Redundant fault-tolerant control system and control method for distributed drive-by-wire chassis

Abstract

The invention designs a redundant fault-tolerant control system and control method for a distributed drive-by-wire chassis, and the system achieves the high-reliability operation of a whole drive-by-wire chassis system through the multi-level redundant design including power subsystem redundancy, dual-controller hot backup redundancy and four-corner module independent control mutual redundancy in combination with a degradation fault-tolerant mechanism. The system comprises components such as DCDC, a low-voltage storage battery, double controllers, four distributed corner modules and various sensors, corresponding fault diagnosis and safety control strategies are configured, and the core of the system is that through collaborative design of hardware redundancy and software fault tolerance, it is ensured that the system can still maintain basic safety functions under the condition that one or more components have faults, and the system is safe and reliable. And the safety and the reliability of the drive-by-wire chassis are obviously improved.

Description

Technical Field

[0001] This invention relates to a redundant fault-tolerant control system and control method for a distributed drive-by-wire chassis, belonging to the field of chassis control technology for autonomous vehicles. Background Technology

[0002] With the widespread application of autonomous driving technology in the vehicle field, distributed drive-by-wire chassis have been implemented in various scenarios such as sanitation, logistics, and ports. These platforms typically operate in specific areas or along fixed routes, making operational safety paramount. However, traditional drive-by-wire chassis control systems mostly employ a single architecture of "single power supply + single controller + single actuator."

[0003] Power system: It relies on a single low-voltage battery for power supply. If the battery fails (such as a short circuit or depletion), the entire system will lose power.

[0004] Control system: The main controller has no backup. Once the chip overheats, the program crashes, or the communication terminal malfunctions, the chassis will lose control.

[0005] Actuators: The drive / steering / braking functions of each wheel are implemented by an independent single-wheel control module. If any module fails, it will directly cause the corresponding wheel to fail, causing the vehicle to deviate or roll over.

[0006] Fault response: Most systems only have basic alarm functions (such as fault light prompts) and lack active degradation control strategies, making it impossible to maintain basic driving capability after a fault occurs. The above defects make it difficult for existing chassis to meet the actual operation requirements in terms of reliability and safety, especially in long-term unattended scenarios where the risks are significant.

[0007] In existing technologies, patent CN220180765A discloses a drive-by-wire chassis safety system that transmits signals via bus or wireless communication, but its redundancy coverage is limited. Patent CN218477549U discloses a redundant drive-by-wire chassis system using a dual-steering system, but it does not address the redundancy issues of the power supply and distributed execution modules. Patent CN101634959B discloses a dual-machine redundant fault-tolerant system based on an embedded CPU, but it mainly focuses on the control unit and does not address the collaborative fault tolerance of the power supply and actuators. The above-mentioned existing technologies mainly suffer from the following defects:

[0008] (1) Existing technologies have limited redundancy coverage, mostly concentrated in specific subsystems (such as control units or networks), lacking full-chain redundancy such as power supply and distributed execution modules, and have the risk of single point of failure;

[0009] (2) Existing technologies are mostly designed for millisecond-level response (such as emergency braking), but lack consideration for long-term reliability and continuous operation capability after failure;

[0010] (3) The existing schemes mostly use dual motors to drive the same wheel, lacking four independent backup and redundancy wheels;

[0011] (4) Most existing systems stop directly after a fault occurs, and cannot dynamically adjust the operating mode according to the fault level.

[0012] Therefore, existing technologies suffer from problems such as limited redundancy coverage, high risk of single point of failure, and limited fault tolerance strategies. There is an urgent need for a drive-by-wire chassis control system and control method that can achieve full-link redundancy and fault tolerance. Summary of the Invention

[0013] The purpose of this invention is to overcome the shortcomings of the prior art and provide a redundant fault-tolerant control system and control method for a distributed drive-by-wire chassis. It aims to solve the reliability and single-point-of-failure problems of the drive-by-wire chassis system and provide a redundant fault-tolerant control system for a distributed drive-by-wire chassis.

[0014] To achieve the above objectives, the present invention is implemented using the following technical solution:

[0015] In a first aspect, the present invention provides a redundant fault-tolerant control system for a distributed drive-by-wire chassis, comprising:

[0016] The power redundancy subsystem, including the main DC-DC converter and low-voltage batteries, provides dual independent power supply and has power monitoring and switching functions.

[0017] The control redundancy subsystem includes a main controller and a backup controller with identical hardware configurations and interconnected via a CAN bus, configured to operate in hot backup mode and achieve seamless fault switching.

[0018] The redundant subsystem includes four distributed corner modules. Each corner module integrates a drive motor, a steering motor, a brake actuator, and a local sensor. The four corner modules are interconnected through a multi-bus communication architecture to form a redundant relationship.

[0019] The fault diagnosis and safety control strategy module is communicatively connected to the power redundancy subsystem, control redundancy subsystem, and execution redundancy subsystem, and is used to perform real-time fault detection, fault classification, and trigger degraded operation strategies.

[0020] Furthermore, the method by which the fault diagnosis and safety control strategy module performs real-time fault detection, fault classification, and triggers a degraded operation strategy includes:

[0021] Fault detection is performed on the power redundancy subsystem, control redundancy subsystem, and execution redundancy subsystem respectively;

[0022] If a fault is detected, the fault is classified to obtain the fault level;

[0023] The degradation operation strategy is triggered based on the fault level.

[0024] Furthermore, fault detection is performed on the power redundancy subsystem, control redundancy subsystem, and execution redundancy subsystem, respectively, including:

[0025] For the power redundancy subsystem: The DC-DC communication management unit monitors the output voltage, current, and temperature parameters of the main DC-DC converter in real time. When the output voltage or current exceeds the normal range, or the temperature exceeds the safety threshold, a power supply fault is identified.

[0026] For the control redundancy subsystem:

[0027] a) Heartbeat signal detection: The backup controller continuously monitors the main controller's heartbeat signal via an independent CAN bus. If no heartbeat signal is received within a set time, the main controller is deemed to have failed in communication or crashed.

