Dual-wheel centralized multi-redundancy EMB control system based on CAN communication

Abstract

The application discloses a double-wheel centralized multi-redundancy EMB control system based on CAN communication, which comprises a front axle central controller and a rear axle central controller; the front axle central controller comprises a front wheel main MCU and a front wheel auxiliary MCU, and the rear axle central controller comprises a rear wheel main MCU and a rear wheel auxiliary MCU; the front wheel main MCU, the front wheel auxiliary MCU, the rear wheel main MCU and the rear wheel auxiliary MCU are respectively connected with a private CAN transceiver; the four private CAN transceivers are connected in a closed ring topology through a private CAN communication bus; the front wheel main MCU is connected with the front wheel auxiliary MCU through an SPI bus, and the rear wheel main MCU is connected with the rear wheel auxiliary MCU through an SPI bus; the front wheel main MCU, the front wheel auxiliary MCU, the rear wheel main MCU and the rear wheel auxiliary MCU are respectively connected with a public CAN transceiver, and the four public CAN transceivers are connected to a public CAN communication bus; the front axle central controller controls a left front actuator and a right front actuator, and the rear axle central controller controls a left rear actuator and a right rear actuator.

Description

Technical Field

[0001] This invention relates to the field of automotive electronic control and functional safety technology, specifically to a dual-wheel centralized multi-redundant EMB control system based on CAN communication. Background Technology

[0002] With the rapid development of intelligent electric vehicle technology, electromechanical braking systems, as the core actuators of drive-by-wire chassis, are gradually replacing traditional hydraulic braking systems. EMB systems directly drive brake calipers via electric motors, eliminating traditional hydraulic lines, vacuum boosters, and other components, offering significant advantages such as fast response, high control precision, and ease of integrated design. However, because the braking system is directly related to vehicle and occupant safety, its functional safety requirements are extremely high, typically needing to meet the ASIL-D level of the ISO 26262 standard. This poses a significant challenge to the architectural design of EMB control systems.

[0003] Current EMB systems generally adopt a distributed architecture of one controller per wheel, meaning each wheel is independently equipped with a microcontroller (MCU) and a CAN communication module, with braking commands issued uniformly by the vehicle controller. Although some technical solutions have proposed using a dual-MCU redundancy design or adding a private CAN bus for diagnostics and debugging, existing technologies still have the following significant shortcomings:

[0004] First, there is insufficient inter-wheel coordination capability. In a distributed architecture, the coordination of braking forces among the four wheels relies entirely on communication via the vehicle's CAN bus. Because the vehicle's CAN bus carries communication tasks for multiple domains, including body control, powertrain, and intelligent driving, its bandwidth resources are very limited, resulting in significant and unpredictable communication latency. When the vehicle performs high-frequency dynamic braking control such as anti-lock braking (ABS) or electronic stability program (ESP), the existing architecture struggles to guarantee real-time coordination of braking forces across the four wheels, hindering further improvements in braking system performance.

[0005] Second, the redundancy design is too simplistic. Most existing redundancy solutions only implement backup for a single node's MCU or communication link, lacking a system-level multi-redundancy design that covers multiple dimensions such as controllers, communication links, communication channels, and task allocation. If the redundancy levels are insufficient, a single point of failure can still lead to the loss of critical functions, making it difficult to truly meet the functional safety requirements of ASIL-D level.

[0006] Third, the utilization rate of hardware resources is low. In the existing master-slave MCU architecture, the slave MCU usually only exists as a hot backup and remains idle for a long time during the normal operation of the master MCU. Its computing power is not effectively utilized, resulting in a waste of hardware resources.

[0007] Fourth, the communication link lacks self-healing capability. In existing proprietary CAN links, once interrupted due to factors such as wire harness wear, loose connectors, or electromagnetic compatibility (EMC) interference, the related collaborative control functions will be immediately lost, and the system does not have the ability to self-heal in the event of a fault.

[0008] Fifth, the system integration is not high. The distributed architecture requires four independent controllers for the four wheels, resulting in higher system costs and more complex wiring harness layout, which is not conducive to the integrated design of new automotive platforms such as skateboard chassis.

