Drive-by-wire system and vehicle

Abstract

The invention discloses a drive-by-wire system and a vehicle, and relates to the technical field of vehicles. The drive-by-wire system comprises a first control loop and a second control loop which are redundant to each other, the first control loop comprises a first turn-off module, a first power module, a first pre-drive chip and a first main control module which are connected in sequence, and the first turn-off module is further connected with the first main control module and is suitable for being connected with a first preset power supply; the first power module is suitable for being connected with controlled equipment; the first main control module is used for outputting a first fault notification signal to a second main control module in the second control loop when determining that the first control loop has a fault, so that the second control loop starts control and controls the first pre-drive chip to stop driving the first power module; and controlling the first turn-off module to disconnect the power supply connection of the first power module, thereby not only enabling the second control loop to take over the control right in time, but also enabling the first control loop to enter a safe state in time, and improving the safety and reliability of the drive-by-wire system.

Description

Technical Field

[0001] This invention relates to the field of vehicle technology, and more particularly to a drive-by-wire system and a vehicle. Background Technology

[0002] In the field of vehicle functional safety, especially in systems involving ASILD (Automotive Safety Integrity Level D) (such as drive-by-wire systems), redundant safety architecture is a common technical approach. This architecture typically includes independent main control and backup control systems, designed to ensure functional continuity when a single point of failure occurs in one control loop, with the other loop taking over.

[0003] However, the redundancy architecture design in related technologies primarily focuses on the physical isolation and independent operation of loops. In practice, the fault state coordination mechanism between the main control system and the backup control system is not yet perfect. This may lead to situations where, when the main control system fails, the backup system cannot obtain the fault state of the main system in a timely or accurate manner, resulting in delayed or incorrect takeover; or the main system may fail to enter a safe state as intended after a fault. These situations may affect the achievement of the overall functional safety objectives of the system and increase system safety risks. Summary of the Invention

[0004] The purpose of this invention is to provide a drive-by-wire system and vehicle to improve the safety and reliability of the drive-by-wire system.

[0005] In a first aspect, embodiments of the present invention provide a wired control system, comprising: a first control loop and a second control loop that are redundant with each other. The first control loop includes a first shutdown module, a first power module, a first pre-driver chip, and a first main control module connected in sequence. The first shutdown module is also connected to the first main control module and is adapted to connect to a first preset power supply. The first power module is adapted to connect to a controlled device. The first main control module is used to output a first fault notification signal to the second main control module in the second control loop when a fault is determined to occur in the first control loop, so as to enable the second control loop to start control, control the first pre-driver chip to turn off the drive of the first power module, and control the first shutdown module to disconnect the power supply connection of the first power module.

[0006] In some embodiments, when the first main control module determines that the first control loop has failed, it is specifically configured to: determine that the first control loop has failed when at least one of the following occurs: the first main control module fails, a second fault notification signal is received from the first pre-driver chip, or the first control loop needs to enter a safe state.

[0007] In some embodiments, the first main control module is further configured to perform a hardware safety circuit check when the first control circuit is powered on or initialized, and control the first shutdown module to disconnect the power supply connection between the first preset power supply and the first power module when the check fails.

[0008] In some embodiments, the first control loop further includes a first power management module, which is connected to the first main control module and adapted to connect to the first preset power supply, for processing the voltage provided by the first preset power supply and supplying the processed voltage to the first main control module.

[0009] In some embodiments, the first main control module is further configured to output a third fault notification signal to the first power management module when a fault is detected in the first main control module; wherein, the first power management module is further configured to output a reset signal to the first main control module to reset the first main control module when a fault is detected in the first power management module or when the third fault notification signal is received.

[0010] In some embodiments, the first power management module is also connected to the first shutdown module and the second main control module, and is further configured to control the first shutdown module to disconnect the power supply connection of the first power module and output a fourth fault notification signal to the second main control module when a fault is detected in the first power management module or the third fault notification signal is received, so as to enable the second control loop to start control; or, the first power management module is also connected to the first pre-driver chip and is further configured to control the first pre-driver chip to turn off the drive of the first power module when a fault is detected in the first power management module or the third fault notification signal is received.

