinated assist to single-winding independent assist, eliminating the sudden change in steering torque caused by traditional hard switching methods, and significantly improving the driver's handling perception and vehicle driving stability. Furthermore, a dynamic compensation algorithm monitors current tracking deviation in real time and calculates compensation. The current increment provides feedforward compensation for tracking errors exceeding the threshold, effectively suppressing the current response lag caused by reduced load capacity in the single-winding degraded operating mode, ensuring the speed and accuracy of the degraded power steering. By establishing a vehicle speed-limit ratio mapping relationship and introducing a working condition compensation coefficient for steering wheel angle and angular velocity, the current limit threshold is dynamically adjusted according to real-time driving conditions, and a rate of change constraint is applied. This ensures the safe operation of the normal side winding within the rated current range in degraded mode, while also taking into account the differentiated matching of power steering requirements for different vehicle speeds and steering conditions. Under the premise of ensuring system reliability, the power steering function is maximized, achieving the optimal balance between fault tolerance and performance degradation, and providing the driver with sufficient emergency control time window.

[0078] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for smooth failover takeover and degraded operation control of an electric power assisted steering system, characterized in that: The double control boards respectively perform hardware self-checking and program loading, synchronously collect homologous torque sensor signals, calculate target assist torque, drive double power boards and double motor windings to cooperatively output assist, exchange working state parameters and control instructions through a CAN-FD bus to mutually monitor, and judge whether the electric power steering system is in an abnormal working mode state. Based on the abnormal working mode state, the double control boards perform local self-checking, start a multi-level verification process to lock a fault unit, and output a fault isolation instruction; Based on the fault isolation instruction, the normal side control board cuts off a control channel and power supply of the fault unit, and simultaneously starts a virtual torque buffer to perform ramp gradual control on a current instruction output to the normal side power board. According to a preset vehicle speed limiting amplitude ratio mapping relationship, a corresponding limiting amplitude ratio value is obtained, the current instruction output to the normal side power board is limited in amplitude, and the normal side motor winding is driven to output degraded assist, and fault information is transmitted to an ECU. The method for obtaining and limiting amplitude of the limiting amplitude ratio value is as follows:

2. The smooth failover takeover and degraded operation control method of an electric power assisted steering system according to claim 1, characterized in that: Based on a single winding independent assist working mode, a vehicle speed signal is received from an ECU, the real-time vehicle speed signal is digitally filtered, and the filtered vehicle speed signal is taken as a real-time vehicle speed value; According to the real-time vehicle speed value, a preset vehicle speed-limiting amplitude ratio mapping table is queried, a vehicle speed interval to which the real-time vehicle speed value belongs is judged, a steering wheel angle signal and a steering wheel angular velocity signal are read; According to absolute values of the steering wheel angle signal and the steering wheel angular velocity signal, a preset working condition compensation coefficient table is queried, and a working condition compensation coefficient is obtained; The limiting amplitude ratio value is multiplied by the working condition compensation coefficient to obtain a final limiting amplitude ratio value, and a limiting current threshold value is calculated according to a rated maximum current of the normal side motor winding and the final limiting amplitude ratio value; An original current instruction value in the degraded mode is calculated, and whether the original current instruction value is greater than the limiting current threshold value is judged. Whether the original current instruction value is greater than the limiting current threshold value includes:

3. The smooth failover takeover and degraded operation control method of an electric power assisted steering system according to claim 2, characterized in that: When the original current instruction value is greater than the limiting current threshold value, the output current instruction value is clipped to the limiting current threshold value; When the original current instruction value is less than or equal to the limiting current threshold value, the output current instruction value is maintained as the original current instruction value, the output current instruction value is subjected to limiting amplitude change rate constraint, and a current instruction change rate between adjacent control periods is calculated; if the current instruction change rate exceeds a preset upper limit of current change rate, the output current instruction value is subjected to segmented limiting amplitude processing. The method for performing ramp gradual control on the current instruction output to the normal side power board includes:

4. The smooth failover takeover and degraded operation control method of an electric power assisted steering system according to claim 1, characterized in that: A current tracking deviation is calculated by the normal side control board, and whether an absolute value of the current tracking deviation exceeds a preset current tracking deviation threshold value is judged; When the absolute value of the current tracking deviation exceeds the preset current tracking deviation threshold value, the normal side control board starts a dynamic compensation algorithm to calculate a compensation current increment, the current instruction value of the next control period is superimposed with the compensation current increment to generate a compensated current instruction value, and the compensated current instruction value is output to the normal side power board. ​ When the absolute value of the current tracking deviation is less than the preset current tracking deviation threshold, the normal side control board maintains the normal output rhythm of the ramp current command sequence.

5. The smooth failover takeover and degraded operation control method of an electric power assisted steering system according to claim 4, characterized in that: Also includes, Accumulate the number of control cycles executed, calculate the transition process time, judge whether the transition process time reaches the transition time parameter, and judge whether the current output current command value reaches the post-degradation target current; When the transition process time reaches the transition time parameter and the current command value reaches the post-degradation target current, the normal side control board marks the completion of the smooth switching process, the virtual torque buffer stops generating the ramp current command sequence, and switches to the single-winding independent assist working mode.

6. The smooth failover takeover and degraded operation control method of an electric power assisted steering system according to claim 5, characterized in that: The generation method of the ramp current command sequence is, The normal side control board reads the current current value output by the normal side power board and stores it as the pre-fault current snapshot; at the same time, reads the fault side current value output by the fault side control board before the fault occurs, and calculates the total current of the double-winding collaborative assist; Based on the total current of the double-winding collaborative assist, a post-degradation target current is calculated based on a preset degradation coefficient, and a corresponding transition time parameter is obtained by querying a preset vehicle speed-transition time mapping table according to a real-time vehicle speed value; Based on the pre-fault current snapshot, the post-degradation target current and the transition time parameter, a virtual torque buffer is started, and a current change amount and a current command slope are calculated; According to the current command slope and the control cycle time, a single-step current increment is calculated, and a ramp current command sequence is generated by taking the pre-fault current snapshot as the starting value and adding the single-step current increment every control cycle. The current command value corresponding to the current cycle is extracted from the ramp current command sequence, and the current command value is output to the normal side power board.

7. The smooth failover takeover and degraded operation control method of an electric power assisted steering system according to claim 1, characterized in that: The execution method of the multi-level verification process is, If the first control board MCU1 or the second control board MCU2 detects an abnormal working mode state, the abnormal control board is marked as the fault side control board, and a local self-checking process is started to mark the fault type; Send the local self-checking result and the fault type to the normal side control board, exchange the original acquisition data, calculate the relative deviation, and judge whether the relative deviation is less than the preset signal review deviation threshold; When any one is greater than or equal to the preset signal review deviation threshold, send an auxiliary signal request instruction to the vehicle control unit ECU, receive the four-wheel speed signals, yaw rate signals and brake pedal signals collected by the wheel speed sensors, and calculate the vehicle speed signal vehicle verification deviation and steering wheel angle vehicle verification deviation; The normal side control board locks the fault unit according to the three-step verification result, judges the fault level, and generates a fault isolation instruction.

8. The smooth failover takeover and degraded operation control method of an electric power assisted steering system according to claim 7, characterized in that: The judgment method of the abnormal working mode state is, The double control boards judge whether the processor load exceeds a preset load threshold, whether the watchdog state resets, whether the instruction output frequency deviation exceeds a preset frequency deviation threshold, whether the target assist torque relative deviation exceeds a preset deviation threshold and whether the duration exceeds a preset duration threshold.

9. The smooth failover takeover and degraded operation control method of an electric power assisted steering system according to claim 1, characterized in that: The double control boards include a first control board MCU1 and a second control board MCU2; the homologous torque sensor signals include a driver torque signal and a steering wheel angle signal; the double power boards include a first power board PWB1 and a second power board PWB2; the double motor windings include a special driving motor winding A and a special driving motor winding B; and the working state parameters include a processor load, a watchdog state and an instruction output frequency.

Images