[0028] b) Verification of command rationality and timing consistency: The backup controller obtains the output commands from the main controller via the common CAN bus, and verifies the rationality of the commands (e.g., whether the steering command is within physical limits) in conjunction with the vehicle status (e.g., vehicle speed, steering angle), and checks whether the timing of the command transmission conforms to logic. If unreasonable commands or disordered timing are found, the main controller is determined to be logically faulty.

[0029] For redundant subsystems: The operating status (such as speed, angle, and pressure) of the drive, steering, and braking units is monitored in real time using local sensors (such as motor encoders, angle sensors, and pressure sensors) in each corner module. The monitored data is cross-compared with the system's expected values ​​and data from the health modules. If the parameters of a certain corner module are continuously abnormal (such as motor stall, steering jamming, or pressure loss), then that corner module is determined to be faulty.

[0030] Furthermore, methods for fault classification include:

[0031] Based on the degree of impact of the fault on system functionality and safety, faults are divided into three levels:

[0032] (1) Minor faults: These are faults that have little impact on the current operation of the system and will not immediately cause safety risks. For example, a single sensor may experience a brief data jump and then return to normal, or the performance of a non-critical component may be slightly degraded.

[0033] (2) Moderate fault: refers to a fault that causes partial limitation of system functions and performance degradation, requiring measures to maintain basic operation. For example, the output of the main DC-DC converter is unstable but the low-voltage battery can take over the power supply; the drive or steering function of a corner module fails; the main controller experiences periodic command delays.

[0034] (3) Serious faults: These are faults that cause the loss of critical system functions and directly threaten driving safety. For example, the main controller may completely shut down and switch abnormally; multiple corner modules may fail simultaneously, leading to the risk of vehicle loss of control; or critical power circuits may completely fail.

[0035] The above fault classification standards can be determined based on historical experimental or empirical data.

[0036] Furthermore, the degradation operation strategy triggered according to the fault level includes:

[0037] (1) Minor fault: The system issues an audible and visual alarm or a remote alarm, records the fault log, but maintains the current normal operating status and reminds the operator to pay attention.

[0038] (2) Moderate fault: Triggering a speed reduction strategy. The system automatically limits the vehicle's maximum speed to reduce the system load. At the same time, the system reconfigures functions based on the specific fault point. For example, when a drive motor fails, the system switches to three-wheel drive mode and maintains straight-line stability by adjusting the torque output of the remaining healthy wheels (differential torque compensation); when a steering motor fails, the system switches to two-wheel steering mode or uses differential steering to achieve steering function.

[0039] (3) Serious Failure: Immediately triggers the emergency stop strategy. The system prioritizes safety, applies controllable emergency braking in conjunction with the ABS anti-lock braking system, and may utilize the drive motor to generate counter-draft torque to bring the vehicle to a quick and smooth stop. After stopping, the system cuts off the power to high-risk components and maintains the braking state, while issuing the highest level alarm.

[0040] Furthermore, the power redundancy subsystem also includes a DC-DC communication management unit, which is configured to monitor the output voltage, current, and temperature parameters of the main DC-DC converter in real time. When any one of the output voltage, current, and temperature parameters of the main DC-DC converter exceeds the set range, the control circuit shuts down the DC-DC enable output and cuts off the DC-DC front-end input, and supplies power from the low-voltage battery.

[0041] Furthermore, anti-reverse diodes are provided in the power supply circuits of both the main DC-DC converter and the low-voltage battery.

[0042] Furthermore, in the control redundancy subsystem, the main controller and the backup controller use an independent CAN bus for heartbeat confirmation and status synchronization, and share sensor data through a shared CAN bus; the status synchronization adopts an incremental transmission mechanism.

[0043] Furthermore, the control redundancy subsystem employs a multi-index fusion decision algorithm for fault detection and switching. The algorithm includes detecting anomalies through heartbeat signals and verifying the rationality and timing consistency of the main controller's output commands.

[0044] Furthermore, the four distributed corner modules include a front left corner module, a rear left corner module, a front left left corner module, and a rear left corner module; each corner module integrates a drive motor, a steering motor, a brake actuator, and a local sensor, and the four corner modules are interconnected through a multi-bus communication architecture to form a redundant relationship.

[0045] Furthermore, the multi-bus communication architecture of the execution redundancy subsystem is as follows:

[0046] The drive and steering units of the left front corner module and the right front corner module share the first CAN bus;

[0047] The drive and steering units of the left rear corner module and the right rear corner module share the second CAN bus;

[0048] The braking unit of the left front corner module shares the third CAN bus with the braking unit of the right front corner module;

[0049] The braking unit of the left rear corner module shares the fourth CAN bus with the braking unit of the right rear corner module.

[0050] Furthermore, the system is applied to wheeled construction machinery, including unmanned sweeping vehicles, unmanned delivery vehicles, or park logistics vehicles.

[0051] In a second aspect, the present invention provides a redundancy-tolerant control method for a distributed drive-by-wire chassis, employing the system described in the first aspect, comprising:

[0052] The power redundancy subsystem provides dual independent power supply, monitors power parameters in real time, and automatically switches to low-voltage battery power supply when the main DC-DC converter fails.

[0053] Hot backup operation of the main controller and standby controller is achieved by controlling the redundant subsystem. Faults in the main controller are detected based on a multi-index fusion decision algorithm, and seamless switching is achieved.

[0054] The four distributed corner modules are made redundant by executing a redundant subsystem. When a corner module failure is detected, a fault-tolerant control algorithm is used to reconfigure the functions of the remaining healthy corner modules.

[0055] The system status is monitored in real time through the fault diagnosis and safety control strategy module, multi-level fault diagnosis is performed, and corresponding degradation operation strategies are triggered according to the severity of the fault.

[0056] Furthermore, the seamless switching process of the control redundancy subsystem includes:

[0057] The backup controller detects the heartbeat signal of the main controller via an independent CAN bus and verifies the rationality and timing consistency of the main controller's output commands via a shared CAN bus.

[0058] A smooth transition algorithm is used during the switchover, and the backup controller takes over control after inheriting the last valid state of the main controller.