[0009] In summary, existing technologies lack an EMB control system that can integrate technologies such as dual-wheel centralized control, multi-MCU private CAN ring network, secondary MCU coprocessing function and dynamic communication reconfiguration, and cannot achieve a truly multi-redundancy design that covers multiple dimensions. Summary of the Invention

[0010] This invention proposes a dual-wheel centralized multi-redundant EMB control system based on CAN communication to address the shortcomings of existing EMB systems in terms of communication reliability, coordination efficiency, and hardware resource utilization, thereby meeting the ASIL-D level braking safety requirements of high-end intelligent electric vehicles.

[0011] To address the aforementioned technical problems, this invention provides a dual-wheel centralized multi-redundant EMB control system based on CAN communication, comprising:

[0012] A front axle central controller and a rear axle central controller; the front axle central controller includes a front wheel main MCU and a front wheel auxiliary MCU, and the rear axle central controller includes a rear wheel main MCU and a rear wheel auxiliary MCU;

[0013] The front wheel main MCU, the front wheel auxiliary MCU, the rear wheel main MCU and the rear wheel auxiliary MCU are each connected to a private CAN transceiver. The four private CAN transceivers are connected end to end through the private CAN communication bus to form a closed ring topology.

[0014] The front wheel main MCU and the front wheel auxiliary MCU are connected via an SPI bus, and the rear wheel main MCU and the rear wheel auxiliary MCU are connected via an SPI bus.

[0015] The front wheel main MCU, the front wheel auxiliary MCU, the rear wheel main MCU, and the rear wheel auxiliary MCU are each connected to a public CAN transceiver, and the four public CAN transceivers are connected to the public CAN communication bus.

[0016] The front axle central controller controls the left front actuator and the right front actuator, and the rear axle central controller controls the left rear actuator and the right rear actuator.

[0017] Preferably, the front wheel main MCU, the front wheel auxiliary MCU, the rear wheel main MCU, and the rear wheel auxiliary MCU are each connected to a channel switching control module; the input terminal of the channel switching control module is connected to the corresponding private CAN transceiver and the public CAN transceiver, and the channel switching control module is used to dynamically select whether to connect the signal of the private CAN transceiver or the public CAN transceiver to the external bus according to the system status.

[0018] Preferably, the front wheel auxiliary MCU and the rear wheel auxiliary MCU have hot standby roles and coprocessing roles; in the hot standby role, the front wheel auxiliary MCU monitors the status of the front wheel master MCU in real time through the SPI bus, and the rear wheel auxiliary MCU monitors the status of the rear wheel master MCU in real time through the SPI bus; in the coprocessing role, the front wheel auxiliary MCU and the rear wheel auxiliary MCU execute preset coprocessing tasks.

[0019] Preferably, when the front wheel main MCU fails, the front wheel auxiliary MCU takes over the control of the left front actuator and the right front actuator; when the rear wheel main MCU fails, the rear wheel auxiliary MCU takes over the control of the left rear actuator and the right rear actuator.

[0020] Preferably, the coprocessing tasks include wheel speed signal filtering, temperature signal filtering, cooperating parameter caching, cross-axis data forwarding, ring network link health monitoring, and diagnostic log aggregation and compression.

[0021] Preferably, the private CAN communication bus is used to transmit collaborative data, which includes target braking force, wheel speed, yaw rate request, and motor temperature.

[0022] Preferably, when any private CAN link in the closed-loop topology fails, the system automatically enables a multi-hop detour path for data transmission; the multi-hop detour path is the path from the front wheel main MCU through the front wheel auxiliary MCU and the rear wheel auxiliary MCU to the rear wheel main MCU, or the path from the rear wheel main MCU through the rear wheel auxiliary MCU and the front wheel auxiliary MCU to the front wheel main MCU.

[0023] Preferably, the channel switching control module includes an analog switch; when the private CAN communication bus fails, the analog switch switches the private CAN transceiver of the corresponding MCU to the public CAN communication bus, thereby realizing dynamic switching from private CAN to public CAN.

[0024] Preferably, the SPI bus is an isolated SPI bus, and electrical isolation is achieved between the front wheel main MCU and the front wheel auxiliary MCU, and between the rear wheel main MCU and the rear wheel auxiliary MCU, through isolation devices.