[0011] In some embodiments, the first power management module is further configured to perform a hardware safety circuit check when the first control circuit is powered on or initialized, and control the first shutdown module to disconnect the power supply connection of the first power module when it is determined that the check fails.

[0012] In some embodiments, the first main control module is also connected to the second main control module via a controller local area network and / or a serial port, and is further configured to output status notification information to the second main control module via the controller local area network and / or the serial port when it is determined that a fault has occurred in the first control loop.

[0013] In some embodiments, the first shutdown module includes: a first unidirectional conduction circuit, a second unidirectional conduction circuit, a filter circuit, and a switching circuit; wherein, a first terminal of the first unidirectional conduction circuit is connected to the first main control module, a first terminal of the second unidirectional conduction circuit is connected to the first power management module, a second terminal of the first unidirectional conduction circuit is connected to the control terminal of the switching circuit, a first terminal of the filter circuit, and a second terminal of the second unidirectional conduction circuit, a first terminal of the switching circuit is adapted to be connected to the first preset power supply, a second terminal of the switching circuit is connected to the first power module, and a second terminal of the filter circuit is grounded.

[0014] In a second aspect, embodiments of the present invention provide a vehicle comprising: the drive-by-wire system (100) described in the first aspect embodiment.

[0015] The drive-by-wire system and vehicle of this invention employ redundant first and second control loops. When a fault occurs in the first control loop, on the one hand, the first main control module outputs a first fault notification signal to the second main control module in the second control loop, causing the second control loop to initiate control and thus promptly take over control. On the other hand, the first main control module controls the first pre-drive chip to shut down the drive of the first power module and controls the first shutdown module to disconnect the power supply to the first power module, thereby enabling the first control loop to promptly enter a safe state and stop drive control. This improves the safety and reliability of the drive-by-wire system, reducing or avoiding situations that could lead to vehicle loss of control or other dangerous situations. Attached Figure Description

[0016] Figure 1 This is a schematic diagram of the structure of a wire-controlled system according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the structure of a wire-controlled system according to another embodiment of the present invention; Figure 3 This is a schematic diagram of the structure of a wire-controlled system according to another embodiment of the present invention; Figure 4 This is a circuit topology diagram of the first shutdown module according to an embodiment of the present invention; Figure 5 This is a flowchart of the working process of a wire-controlled system according to an embodiment of the present invention; Figure 6 This is a structural block diagram of a vehicle according to an embodiment of the present invention. Detailed Implementation

[0017] Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the present invention, and should not be construed as limiting the present invention.

[0018] The drive-by-wire system and vehicle of embodiments of the present invention are described below with reference to the accompanying drawings.

[0019] Figure 1 This is a schematic diagram of the structure of a wire-controlled system according to an embodiment of the present invention.

[0020] like Figure 1 As shown, the drive-by-wire system 100 (such as a drive-by-wire steering system, a drive-by-wire braking system, etc.) includes: a first control loop 10 and a second control loop 20 that are redundant with each other. The first control loop 10 includes a first shutdown module 11, a first power module 12 (such as a three-phase bridge), a first pre-drive chip 13, and a first main control module 14 connected in sequence. The first shutdown module 11 is also connected to the first main control module 14 and is adapted to be connected to a first preset power supply BAT1 (such as the vehicle's low-voltage power supply, which can be 12V). The first power module 12 is adapted to be connected to the controlled equipment (such as a steering motor, a brake motor, etc.).

[0021] In this embodiment, the first main control module 14 is used to output a first fault notification signal to the second main control module 24 in the second control loop 20 when a fault is determined to occur in the first control loop 10. This causes the second control loop 20 to start control, control the first pre-driver chip 13 to shut down the drive to the first power module 12, and control the first shutdown module 11 to disconnect the power supply connection to the first power module 12. The second control loop 20 and the first control loop 10 can adopt a fully redundant design, with the same structure and function. See [link to documentation]. Figure 1 The second control loop 20 also includes a second shutdown module 21, a second power module 22 (such as a three-phase bridge), and a second pre-driver chip 23. The second shutdown module 21 is also connected to the second main control module 24 and is adapted to connect to the second preset power supply BAT2. The second preset power supply BAT2 and the first preset power supply BAT1 may or may not share the same power supply.