[0059] Furthermore, multi-level fault diagnosis is performed, and corresponding degradation operation strategies are triggered based on the severity of the fault, including:

[0060] Fault detection is implemented based on multi-sensor information fusion technology, and the fault detection covers power redundancy subsystem, control redundancy subsystem and execution redundancy subsystem;

[0061] The faults are classified into three levels: minor faults, moderate faults, and severe faults.

[0062] When the fault is minor, the alarm strategy is triggered to issue an audible and visual alarm or a remote alarm, but the current operating status is maintained.

[0063] When the fault is classified as a moderate fault, a speed reduction operation strategy is triggered, which automatically limits the vehicle's maximum speed and performs functional reconfiguration.

[0064] When the fault is a serious fault, the emergency stop strategy is triggered, which combines the ABS anti-lock braking system and the reverse drag torque of the drive motor to implement controllable braking and bring the vehicle to a smooth stop.

[0065] Furthermore, the criteria for fault classification include:

[0066] Minor faults refer to faults that have little impact on the current operation of the system and will not immediately pose a safety risk, including faults that recover to normal after a brief fluctuation in the data of a single sensor;

[0067] A moderate fault refers to a fault that limits some functions of the system or degrades its performance, including unstable output of the main DC-DC converter, partial failure of a single corner module, or delay in main controller commands.

[0068] Serious faults refer to faults that cause the loss of critical system functions and directly threaten driving safety, including complete shutdown of the main controller, simultaneous failure of multiple corner modules, or complete failure of critical power circuits.

[0069] Furthermore, the fault-tolerant control algorithm includes:

[0070] When the drive motor fails, a three-wheel drive mode is adopted and the vehicle's straight-line capability is maintained through differential torque compensation;

[0071] When the steering motor fails, use two-wheel steering mode or differential steering mode;

[0072] When the brake actuator fails, the braking torque is redistributed to the remaining healthy angle modules.

[0073] Compared with the prior art, the beneficial effects achieved by the present invention are as follows:

[0074] 1. High reliability across the entire chain: The redundant architecture integrating power supply, control, and execution eliminates the risk of single point of failure.

[0075] 2. Intelligent fault-tolerant control: Through the coordinated design of hardware redundancy and software fault tolerance, functional reconfiguration and degraded operation are achieved under fault conditions;

[0076] 3. High availability and security: Ensure that the system can maintain basic safety functions even in the event of failure of one or more components;

[0077] 4. Cost-effectiveness optimization: Maximize the fault tolerance effect of limited hardware resources through software fault tolerance mechanisms to reduce the overall system cost. Attached Figure Description

[0078] Figure 1 A diagram of the existing solution;

[0079] Figure 2 Figure 2 shows the existing scheme.

[0080] Figure 3 The three diagrams represent the existing scheme;

[0081] Figure 4 Figure 4 shows the existing scheme;

[0082] Figure 5 This is a schematic diagram of the overall system framework;

[0083] Figure 6 This is a diagram of a power redundancy system architecture.

[0084] Figure 7 Dual-controller hot backup switching solution;

[0085] Figure 8 For distributed corner module redundancy;

[0086] Figure 9 This is a schematic diagram of fault analysis and control strategies for abnormal scenarios.

[0087] In the diagram: 1. Main controller; 2. Backup controller; 4. Main DC-DC converter; 5. Low-voltage battery; 9. Left front corner module drive motor; 10. Left front corner module steering motor; 11. Left front corner module brake actuator; 12. Right front corner module drive motor; 13. Right front corner module steering motor; 14. Right front corner module brake actuator; 15. Left rear corner module drive motor; 16. Left rear corner module steering motor; 17. Left rear corner module brake actuator; 18. Right rear corner module drive motor; 19. Right rear corner module steering motor; 20. Right rear corner module brake actuator.

[0088] 21. Front left corner module; 22. Front right corner module; 23. Rear left corner module; 24. Rear right corner module. Detailed Implementation

[0089] The present invention will be further described below with reference to the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and should not be used to limit the scope of protection of the present invention.

[0090] Definitions of abbreviations and key terms:

[0091] DCDC: DC-DC converter, used to convert high-voltage DC power into low-voltage DC power (typically 12V).

[0092] Low-voltage battery: Provides low-voltage power (typically 12V) for chassis electronic control systems (such as controllers and sensors);

[0093] Dual controllers: The chassis main controller and the backup controller form a hot backup redundant unit, which synchronizes the status in real time and has the ability to switch over in case of failure.

[0094] Distributed corner module: An independent functional unit that integrates drive motor, steering motor, brake actuator and local sensors, corresponding to the four wheels of the vehicle;

[0095] Wheel speed sensor: A sensor that detects the rotational speed of the wheels, used for vehicle speed calculation and slip control;

[0096] Steering sensor: A sensor that detects the steering angle of the wheels, used for attitude control and steering closed-loop;

[0097] Hot backup redundancy: The backup component runs synchronously with the primary component under normal conditions and seamlessly takes over the function in case of failure;

[0098] Fault diagnosis: Real-time detection technology for abnormalities in hardware status (such as voltage, current, and communication signals) and software logic (such as control command response);

[0099] Safety control strategies: Degraded operating modes (such as speed limit, locking, emergency braking) or parking logic triggered by fault levels.

[0100] Example 1:

[0101] This embodiment provides a redundant fault-tolerant control system for a distributed drive-by-wire chassis, specifically addressing the following issues:

[0102] 1. Vulnerability of the power system: Traditional single power architectures can cause the vehicle control system to lose power and fail when the battery or power supply line fails. This invention uses a DC-DC + battery solution to ensure that the system can still obtain a stable power supply when any single power component fails.

[0103] 2. Single point of failure in control unit: A failure of the centralized controller can cause the entire system to crash. This invention adopts a dual-controller hot backup design to achieve seamless switching of functions and avoid system loss of control due to control unit failure.

[0104] 3. The problem of missing actuator functions: Traditional actuators (such as steering motors and brakes) lack backups. Local failures can lead to the loss of overall functions. This invention achieves redundancy among the four corner modules through a distributed corner module design. Even if a single module fails, the basic operating capability can still be maintained by reorganizing the functions of the remaining modules.