[0025] Preferably, the terminating resistors of the closed-loop topology are dynamically enabled by the GPIO ports of the front wheel main MCU, the front wheel auxiliary MCU, the rear wheel main MCU, and the rear wheel auxiliary MCU; when any link in the closed-loop topology is disconnected, the MCUs at both ends of the corresponding link automatically enable their respective terminating resistors.

[0026] This invention constructs a multi-level redundancy system covering four dimensions: controller, communication link, channel role, and task allocation.

[0027] The first level is controller redundancy. Each central controller contains a main MCU and a secondary MCU, which are synchronized through an isolated SPI bus. When the main MCU fails, the secondary MCU can seamlessly take over control in a very short time, achieving hardware-level fault switching.

[0028] The second level is communication link redundancy. The private CAN channels of the four MCUs are connected end-to-end via shielded twisted-pair cables to form a closed ring topology, supporting multipath transmission and fault self-healing. When any link in the ring network fails, data can continue to be transmitted through a detour, ensuring uninterrupted coordinated control.

[0029] The third level is channel role redundancy. Private CAN channels can be dynamically switched to public CAN channels via analog switches, enabling flexible reuse of communication channels. When a systemic failure occurs in private CAN communication, the system can switch the private CAN transceiver to the public CAN bus to ensure basic communication functions.

[0030] The fourth level is task-level redundancy. While performing hot standby monitoring tasks, the secondary MCU actively undertakes co-processing tasks such as round-robin filtering, parameter caching, and link monitoring, improving the overall robustness and resource utilization efficiency of the system.

[0031] Compared with the prior art, the present invention has the following beneficial effects:

[0032] Through the collaborative design of redundancy between the main and auxiliary MCUs and self-healing ring network communication, the system can still maintain basic braking and coordination capabilities under any single point of failure, meeting the functional safety requirements of ASIL-D level in the ISO 26262 standard.

[0033] The dedicated private CAN ring network supports collaborative communication frequencies of 500Hz and above, providing a reliable communication foundation for high-frequency dynamic braking control such as ABS and ESP, and significantly improving the coordination accuracy of four-wheel braking force.

[0034] The secondary MCU has been upgraded from a traditional idle hot standby to an active coprocessor, which performs auxiliary tasks such as signal filtering and data forwarding while maintaining the hot standby function, thus making full use of the value of hardware resources.

[0035] By adopting a centralized architecture with two wheels and one control, the number of controllers is reduced from four to two, which significantly reduces system costs and simplifies wiring harness layout, which is beneficial for the integrated design of new platforms such as skateboard chassis. Attached Figure Description

[0036] Figure 1 A diagram illustrating a dual-wheel centralized multi-redundant EMB control system architecture based on CAN communication provided in this embodiment of the invention. Detailed Implementation

[0037] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the protection scope of the present invention.

[0038] like Figure 1 As shown in the figure, this invention provides a dual-wheel centralized multi-redundant EMB control system based on CAN communication, employing a dual-controller architecture with separate front and rear axles. The system consists of two parts: a front axle central controller and a rear axle central controller, which are responsible for controlling the EMB actuators of the left and right wheels of the front axle and the left and right wheels of the rear axle, respectively. This dual-wheel centralized control design concept, compared to the traditional one-controller-one-wheel distributed architecture, reduces the number of controllers from four to two, significantly reducing system cost and wiring complexity while ensuring control performance.

[0039] The front axle central controller is installed in the front area of ​​the vehicle subframe, integrating two independent microcontroller units: a main front-wheel MCU and a secondary front-wheel MCU. In this embodiment, both the main and secondary MCUs can be Renesas R7F701374AEAFP series automotive-grade microcontrollers. This series of chips features high-performance computing capabilities and rich peripheral interfaces, meeting the ASIL-D level requirements for automotive functional safety. The main and secondary front-wheel MCUs communicate bidirectionally via an isolated SPI bus for real-time synchronization of status information and transmission of heartbeat signals. The output of the front axle central controller is connected to the left and right front actuators, driving the EMB motor via PWM signals to control braking force.