[0022] For example, see Figure 1The first main control module 14 includes the main chip MCU (Micro Control Unit) itself and its peripheral control circuits. The functional safety level of the first main control module 14 is ASILD. The first main control module 14 controls the first pre-driver chip 13 by controlling the enable pin EN and the PWM (Pulse Width Modulation) waveform output, thereby driving or shutting down the first power module 12. At the same time, the first main control module 14 has its own dedicated fault output pins, including: a pin connected to the first shutdown module 11, a pin connected to the second main control module 24 (such as an I / O port), and a pin connected to the first pre-driver chip 13.

[0023] Optionally, the first main control module 14 can also control the first pre-driver chip 13 via SPI (Serial Peripheral Interface). Specifically, this may include: enabling high-speed, synchronous communication between the first main control module 14 and the first pre-driver chip 13 for configuring, monitoring, and controlling the operating status of the first pre-driver chip 13, such as dynamic dead-time adjustment, fault protection linkage, and parameter calibration. The first main control module 14 may also be equipped with an ADC (Analog-to-Digital Converter) module to acquire analog signals such as current, temperature, and voltage from the first power module 12. The first main control module 14 may also be equipped with peripheral modules, such as a SENT (Single Edge Nibble Transmission) module and a CAN (Controller Area Network) transceiver module, responsible for acquiring information used by the wire control system 100 (such as motor position signals).

[0024] The main function of the first shutdown module 11 is to control the first preset power supply BAT1 to supply power to the first power module 12. For example, under normal circumstances, the first main control module 14 outputs a high level control signal CONTRL, the first shutdown module 11 is turned on, and the first preset power supply BAT1 normally supplies power to the first power module 12; when a safety-critical fault occurs, CONTRL is low, which can shut down the power supply to the first power module 12, thereby putting the first control loop 10 into a safe state.

[0025] Taking a three-phase bridge as an example where the first power module 12 is the controlled device and the motor is the controlled device, the first pre-driver chip 13 can have six PWM signal input ports and six PWM drive ports to control the three-phase bridge to drive the motor. Meanwhile, the first pre-driver chip 13 has an ASILD functional safety level and diagnostic capabilities; the NFAULT and Driver OFF signal pins correspond to its functional safety-related pins.

[0026] The drive-by-wire system 100 employs a redundant first control loop 10 and a second control loop 20. When the first control loop 10 malfunctions, on the one hand, the first main control module 14 outputs a first fault notification signal to the second main control module 24 in the second control loop 20, causing the second control loop 20 to initiate control and thus promptly take over control. On the other hand, the first main control module 14 controls the first pre-drive chip 13 to shut down the drive to the first power module 12 and controls the first shutdown module 11 to disconnect the power supply to the first power module 12, thereby enabling the first control loop 10 to promptly enter a safe state and stop drive control. This improves the safety and reliability of the drive-by-wire system 100, reducing or avoiding situations that could lead to vehicle loss of control or other dangerous situations.

[0027] In some embodiments of the present invention, when the first main control module 14 determines that the first control loop 10 has failed, it is specifically used to: determine that the first control loop 10 has failed when at least one of the following occurs: the first main control module 14 fails, the first pre-drive chip 13 sends a second fault notification signal, or the first control loop 10 needs to enter a safe state.

[0028] See Figure 1 When the first main control module 14 malfunctions and is detected by its own safety mechanism, it can directly output a first fault notification signal to the second main control module 24 through its dedicated fault pin, so that the second control loop 20 can start control. At the same time, the first main control module 14 also outputs a driver OFF signal to the first pre-driver chip 13 through a dedicated fault shutdown pin, so as to control the first pre-driver chip 13 to shut down the drive of the first power module 12, and outputs a shutdown control signal CONTRL to the first shutdown module 11, so as to control the first shutdown module 11 to disconnect the power supply connection of the first power module 12, ensuring that the first control loop 10 enters a safe state.