[0105] 4. Problem of delayed fault diagnosis and handling: Existing systems struggle to detect and locate faults in a timely manner. This invention integrates a multi-level fault diagnosis mechanism, combining sensor data fusion and algorithm analysis to achieve early warning and precise fault location.

[0106] 5. Problem of limited fault tolerance strategies: Existing redundancy designs mostly rely on hardware backup, which is costly and has limited coverage. This invention adopts a redundancy fault tolerance mechanism of hardware redundancy + software degradation, and expands the fault tolerance range even with limited hardware backup through adaptive adjustment of the control algorithm.

[0107] Its core design concept is to build a highly reliable drive-by-wire chassis through triple protection of power redundancy, control redundancy and actuator redundancy, combined with intelligent fault diagnosis strategies, to meet the needs of unmanned sweepers, logistics vehicles and other applications.

[0108] System overall architecture:

[0109] This system consists of four main parts: a power redundancy subsystem, a control redundancy subsystem, an execution redundancy subsystem, and a fault diagnosis and safety control strategy module. The system adopts a layered redundancy design, with each level operating independently yet collaboratively to form a complete fault-tolerant system. The power system provides dual independent power supplies to the entire chassis, and the dual controllers use a master-slave hot backup mode to synchronize operating data in real time. The four distributed corner modules have independent control capabilities and cross-communication capabilities. The safety control strategy module is responsible for real-time fault diagnosis and system degradation management.

[0110] The system hardware includes: a DC-DC power conversion module (4 units), a low-voltage battery (5 units), a main controller (1 unit), a backup controller (2 units), and four distributed corner modules for drive, steering, and braking systems. These components are interconnected via a high-speed CAN bus to achieve data sharing and command synchronization. Compared to traditional solutions, the innovation of this design lies in achieving end-to-end redundancy from power supply to actuators, with fault isolation and automatic switching capabilities between each redundancy level.

[0111] Power redundancy subsystem:

[0112] The power redundancy subsystem adopts a dual-path independent power supply architecture to solve the vulnerability problem of traditional single power path. The system includes two power supply units: a main DC-DC converter 4 and a low-voltage battery 5. The DC-DC converter is directly connected to the vehicle's main power supply (high-voltage battery pack) and converts the voltage to the low-voltage platform (12V) required by the chassis control system. The low-voltage battery serves as a backup power source, providing power immediately in case of DC-DC failure or low output voltage.

[0113] The DCDC output voltage, current, and temperature parameters are checked synchronously via the bus. If an abnormality is detected, an alarm is triggered, the DCDC output is cut off, and the battery supplies power to the entire vehicle. Both independent power supplies are equipped with anti-reverse diodes to ensure that short circuits do not affect the bus voltage, thus ensuring that the vehicle is not affected during operation.

[0114] Simultaneously, in the event of a DC-DC converter failure, the system automatically adjusts the power supply to non-critical systems, shutting off some lights and voice functions via the controller, prioritizing safety-critical functions such as steering, braking, and drive. This extends the battery's lifespan in case of a failure, providing energy assurance for the safe return of the low-speed drive-by-wire chassis.

[0115] Control redundancy subsystem:

[0116] Controller hardware structure: The control redundancy subsystem adopts a homogeneous dual-controller design. The two controllers have the same hardware configuration and are connected to the same wired control subsystem equipment.

[0117] Hot Backup Mechanism: The dual controllers operate in parallel via hot backup mode. Unlike traditional cold backup solutions, in this system, both the primary and backup controllers receive the same sensor data and execute the same control code simultaneously. However, only the output commands of the primary controller are actually sent to the actuators. The backup controller continuously synchronizes its status with the primary controller to ensure command continuity during switching. The dual controllers use a dedicated CAN bus for heartbeat confirmation while sharing data from other devices on the common bus.

[0118] Fault detection and switching mechanism: A multi-index fusion decision algorithm is adopted, and a two-step confirmation process is designed: First, the backup controller detects anomalies through a heartbeat signal, and then verifies the rationality and timing consistency of the main controller's output commands. If both are satisfied, a switching synchronization and smooth transition algorithm is used to switch, avoiding sudden changes in control commands that could cause vehicle vibration. After taking over from the main controller, it inherits the last effective state of the main controller to ensure control continuity.

[0119] Execute redundant subsystems:

[0120] The redundant execution subsystem implements the redundant design of the actuator through four distributed corner modules.

[0121] Redundant working mechanism: Each corner module integrates a drive motor, steering motor, brake actuator, and steering angle and wheel speed sensors, forming an independent drive, steering, and braking unit. It adopts a standardized interface and modular structure, and the four corner modules are mutually redundant.

[0122] Communication architecture redundancy mechanism: For the independent drive, steering, and braking systems of the four corner modules, a multi-bus mechanism is used to isolate regions and functions. The left front corner module 21's left front corner module drive motor 9 and left front corner module steering motor 10 share a bus with the right front corner module 22's right front corner module drive motor 12 and right front corner module steering motor 13. The left rear corner module 23's left rear corner module drive motor 15 and left rear corner module steering motor 16 share a bus with the right rear corner module 24's right rear corner module drive motor 18 and right rear corner module steering motor 19, achieving isolation of the drive and steering functions of the front and rear axles. In case of failure, the system can switch from four-wheel drive steering to two-wheel drive steering mode. The left front corner module's brake 11 and right front corner module's brake 14 share a bus, and the left rear corner module's brake 17 and right rear corner module's brake 20 share a bus, isolating the braking function from other functions and simultaneously isolating the front and rear axle braking functions.

[0123] Specifically: How the fault diagnosis and safety control strategy module operates:

[0124] 1. Fault detection: Implement comprehensive fault detection based on multi-sensor information fusion technology.

[0125] (1) Power redundancy subsystem detection: The output voltage, current and temperature parameters of the main DC-DC converter are monitored in real time through the DC-DC communication management unit. When the output voltage or current exceeds the normal range, or the temperature exceeds the safety threshold, it is determined to be a power supply fault.

[0126] (2) Control redundancy subsystem detection:

[0127] a) Heartbeat signal detection: The backup controller continuously monitors the main controller's heartbeat signal via an independent CAN bus. If no heartbeat signal is received within a set time, the main controller is deemed to have failed in communication or crashed.