[0040] The rear axle central controller has a completely symmetrical structure to the front axle controller, also containing a main rear wheel MCU and a secondary rear wheel MCU, which are connected via an isolated SPI bus. The output of the rear axle central controller is connected to the left and right rear actuators, enabling independent control of the braking force of the two rear wheels. This symmetrical design of the front and rear axles not only facilitates modular development and manufacturing of the system but also benefits later maintenance and fault diagnosis.

[0041] The communication network of this invention adopts a parallel architecture design of public and private dual CAN buses, and optimizes the allocation of communication resources through functional separation.

[0042] The public CAN communication bus handles standardized communication between the EMB control system and other electronic control units (ECUs) of the vehicle. The front wheel main MCU, front wheel auxiliary MCU, rear wheel main MCU, and rear wheel auxiliary MCU are each connected to the public CAN communication bus via their respective public CAN transceivers. Under normal operating conditions, the main MCU receives braking commands from the vehicle controller via the public CAN bus and reports the status information of the braking system. The auxiliary MCU's public CAN transceiver is normally in listening mode. When the main MCU malfunctions and needs to be switched over, the auxiliary MCU activates its public CAN channel to take over the communication function with the vehicle ECU.

[0043] The private CAN communication bus is one of the core components of this invention, specifically designed for high-speed collaborative control data transmission between the four-wheel EMB controllers. Each of the front-wheel main MCU, front-wheel secondary MCU, rear-wheel main MCU, and rear-wheel secondary MCU is connected to a private CAN transceiver. In this embodiment, the NXP TJA1145 CAN transceiver is selected, as it supports the CAN FD protocol and possesses high communication speed and good electromagnetic compatibility performance. The CANH and CANL signal lines of the four private CAN transceivers are connected end-to-end via shielded twisted-pair cable in the order of front-wheel main MCU to rear-wheel main MCU to rear-wheel secondary MCU to front-wheel secondary MCU and finally back to front-wheel main MCU, forming a closed loop topology.

[0044] The private CAN ring network is primarily used to transmit collaborative data, which is crucial for achieving coordinated control of four-wheel braking force. The specific content of the collaborative data includes: target braking force (the requested braking torque value for each wheel); wheel speed (the current rotational speed of each wheel); yaw rate request (the yaw rate correction amount used for vehicle stability control); and motor temperature (the real-time temperature monitoring value of each wheel's EMB motor). The private CAN ring network is designed with a communication frequency of 500Hz and above, significantly higher than the typical period of the public CAN bus, meeting the stringent real-time communication requirements of high-frequency dynamic braking control systems such as ABS and ESP.

[0045] The secondary MCU in this invention differs from traditional hot standby solutions, giving it a dual functional role as both a hot standby and a coprocessor, thus achieving efficient utilization of hardware resources.

[0046] In hot standby mode, the front wheel slave MCU continuously monitors the heartbeat signal and critical status data sent by the front wheel master MCU via an isolated SPI bus. The SPI bus uses an ADuM5401 series digital isolator to achieve electrical isolation between the master and slave MCUs. This isolator has an isolation withstand voltage of 5kV rms, effectively preventing fault propagation between the master and slave MCUs and ensuring the system's fault isolation characteristics. The heartbeat signal transmission period is set to 1ms, and the slave MCU determines the master MCU's operating status by detecting the continuity of the heartbeat signal. The monitoring mechanism of the rear wheel slave MCU to the rear wheel master MCU is exactly the same.

[0047] When the primary MCU fails, the secondary MCU can quickly respond and take over control. Specifically, when the primary MCU of the front wheels fails, the secondary MCU of the front wheels, after detecting the loss of heartbeat signals for two consecutive cycles (2ms), immediately determines that the primary MCU has failed and completes the following switching actions within 2ms: taking over the PWM output control of the left and right front actuators; activating its own public CAN channel to continue communicating with the vehicle ECU; and switching its role from secondary to primary in the private CAN loop to continue participating in four-wheel coordinated control. The mechanism by which the secondary MCU of the rear wheels takes over the primary MCU of the rear wheels is the same. This rapid switching mechanism ensures the continuity of braking control in the event of a primary MCU failure, and the switching process is almost imperceptible to the driver.