[0029] When the first pre-driver chip 13 malfunctions and is detected by its own safety mechanism, it can output a second fault notification signal NFAULT (via I / O port) to the first main control module 14 through its dedicated fault pin. After arbitration, the first main control module 14 can directly output the first fault notification signal to the second main control module 24 through its dedicated fault pin, so that the second control loop 20 can start control. At the same time, the driver OFF and CONTRL signals are output through the fault shutdown pin to shut down the first power module 12 drive and its drive power supply, ensuring that the first control loop 10 enters a safe state.

[0030] When the first main control module 14 determines through arbitration that the first control loop 10 needs to enter a safe state (e.g., a calculation error occurs in an important external sensor of the drive-by-wire system 100), it can directly output a first fault notification signal to the second main control module 24 through its dedicated fault pin, so that the second control loop 20 can start control. At the same time, the driver OFF and CONTRL signals are output through the fault shutdown pin to shut down the first power module 12 and its drive power supply, ensuring that the first control loop 10 enters a safe state.

[0031] In some embodiments of the present invention, the first main control module 14 is further configured to perform a hardware safety circuit check when the first control circuit 14 is powered on or initialized, and control the first shutdown module 11 to disconnect the power supply connection between the first preset power supply BAT1 and the first power module 12 when the check fails.

[0032] According to functional safety requirements, a safety mechanism can be defined to prevent a fault from becoming a latent fault. Since multiple points of random hardware failure may become latent faults, this invention sets up a self-test as a safety mechanism for detecting multiple points of failure. Specifically, it may include: when the first main control module 14 is powered on or initialized, it performs a hardware safety circuit check; and if the check fails, it controls the first shutdown module 11 to shut down VBAT to supply power to the first power module 12 via the control signal CONTRL, causing the first power module 12 to stop working, thereby preventing the checked hardware safety circuit fault from becoming a latent fault.

[0033] In some embodiments of the present invention, such as Figure 2 As shown, the first control loop 10 also includes a first power management module 15, which is connected to the first main control module 14 and adapted to connect to a first preset power supply BAT1. The first power management module 15 processes the voltage provided by the first preset power supply BAT1 and supplies the processed voltage to the first main control module 14. Correspondingly, see [link to relevant documentation]. Figure 2 The second control loop 20 also includes a second power management module 25, which is connected to the second main control module 24 and is adapted to connect to the second preset power supply BAT2. It is used to process the voltage provided by the second preset power supply BAT2 and supply the processed voltage to the second main control module 24.

[0034] The first power management module 15 may include an SBC (System Basis Chip), which includes the chip itself and peripheral power management circuitry. Its power supply comes from the first preset power supply BAT1. It can filter the voltage provided by the first preset power supply BAT1, perform reverse connection protection, and supply power to the first main control module 14.

[0035] For example, the first main control module 14 is further configured to output a third fault notification signal FCUU to the first power management module 15 when a fault is detected in the first main control module 14. The first power management module 15 is further configured to output a reset signal to the first main control module 14 to reset the first main control module 14 when a fault is detected in the first power management module 15 or when the third fault notification signal is received.

[0036] See Figure 2 The fault output pin of the first main control module 14 also includes a pin connected to the first power management module 15. Meanwhile, the first power management module 15 has a functional safety level of ASILD and is equipped with a dedicated fault output pin, including a pin connected to the first main control module 14 for outputting a reset signal RSTB.

[0037] As one implementation method, see Figure 2 The first power management module 15 is also connected to the first shutdown module 11 and the second main control module 24 respectively. It is also used to control the first shutdown module 11 to disconnect the power supply connection of the first power module 12 and output a fourth fault notification signal to the second main control module 24 when a fault is detected in the first power management module 15 or a third fault notification signal is received, so as to enable the second control loop 20 to start control.

[0038] See Figure 2 The fault output pin dedicated to the first power management module 15 may also include: a pin connected to the second main control module 24 (used to output the fourth fault notification signal FS0B) and a pin connected to the first shutdown module 11 (used to output the signal FS1B, which is generally delayed compared to FS0B).

[0039] As another implementation method, such as Figure 3 As shown, the first power management module 15 is also connected to the first pre-drive chip 13 and is also used to control the first pre-drive chip 13 to shut down the drive of the first power module 12 when a fault is detected in the first power management module 15 or a third fault notification signal is received.