[0128] b) Verification of command rationality and timing consistency: The backup controller obtains the output commands from the main controller via the common CAN bus, and verifies the rationality of the commands (e.g., whether the steering command is within physical limits) in conjunction with the vehicle status (e.g., vehicle speed, steering angle), and checks whether the timing of the command transmission conforms to logic. If unreasonable commands or disordered timing are found, the main controller is determined to be logically faulty.

[0129] (3) Perform redundant subsystem detection: Monitor the working status (such as speed, angle, and pressure) of the drive, steering, and braking units in real time through local sensors (such as motor encoders, angle sensors, and pressure sensors) of each corner module. Cross-compare the monitoring data with the expected values ​​of the system and the data of the health module. If the parameters of a certain corner module are continuously abnormal (such as motor stall, steering jam, or pressure loss), then the corner module is determined to be faulty.

[0130] 2. Fault Classification: Based on the degree of impact of the fault on system functionality and safety, faults are classified into three levels:

[0131] (1) Minor faults: These are faults that have little impact on the current operation of the system and will not immediately cause safety risks. For example, a single sensor may experience a brief data jump and then return to normal, or the performance of a non-critical component may be slightly degraded.

[0132] (2) Moderate fault: refers to a fault that causes partial limitation of system functions and performance degradation, requiring measures to maintain basic operation. For example, the output of the main DC-DC converter is unstable but the low-voltage battery can take over the power supply; the drive or steering function of a corner module fails; the main controller experiences periodic command delays.

[0133] (3) Serious faults: These are faults that cause the loss of critical system functions and directly threaten driving safety. For example, the main controller may completely shut down and switch abnormally; multiple corner modules may fail simultaneously, leading to the risk of vehicle loss of control; or critical power circuits may completely fail.

[0134] 3. Corresponding actions (degraded operation strategy): The corresponding control strategy is immediately triggered based on the fault level:

[0135] (1) Minor fault: The system issues an audible and visual alarm or a remote alarm, records the fault log, but maintains the current normal operating status and reminds the operator to pay attention.

[0136] (2) Moderate fault: Triggering a speed reduction strategy. The system automatically limits the vehicle's maximum speed to reduce the system load. At the same time, the system reconfigures functions based on the specific fault point. For example, when a drive motor fails, the system switches to three-wheel drive mode and maintains straight-line stability by adjusting the torque output of the remaining healthy wheels (differential torque compensation); when a steering motor fails, the system switches to two-wheel steering mode or uses differential steering to achieve steering function.

[0137] (3) Serious Failure: Immediately triggers the emergency stop strategy. The system prioritizes safety, applies controllable emergency braking in conjunction with the ABS anti-lock braking system, and may utilize the drive motor to generate counter-draft torque to bring the vehicle to a quick and smooth stop. After stopping, the system cuts off the power to high-risk components and maintains the braking state, while issuing the highest level alarm.

[0138] Fault-tolerant control strategy: For different fault types of corner modules, corresponding fault-tolerant control strategies are adopted. For example, if the drive motor fails, a 3-wheel drive mode is adopted; if the steering motor fails, a 2-wheel steering mode or differential steering is adopted.

[0139] Specific fault tolerance control strategies:

[0140] The severity and scope of failures in the execution subsystem are classified into "single-angle → dual-angle → multi-angle → emergency scenario," corresponding to different failure modes:

[0141] Table 1 Failure Mode Correspondence Table

[0142]

[0143] Corresponding action: Layered and progressive fault-tolerant control strategy

[0144] The fault diagnosis and safety control strategy module executes layered actions of "partial reconstruction → speed reduction compensation → emergency braking" according to different levels, prioritizing "driving safety → vehicle controllability → gradual stopping":

[0145] (1) Single-corner module failure → Local function reconstruction and torque redistribution

[0146] Focusing on "failed corner modules exiting and normal corner modules taking over," vehicle performance is maintained through dynamic torque distribution:

[0147] Drive failure: When the motor of the faulty corner module is de-energized, the main controller will redistribute the drive torque according to the ratio of "number of remaining corner modules + vehicle speed" (if the front wheel drive fails, the rear wheel will compensate for the torque) to ensure a stable total drive force.

[0148] Steering failure: The fault angle module steering mechanism in "follow-up mode" passively steers in accordance with the vehicle's posture. The drive system compensates for understeer / oversteer through differential control (adjusting the speed difference between the left and right wheels) and, in conjunction with the electronic stability program (ESC), fine-tunes the vehicle's posture.

[0149] Braking failure: The brake circuit of the fault angle is depressurized, and the main controller redistributes the braking torque to the remaining angle modules (if the brake of one axle fails, the torque of the other axle is increased), and the deceleration is limited according to the brake pedal opening.

[0150] (2) Dual-angle module fails to function → Reduce speed operation + drive reaction torque compensation braking

[0151] Because the failure of both corners simultaneously affects the vehicle's symmetry and redundancy, a two-pronged approach of "speed reduction + coordinated power braking" is required:

[0152] Forced speed limit: The vehicle speed is reduced linearly through the main controller, reducing the load on the braking system;

[0153] Drive counter-torque compensation: The drive motor of the remaining normal angle module uses the motor's reverse torque (counter-torque) to generate braking force, which compensates for the braking gap after the failure of the double angle module. At the same time, ABS prevents the drive wheels from locking up and ensures braking stability.

[0154] (3) Multi-corner module composite function failure → Emergency scenario takeover and dynamic torque adjustment

[0155] After a multi-angle composite failure, conventional strategies fail, triggering "limit torque control" to ensure safety:

[0156] Drive Slip Control (TCS) Dominant: Apply maximum braking force to the slipping wheel and output maximum driving force to the gripping wheel (torque vector limit control) to suppress wheel spin and correct vehicle yaw / roll.

[0157] Tire blowout emergency: Locate the blowout side using inertial navigation data, apply directional braking force to the wheels on that side (reduce vehicle speed and suppress lateral deviation), and simultaneously adjust the driving force / braking force of the wheels on the other side to maintain the vehicle's straight-line driving trend, gradually reducing speed to a stop.