[0048] In its coprocessor role, the secondary MCU proactively executes a series of lightweight auxiliary tasks using its idle computing resources. These tasks are all non-safety-critical (QM-level) and will not affect the system's functional safety boundaries. Specific coprocessor tasks include: wheel speed signal filtering, which digitally filters the raw signals collected by the wheel speed sensor to suppress noise interference and improve wheel speed measurement accuracy; temperature signal filtering, which smooths the temperature sampling values ​​of the EMB motor and power devices, providing reliable input for thermal protection strategies; collaborative parameter caching, which caches collaborative control parameters received from the private CAN ring network for quick access by the main MCU; cross-axis data forwarding, where the secondary MCU can act as a relay node to forward data when a communication path is blocked; ring network link health monitoring, which continuously monitors the communication quality of each link in the private CAN ring network to promptly detect potential faults; and diagnostic log aggregation and compression, which collects diagnostic information during system operation, aggregates and compresses it for later fault analysis. Through the design of the coprocessor role, the secondary MCU is upgraded from a traditional idle hot standby state to an active coprocessor, significantly improving the overall system's computational efficiency and resource utilization.

[0049] This invention designs multiple redundancies and fault self-healing mechanisms at the communication layer to ensure high reliability of the communication link.

[0050] The closed-loop topology of a private CAN ring network inherently possesses path redundancy capabilities. Under normal operating conditions, data is transmitted along the shortest path within the ring network. When any link in the ring network fails (e.g., communication interruption caused by wiring harness wear, loose connectors, EMC interference, etc.), the system can automatically detect the fault and activate a multi-hop detour path to continue data transmission. The principle of fault detection is: if a transmitting node does not receive an ACK response signal as specified by the CAN protocol within a specified time, it determines that the link has a fault. For example, if the direct link between the front wheel master MCU and the rear wheel master MCU fails, data transmission automatically switches to a detour path from the front wheel master MCU to the front wheel slave MCU, then to the rear wheel slave MCU, and finally to the rear wheel master MCU. Since there are two independent transmission paths between any two nodes in the ring network, a single-point link failure will not lead to a complete communication interruption; it will only increase the transmission delay by approximately 0.5ms, allowing the cooperative control function to continue operating.

[0051] The ring network terminating resistors are configured using a dynamic enabling method. Each MCU's GPIO port is connected to a controllable switch and a terminating resistor. When the ring network is fully closed, the terminating resistors are open, relying on the impedance matching characteristics of the ring structure itself to ensure signal quality. When a link is detected to be disconnected (determined by ACK loss or communication timeout), the MCUs at both ends of the corresponding link automatically enable their respective terminating resistors, converting the disconnected ring network into two independent bus structures, avoiding communication quality degradation caused by signal reflection. This dynamic terminating resistor management mechanism enables the system to maintain good communication performance even after a link failure.

[0052] The channel switching control module provides channel role redundancy for the system. Each MCU is equipped with a channel switching control module, the core component of which is an analog switch. Its inputs are connected to the corresponding MCU's private CAN transceiver and public CAN transceiver, respectively, and its output is connected to an external bus interface. Under normal operating conditions, the channel switching control module outputs the signals from the private CAN transceiver to the private CAN communication bus. When the system detects a systemic fault in the private CAN communication bus (such as a bus short circuit, severe EMC interference, or other situations that prevent the private CAN ring network from functioning properly), the channel switching control module can dynamically switch the private CAN transceiver to the public CAN communication bus, achieving a channel role switch from private CAN to public CAN. At this time, the collaborative data originally transmitted via the private CAN will be transmitted via the public CAN bus. Although the communication bandwidth and real-time performance will decrease, the basic collaborative control functions are not lost. This channel role redundancy design provides a final communication guarantee for the system.

[0053] Based on the above design, this invention constructs a multi-level redundancy system covering four dimensions.

[0054] The first level is controller redundancy. Each central controller is equipped with a dual-redundant configuration of a main MCU and a secondary MCU, achieving state synchronization through isolated SPI and supporting fast, seamless switching of less than 2ms. This level of redundancy ensures fault tolerance at the controller hardware level.

[0055] The second level is communication link redundancy. A four-MCU private CAN ring network forms a closed topology, with bidirectional redundant paths between any two nodes. Automatic rerouting is supported in case of a single link failure, and the communication path reconstruction time is less than 5ms. This level of redundancy ensures the continuity of high-speed collaborative communication.