[0040] See Figure 3 The pins of the first power management module 15 (output signal FS0B) and the first main control module 14 (output signal DriveOFF) are both connected to the first pre-driver chip 13. These two signals are ORed, and both can disable the drive output of the first pre-driver chip 13. Only the first main control module 14 can control the power-off of the first power module 12. It should be noted that disabling the drive output of the first pre-driver chip 13 (by controlling the switching transistor to cut off the current) avoids damage to the device due to back electromotive force compared to directly shutting off the power, but the response is slower. Circuit design should be adjusted according to actual conditions.

[0041] For example, the first power management module 15 is also used to perform a hardware safety circuit check when the first control circuit 14 is powered on or initialized, and to control the first shutdown module 11 to disconnect the power supply connection of the first power module 12 when the check fails.

[0042] See Figure 2 When the first control circuit 10 is powered on or initialized, the hardware safety circuit is checked to prevent latent faults caused by random hardware failures. It may also include: when the first power management module 15 is powered on or initialized, the hardware safety circuit is checked, and when the check fails, the first shutdown module 11 is controlled by the control signal FS1B to disconnect the power supply connection of the first power module 12.

[0043] In some examples, the first master control module 14 is also connected to the second master control module 24 via CAN and / or serial port, and is also used to output status notification information to the second master control module 24 via controller area network and / or serial port when a fault is determined to have occurred in the first control loop 10.

[0044] For example, see Figure 2 The first main control module 14 communicates with the second main control module 24 via a heterogeneous method using CAN and serial ports (such as UART (Universal Asynchronous Receiver / Transmitter)) to transmit detailed fault types (such as "clock error" and "CAN signal loss"), fault times, system status, etc., facilitating accurate decision-making by the second control loop 20; it also supports real-time status updates. Optionally, the first main control module 14 can integrate a CAN controller to handle protocol processing (such as frame format, arbitration, and error detection), and can convert the digital signals of the CAN controller into differential signals via a CAN transceiver module for connection to the CAN bus.

[0045] In some examples, such as Figure 4 As shown, the first shutdown module 11 includes: a first unidirectional conduction circuit 111, a second unidirectional conduction circuit 112, a filter circuit 113, and a switch circuit 114. The first terminal of the first unidirectional conduction circuit 111 is connected to the first main control module 14, the first terminal of the second unidirectional conduction circuit 112 is connected to the first power management module 15, the second terminal of the first unidirectional conduction circuit 111 is connected to the control terminal of the switch circuit 114, the first terminal of the filter circuit 113, and the second terminal of the second unidirectional conduction circuit 112, respectively. The first terminal of the switch circuit is adapted to connect to a first preset power supply BAT1, the second terminal of the switch circuit 114 is connected to the first power module 12, and the second terminal of the filter circuit 113 is grounded.

[0046] As one implementation method, see Figure 4 The first unidirectional conduction circuit 111 includes a first diode D1, the second unidirectional conduction circuit 112 includes a second diode D2 and a first resistor R1 connected in series, the filter circuit 113 includes a first capacitor C1 and a second resistor R2 connected in parallel, and the switching circuit 114 includes a switching transistor Q1. The cathode of the first diode D1 is connected to the first power management module 15 (to receive the FS1B signal), and the anode is connected to the control terminal (gate) of the switching transistor Q1; the cathode of the second diode D2 is connected to the first main control module 14 (to receive the CONTROL signal), and the cathode is connected to one end of the first resistor R1, while the other end of the first resistor R1 is connected to the control terminal of the switching transistor Q1. Of course, the positions of the second diode D2 and the first resistor R1 can be interchanged; one end of the second resistor R2 is connected to the control terminal of the switching transistor Q1, and the other end is grounded; the first terminal (e.g., the source) of the switching transistor Q1 is connected to the first shutdown module 11, and the second terminal (e.g., the drain) is connected to the first power module 12. Both the first diode D1 and the second diode D2 can be Schottky diodes.

[0047] See Figure 4 When either the FS1B signal or the CONTROL signal is low, the switch Q1 can be turned off; when both the FS1B signal and the CONTROL signal are high, the switch Q1 can be turned on.