[0158] 4 Emergency Scenarios → Hardcore Strategies for Safe Parking

[0159] For extreme operating conditions that directly threaten safety, implement "maximum braking + system isolation":

[0160] Emergency stop (ABS + drive reaction torque): Immediately activate ABS (individual wheel speed control) + drive reaction torque (full braking by motor), cut off unnecessary high-voltage loads (such as superstructure equipment), and reduce the vehicle speed to 0;

[0161] This invention designs a redundant fault-tolerant control system for a distributed drive-by-wire chassis. This system achieves high-reliability operation of the drive-by-wire chassis system through multi-level redundancy design (including power redundancy, dual-controller hot backup redundancy, and independent control of the four corner modules with mutual redundancy) combined with a software degradation fault-tolerant mechanism. The system includes components such as a DC-DC converter, a low-voltage battery, dual controllers, four distributed corner modules, and various sensors, and is equipped with corresponding fault diagnosis and safety control strategies. The core of this invention lies in ensuring that the system can maintain basic safety functions even in the event of a single or multiple component failures through the coordinated design of hardware redundancy and software fault tolerance, significantly improving the safety and reliability of autonomous vehicles.

[0162] Example 2:

[0163] The present invention will be further described below with reference to the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solutions of the present invention and should not be construed as limiting the scope of protection of the present invention. The drawings and reference numerals involved in the embodiments of the present invention include: Figure 5 (System overall framework diagram) Figure 6 (Power redundancy system architecture diagram) Figure 7 (Dual controller hot backup switching solution) Figure 8 (Distributed corner module redundancy) Figure 9 (Diagram of fault analysis and control strategy for abnormal scenarios); The components in the diagram include: main controller 1, backup controller 2, main DC-DC converter 4, low-voltage battery 5, left front corner module drive motor 9, left front corner module steering motor 10, left front corner module brake actuator 11, right front corner module drive motor 12, right front corner module steering motor 13, right front corner module brake actuator 14, left rear corner module drive motor 15, left rear corner module steering motor 16, left rear corner module brake actuator 17, right rear corner module drive motor 18, right rear corner module steering motor 19, right rear corner module brake actuator 20; The buses include: CAN2 (front axle brake bus), CAN3 (front axle drive and steering bus), CAN4 (main and backup controller interaction bus), CAN5 (rear axle drive and steering bus), CAN6 (rear axle brake bus), and CAN8 (DC-DC and expansion bus).

[0164] like Figure 5As shown, the overall framework of the system of this invention includes a power redundancy subsystem, a control redundancy subsystem, an execution redundancy subsystem, and a fault diagnosis and safety control strategy module. These subsystems are interconnected via a high-speed CAN bus, forming a hierarchical redundancy architecture. The power redundancy subsystem provides dual independent power to the main DC-DC converter 4 and the low-voltage battery 5. The control redundancy subsystem includes a main controller 1 and a backup controller 2, operating in hot backup mode. The execution redundancy subsystem consists of four distributed corner modules, each integrating a drive motor, a steering motor, and a brake actuator (e.g., the left front corner module includes a drive motor 9, a steering motor 10, and a brake actuator 11). The fault diagnosis and safety control strategy module communicates with each subsystem to achieve real-time fault detection and degraded control. The system achieves data sharing and command synchronization through a multi-bus architecture, where CAN3, CAN5, CAN2, and CAN6 are used for communication of different functions, ensuring redundancy isolation.

[0165] like Figure 6 As shown, the power redundancy subsystem adopts a dual-path independent power supply architecture, including a main DC-DC converter 4 and a low-voltage battery 5. The main DC-DC converter 4 connects to the vehicle's high-voltage power supply, outputting 12V low-voltage electricity, and communicates with the DC-DC communication management unit via CAN8 (DCDC and extension bus) to monitor output voltage, current, and temperature parameters in real time. The low-voltage battery 5 serves as a backup power source, automatically switching power supply in case of a failure of the main DC-DC converter 4. In practice, both the main DC-DC converter 4 and the low-voltage battery 5's power supply circuits are equipped with anti-reverse diodes to prevent short circuits from affecting the bus voltage. When the DC-DC communication management unit detects an abnormal output voltage (e.g., below 11V or above 13V), current overload, or temperature exceeding 85℃, the control circuit shuts down the enable output of the main DC-DC converter 4 and cuts off its front-end input, switching to power supply from the low-voltage battery 5, with a switching response time of less than 10ms. Simultaneously, the system prioritizes power supply to critical functions (such as steering and braking) and shuts down non-critical loads (such as lights) to extend battery life.

[0166] like Figure 7As shown, the control redundancy subsystem adopts a homogeneous dual-controller design, including a main controller 1 and a backup controller 2. Main controller 1 and backup controller 2 use CAN4 (main / backup controller interaction bus) for heartbeat confirmation and state synchronization. The heartbeat signal interval is 100ms, and the timeout is determined by 300ms (three consecutive heartbeats not received). Simultaneously, main controller 1 and backup controller 2 share sensor data via a common CAN bus (such as CAN3 or CAN5). State synchronization uses an incremental transmission mechanism, transmitting only state changes to reduce bus load. Fault detection employs a multi-index fusion decision algorithm: backup controller 2 detects the heartbeat signal of main controller 1 via CAN4 and verifies the rationality and timing consistency of main controller 1's output commands (e.g., whether the steering angle command is within the range of -30° to +30°) via the common CAN bus. When the heartbeat is abnormal and the command is unreasonable, a switching process is triggered, using a smooth transition algorithm: backup controller 2 inherits the last valid state of main controller 1 and takes over control within 50ms, limiting the control command change rate to ±5% / ms to avoid vehicle vibration.

[0167] like Figure 8 As shown, the redundant execution subsystem includes four distributed corner modules: front left corner module 21 (drive motor 9, steering motor 10, brake actuator 11), front right corner module 22 (drive motor 12, steering motor 13, brake actuator 14), rear left corner module 23 (drive motor 15, steering motor 16, brake actuator 17), and rear right corner module 24 (drive motor 18, steering motor 19, brake actuator 20). These corner modules are interconnected via a multi-bus communication architecture to achieve functional isolation and redundancy.