[0056] The third level is channel role redundancy. The private CAN channel can be dynamically switched to the public CAN channel via an analog switch, and basic collaborative functions can still be maintained through the public CAN in the event of a systemic failure of the private CAN system. This level of redundancy enables flexible reuse of communication channels.

[0057] The fourth level is task-level redundancy. During hot standby, the secondary MCU simultaneously undertakes coprocessing tasks, including signal filtering, parameter caching, and link monitoring, improving the overall robustness of the system. This level of redundancy achieves efficient utilization of computing resources.

[0058] The aforementioned four levels of redundancy work together and progress step by step to form a complete functional safety assurance system. In the event of any single point of failure, the system can maintain basic braking control and cooperative functions through the corresponding redundancy mechanisms.

[0059] To more clearly illustrate the working principle of this invention, the following detailed description is provided in conjunction with several typical working scenarios.

[0060] Scenario 1: Normal Operation. In this state, the front wheel master MCU acts as the core of the front axle control, executing a control cycle every 2ms. Within each control cycle, the front wheel master MCU reads the wheel speed sensor signals from the left and right front wheels, combines this with braking commands from the vehicle controller, calculates the target braking force for the left and right front wheels using a braking force distribution algorithm, and drives the left and right front actuators to output the corresponding braking torque via PWM signals. Simultaneously, the front wheel master MCU broadcasts the calculated target braking force, current wheel speed, and other coordinated data to other MCUs via the private CAN ring network. Upon receiving the coordinated data from the front axle, the rear wheel master MCU, combined with the vehicle's current yaw rate, lateral acceleration, and other status information, calculates the target braking force for the rear axle and sends a yaw rate correction request back to the front axle. During this period, the front wheel auxiliary MCU continuously monitors the SPI heartbeat signal of the front wheel master MCU and performs coprocessing tasks such as wheel speed filtering and parameter caching. The operation of the rear axle controller is completely symmetrical to that of the front axle.

[0061] Scenario 2: Master MCU Failure Switching. Assume the front wheel master MCU locks up due to a software or hardware malfunction. If the front wheel slave MCU does not receive a valid heartbeat signal within two consecutive SPI communication cycles (2ms), it immediately determines that the front wheel master MCU has failed. The front wheel slave MCU performs the following switching actions: First, it takes over the PWM output ports of the left and right front actuators, continuing to output braking force according to the most recent valid control command to ensure uninterrupted braking control; second, it activates its public CAN transceiver, taking over the communication function with the vehicle ECU, starting to receive new braking commands and report system status; finally, it updates its role identifier in the private CAN ring network, switching from slave to master, and continues to participate in the data interaction for four-wheel coordinated control. The entire switching process is completed within 2ms, with minimal impact on vehicle braking performance, and is almost imperceptible to the driver.

[0062] Scenario 3: Private CAN Link Fault Self-Healing. Assume the private CAN direct link between the front-wheel master MCU and the rear-wheel master MCU short-circuits due to wiring harness wear. The collaborative data sent by the front-wheel master MCU to the rear-wheel master MCU fails to receive an ACK response, and the system determines the link is faulty. At this time, the private CAN ring network automatically activates a rerouting path: data from the front-wheel master MCU is first sent to the front-wheel slave MCU, which then relays it to the rear-wheel slave MCU, which in turn forwards it to the rear-wheel master MCU, completing the data transmission. Simultaneously, the front-wheel and rear-wheel master MCUs enable their respective terminating resistors, converting the ring network into two independent bus structures. The rerouting transmission adds approximately 0.5ms of delay, but the collaborative control function remains continuous, and the system continues to operate normally. Communication path reconstruction is completed within 5ms.

[0063] The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described; only preferred embodiments of the present invention are illustrated. The descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the present invention. As long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification.

[0064] It should be noted that those skilled in the art can make various modifications and improvements without departing from the inventive concept, and these all fall within the scope of protection of this invention. Therefore, the scope of protection of this invention should be determined by the appended claims.