[0168] The left front corner module drive motor 9 and steering motor 10 share CAN3 (front axle drive and steering bus) with the right front corner module drive motor 12 and steering motor (13).

[0169] The left rear corner module drive motor 15 and steering motor 16 share CAN5 (rear axle drive and steering bus) with the right rear corner module drive motor 18 and steering motor 19.

[0170] The left front corner module brake actuator 11 and the right front corner module brake actuator 14 share CAN2 (front axle brake bus).

[0171] The left rear corner module brake actuator 17 and the right rear corner module brake actuator 20 share CAN6 (rear axle brake bus).

[0172] This design makes the corner modules redundant. When a single corner module fails, the system can reconfigure its functions using the remaining healthy corner modules. For example, when the drive motor 9 of the left front corner module fails, the system switches to three-wheel drive mode and maintains straight-line driving through differential torque compensation (torque difference between left and right wheels ≤ 10%). When the steering motor 10 of the left front corner module fails, a two-wheel steering mode or a differential steering mode is used (left and right wheel speed difference adjusted ± 5%).

[0173] The above embodiments fully illustrate the implementation of the present invention, and those skilled in the art can reproduce the system based on the accompanying drawings and markings. The present invention achieves highly reliable drive-by-wire chassis control through the synergy of hardware redundancy and software fault tolerance, and is suitable for wheeled engineering machinery such as unmanned sweepers and logistics vehicles.

[0174] Example 3:

[0175] This embodiment provides a redundancy-tolerant control method for a distributed drive-by-wire chassis, based on the system described in Embodiment 2, including:

[0176] 1. Power redundancy control method:

[0177] Uninterrupted power supply is achieved through a dual-power supply architecture. Under normal conditions, the DC-DC converter provides power and float charges the battery; when a DC-DC fault is detected, it automatically switches to battery power supply, prioritizing the power supply for critical functions.

[0178] 2. Redundancy control methods:

[0179] Seamless switching is achieved through dual-controller hot backup. The primary and backup controllers operate synchronously. Faults in the primary controller are detected based on a multi-index fusion decision algorithm, and a smooth transition algorithm is used to achieve switching, ensuring control continuity.

[0180] 3. Implement redundancy and fault-tolerant control methods:

[0181] Functional reconfiguration is achieved through redundancy between corner modules. When a single corner module fails, a fault-tolerant control algorithm is employed.

[0182] Drive motor failure: Three-wheel drive mode is used, and straight-line driving is maintained through differential torque compensation;

[0183] Steering motor malfunction: Use two-wheel steering mode or differential steering mode.

[0184] 4. Fault diagnosis and safety policy implementation methods:

[0185] System safety is ensured through real-time monitoring and tiered processing. Fault diagnosis is implemented based on multi-sensor information fusion, and corresponding handling strategies are triggered according to the severity of the fault: alarm, reduced speed operation, or emergency shutdown.

[0186] like Figure 9 As shown, the fault diagnosis and safety control strategy module implements real-time fault detection and hierarchical processing based on multi-sensor information fusion. Fault detection covers the power redundancy subsystem, control redundancy subsystem, and execution redundancy subsystem.

[0187] Power supply detection: The parameters of the main DC-DC converter 4 are monitored through the DC-DC communication management unit, and switching is triggered when an abnormality occurs;

[0188] Control detection: Backup controller 2 detects the heartbeat of main controller 1 via CAN4 and verifies commands via the common CAN bus;

[0189] Execution detection: Monitor the status of each unit through local sensors in the corner module (such as motor encoders and angle sensors) and cross-compare with the expected values.

[0190] The fault is divided into three levels:

[0191] Minor faults (such as sensor data fluctuations <1s): trigger the alarm strategy, the system issues an audible and visual alarm or a remote alarm, and maintains normal operation;

[0192] Moderate faults (such as unstable output of the main DC-DC converter 4, or partial failure of a single corner module): trigger a speed reduction operation strategy, limit the vehicle speed to 20km / h, and perform functional reconfiguration (such as using three-wheel drive when the drive motor fails).

[0193] Serious malfunction (such as main controller 1 crash or multiple corner module failures): triggers emergency stop strategy, combines ABS and drive motor reverse drag torque to implement braking (deceleration ≥ 0.5g), and smoothly stops within 5 seconds.

[0194] For multi-fault scenarios, such as Figure 9 As shown, the system performs layered control: for dual-corner module failures, the speed is forcibly limited to 15km / h, and braking is compensated by the drive counter-torque; for multi-corner module failures, limit torque control is triggered, and vehicle stability is maintained through torque vector adjustment; for emergency scenarios such as tire blowouts, directional braking is combined with inertial navigation data to maintain straight-line driving.

[0195] The key technical points of this invention include:

[0196] 1. Multi-level redundant architecture design:

[0197] A redundant architecture integrating power supply, control, and execution is proposed, which solves the problem of independent redundancy and lack of coordination among subsystems in traditional designs. It achieves deep integration of hardware redundancy and software fault tolerance, and maximizes the fault tolerance effect of limited hardware resources through software processing logic.

[0198] 2. Dual-standby controller hot backup and synchronization technology

[0199] An independent bus is used between the primary and backup controllers to implement a state synchronization incremental transmission mechanism, transmitting only state changes rather than all data. Other data is obtained through a shared bus, significantly reducing the load on the synchronization bus. Simultaneously, a multi-indicator fusion monitoring algorithm (heartbeat + command rationality monitoring) confirms the switching command, employing transition synchronization and smooth transition algorithms to prevent sudden changes in control commands that could cause vehicle vibration. After taking over from the primary controller, it inherits the last valid state of the primary controller, ensuring control continuity.

[0200] 3. Redundancy mechanism of distributed corner modules

[0201] A distributed control architecture with four corner modules is proposed. The corner modules achieve redundancy by integrating independent drive, steering, and braking functions, and regional and functional redundancy is achieved through a communication architecture. At the same time, the single-point failure limitation of traditional centralized control is overcome through the coordinated control of each module.

[0202] 4. Integration of fault diagnosis and safety strategy: A multi-dimensional fault diagnosis and hierarchical safety strategy has been established to realize an adaptive degradation strategy for distributed drive-by-wire chassis, balancing safety and operational efficiency.

[0203] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0204] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0205] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0206] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0207] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A redundant fault-tolerant control system for a distributed drive-by-wire chassis, characterized in that, include: The power redundancy subsystem, including the main DC-DC converter and low-voltage batteries, provides dual independent power supply and has power monitoring and switching functions. The control redundancy subsystem includes a main controller and a backup controller with identical hardware configurations and interconnected via a CAN bus, configured to operate in hot backup mode and achieve seamless fault switching. The redundant subsystem includes four distributed corner modules. Each corner module integrates a drive motor, a steering motor, a brake actuator, and a local sensor. The four corner modules are interconnected through a multi-bus communication architecture to form a redundant relationship. The fault diagnosis and safety control strategy module is communicatively connected to the power redundancy subsystem, control redundancy subsystem, and execution redundancy subsystem, and is used to perform real-time fault detection, fault classification, and trigger degraded operation strategies.

2. The redundant fault-tolerant control system for a distributed drive-by-wire chassis according to claim 1, characterized in that, The method by which the fault diagnosis and safety control strategy module performs real-time fault detection, fault classification, and triggers a degraded operation strategy includes: Fault detection is performed on the power redundancy subsystem, control redundancy subsystem, and execution redundancy subsystem respectively; If a fault is detected, the fault is classified to obtain the fault level; The degradation operation strategy is triggered based on the fault level.

3. The redundant fault-tolerant control system for a distributed drive-by-wire chassis according to claim 1, characterized in that, The power redundancy subsystem also includes a DC-DC communication management unit, which is configured to monitor the output voltage, current and temperature parameters of the main DC-DC converter in real time. When any one of the output voltage, current and temperature parameters of the main DC-DC converter exceeds the set range, the control circuit shuts down the DC-DC enable output and cuts off the DC-DC front-end input, and supplies power from the low-voltage battery. Both the main DC-DC converter and the low-voltage battery power supply circuit are equipped with anti-reverse diodes.

4. The redundant fault-tolerant control system for a distributed drive-by-wire chassis according to claim 1, characterized in that, In the control redundancy subsystem, the main controller and the backup controller use an independent CAN bus for heartbeat confirmation and status synchronization, and share sensor data through a shared CAN bus; the status synchronization adopts an incremental transmission mechanism.

5. The redundant fault-tolerant control system for a distributed drive-by-wire chassis according to claim 1, characterized in that, The control redundancy subsystem employs a multi-index fusion decision algorithm for fault detection and switching. The algorithm includes detecting anomalies through heartbeat signals and verifying the rationality and timing consistency of the main controller's output commands.

6. The redundant fault-tolerant control system for a distributed drive-by-wire chassis according to claim 1, characterized in that, The four distributed corner modules include a front left corner module, a rear left corner module, a front left left corner module, and a rear left corner module; each corner module integrates a drive motor, a steering motor, a brake actuator, and a local sensor. The four corner modules are interconnected through a multi-bus communication architecture to form a redundant relationship.

7. The redundant fault-tolerant control system for a distributed drive-by-wire chassis according to claim 6, characterized in that, The multi-bus communication architecture of the execution redundancy subsystem is as follows: The drive and steering units of the left front corner module and the right front corner module share the first CAN bus; The drive and steering units of the left rear corner module and the right rear corner module share the second CAN bus; The braking unit of the left front corner module shares the third CAN bus with the braking unit of the right front corner module; The braking unit of the left rear corner module shares the fourth CAN bus with the braking unit of the right rear corner module.

8. A redundancy-tolerant control method for a distributed drive-by-wire chassis, characterized in that, The system described in any one of claims 1-7 comprises: The power redundancy subsystem provides dual independent power supply, monitors power parameters in real time, and automatically switches to low-voltage battery power supply when the main DC-DC converter fails. Hot backup operation of the main controller and standby controller is achieved by controlling the redundant subsystem. Faults in the main controller are detected based on a multi-index fusion decision algorithm, and seamless switching is achieved. The four distributed corner modules are made redundant by executing a redundant subsystem. When a corner module failure is detected, a fault-tolerant control algorithm is used to reconfigure the functions of the remaining healthy corner modules. The system status is monitored in real time through the fault diagnosis and safety control strategy module, multi-level fault diagnosis is performed, and corresponding degradation operation strategies are triggered according to the severity of the fault.

9. The redundancy-tolerant control method for a distributed drive-by-wire chassis according to claim 8, characterized in that, The seamless switching process of the control redundancy subsystem includes: The backup controller detects the heartbeat signal of the main controller via an independent CAN bus and verifies the rationality and timing consistency of the main controller's output commands via a shared CAN bus. A smooth transition algorithm is used during the switchover, and the backup controller takes over control after inheriting the last valid state of the main controller. And / or, The fault-tolerant control algorithm includes: When the drive motor fails, a three-wheel drive mode is adopted and the vehicle's straight-line capability is maintained through differential torque compensation; When the steering motor fails, use two-wheel steering mode or differential steering mode; When the brake actuator fails, the braking torque is redistributed to the remaining healthy angle modules.

10. The redundancy-tolerant control method for a distributed drive-by-wire chassis according to claim 8, characterized in that, Perform multi-level fault diagnosis and trigger corresponding degradation operation strategies based on the severity of the fault, including: Fault detection is implemented based on multi-sensor information fusion technology, and the fault detection covers power redundancy subsystem, control redundancy subsystem and execution redundancy subsystem; The faults are classified into three levels: minor faults, moderate faults, and severe faults. When the fault is minor, the alarm strategy is triggered to issue an audible and visual alarm or a remote alarm, but the current operating status is maintained. When the fault is classified as a moderate fault, a speed reduction operation strategy is triggered, which automatically limits the vehicle's maximum speed and performs functional reconfiguration. When the fault is a serious fault, the emergency stop strategy is triggered, which combines the ABS anti-lock braking system and the reverse drag torque of the drive motor to implement controllable braking and bring the vehicle to a smooth stop.

Images