Claims

1. A dual-wheel centralized multi-redundant EMB control system based on CAN communication, characterized in that, include: A front axle central controller and a rear axle central controller; the front axle central controller includes a front wheel main MCU and a front wheel auxiliary MCU, and the rear axle central controller includes a rear wheel main MCU and a rear wheel auxiliary MCU; The front wheel main MCU, the front wheel auxiliary MCU, the rear wheel main MCU and the rear wheel auxiliary MCU are each connected to a private CAN transceiver. The four private CAN transceivers are connected end to end through the private CAN communication bus to form a closed ring topology. The front wheel main MCU and the front wheel auxiliary MCU are connected via an SPI bus, and the rear wheel main MCU and the rear wheel auxiliary MCU are connected via an SPI bus. The front wheel main MCU, the front wheel auxiliary MCU, the rear wheel main MCU, and the rear wheel auxiliary MCU are each connected to a public CAN transceiver, and the four public CAN transceivers are connected to the public CAN communication bus. The front axle central controller controls the left front actuator and the right front actuator, and the rear axle central controller controls the left rear actuator and the right rear actuator; The front wheel main MCU, front wheel auxiliary MCU, rear wheel main MCU, and rear wheel auxiliary MCU are each connected to a channel switching control module; the input terminal of the channel switching control module is connected to the corresponding private CAN transceiver and public CAN transceiver, and the channel switching control module is used to dynamically select whether to connect the signal of the private CAN transceiver or the public CAN transceiver to the external bus according to the system status. The front wheel auxiliary MCU and the rear wheel auxiliary MCU have hot standby and coprocessing roles. In the hot standby role, the front wheel auxiliary MCU monitors the status of the front wheel master MCU in real time through the SPI bus, and the rear wheel auxiliary MCU monitors the status of the rear wheel master MCU in real time through the SPI bus. In the coprocessing role, the front wheel auxiliary MCU and the rear wheel auxiliary MCU execute preset coprocessing tasks. When the main MCU of the front wheel fails, the auxiliary MCU of the front wheel takes over the control of the left front actuator and the right front actuator; when the main MCU of the rear wheel fails, the auxiliary MCU of the rear wheel takes over the control of the left rear actuator and the right rear actuator. When any private CAN link in the closed ring topology fails, the system automatically enables a multi-hop detour path for data transmission; the multi-hop detour path is the path from the front wheel main MCU through the front wheel auxiliary MCU and the rear wheel auxiliary MCU to the rear wheel main MCU, or the path from the rear wheel main MCU through the rear wheel auxiliary MCU and the front wheel auxiliary MCU to the front wheel main MCU.

2. The dual-wheel centralized multi-redundant EMB control system based on CAN communication according to claim 1, characterized in that: The coprocessing tasks include wheel speed signal filtering, temperature signal filtering, co-processing parameter caching, cross-axis data forwarding, ring network link health monitoring, and diagnostic log aggregation and compression.

3. The dual-wheel centralized multi-redundant EMB control system based on CAN communication according to claim 1, characterized in that: The private CAN communication bus is used to transmit collaborative data, which includes target braking force, wheel speed, yaw rate request, and motor temperature.

4. The dual-wheel centralized multi-redundant EMB control system based on CAN communication according to claim 1, characterized in that: The channel switching control module includes an analog switch; when the private CAN communication bus fails, the analog switch switches the private CAN transceiver of the corresponding MCU to the public CAN communication bus, realizing dynamic switching from private CAN to public CAN.

5. The dual-wheel centralized multi-redundant EMB control system based on CAN communication according to claim 1, characterized in that: The SPI bus is an isolated SPI bus, and electrical isolation is achieved between the front wheel main MCU and the front wheel auxiliary MCU, and between the rear wheel main MCU and the rear wheel auxiliary MCU through isolation devices.

6. The dual-wheel centralized multi-redundant EMB control system based on CAN communication according to claim 1, characterized in that: The terminating resistors of the closed-loop topology are dynamically enabled by the GPIO ports of the front wheel main MCU, the front wheel auxiliary MCU, the rear wheel main MCU, and the rear wheel auxiliary MCU; when any link in the closed-loop topology is disconnected, the MCUs at both ends of the corresponding link automatically enable their respective terminating resistors.

Images