[0048] by Figure 2 Taking the drive-by-wire system 100 as an example, as shown Figure 5 As shown, the workflow of the wire-controlled system 100 includes: S01, Power on and check the hardware safety circuit.

[0049] If the check fails, the workflow ends. If the check passes, the first control loop 10 enters the running state.

[0050] S02, a critical safety fault occurred in the first main control module.

[0051] When the first main control module 14 detects a safety-critical fault (such as abnormal clock frequency or program lag), the first main control module 14 sets the FCUU, CONTRL, and first fault notification signals to low level.

[0052] a. When the first power management module 15 receives a low-level FCUU signal, it determines that the first main control module 14 has a problem and sets FS0B, FS1B, and RSTB to low level; b. When the second main control module 24 receives a low-level first fault notification signal, it determines that there is a problem with the first control loop 10 and starts the second control loop 20. c. When the first shutdown module 11 receives a low-level CONTRL signal, it disconnects the first preset power supply BAT1, causing the first power module 12 to lose power. S03, a critical safety fault occurred in the first power management module.

[0053] When the first power management module 15 detects a safety-critical fault (e.g., power supply output overvoltage, abnormal clock frequency, etc.), it sets FS0B, FS1B, and RSTB to low level.

[0054] a. When the second main control module 24 receives a low-level FS0B signal, it determines that there is a problem with the first control loop 10 and starts the second control loop 20; b. When the first shutdown module 11 receives a low-level FS1B signal, it disconnects the first preset power supply BAT1, causing the first power module 12 to lose power. c. When the first main control module 14 receives a low-level RSTB signal, it will reset the first main control module 14.

[0055] S04, the first pre-driver chip has experienced a safety-critical failure.

[0056] When the first pre-driver chip 13 detects a fault in itself or a fault in the first power module 12 (such as a short circuit or open circuit), it notifies the first main control module 14 by setting the NFAULT signal to a low level. The first main control module 14 will actively set the first fault notification signal, CONTRL, and Driver OFF to a low level. At the same time, it can also communicate the status of the first control loop 10 to the second main control module 24 through CAN and serial port.

[0057] S05, determine that the first control loop needs to enter a safe state.

[0058] When the wired control system 100 determines through arbitration that the first control loop 10 needs to enter a safe state (e.g., a critical CAN signal is lost or damaged by interference, i.e., the fault is not from the first main control module 14 itself), it will proactively set the first fault notification signal, CONTRL, and Driver OFF to low level. Simultaneously, it will communicate the status of the first control loop 10 to the second main control module 24 via CAN and serial ports. Specifically, Driver OFF will disable the drive of the first pre-driver chip 13, and CONTRL is designed to output with a delay compared to Driver OFF. S06, enter the corresponding safety state according to the corresponding fault.

[0059] As described above, the structure and functional design of the first control loop 10 are mainly explained. The design of the second control loop 20 is similar to that of the first control loop 10 and will not be repeated. This redundancy design not only ensures that the second control loop 20 is promptly notified and the first control loop 10 enters a safe state when the first control loop 10 fails, but also promptly notifies the first control loop 10 to take appropriate action when the second control loop 20 fails. Therefore, the safety and reliability of the drive-by-wire system 100 can be improved.

[0060] Figure 6 This is a structural block diagram of a vehicle according to an embodiment of the present invention.

[0061] like Figure 6 As shown, vehicle 1000 includes: drive-by-wire system 100.

[0062] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0063] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0064] In the description of this invention, it should be understood that the terms "center," "longitudinal," "lateral," "length," "width," "thickness," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," "outer," "clockwise," "counterclockwise," "axial," "radial," and "circumferential" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience of describing this invention and simplifying the description, and are not intended to indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0065] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0066] In this invention, unless otherwise explicitly specified and limited, the terms "installation," "connection," "linking," and "fixing," etc., should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components, unless otherwise explicitly limited. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0067] In this invention, unless otherwise explicitly specified and limited, "above" or "below" the second feature can mean that the first feature is in direct contact with the second feature, or that the first feature is in indirect contact with the second feature through an intermediate medium. Furthermore, "above," "over," and "on top" of the second feature can mean that the first feature is directly above or diagonally above the second feature, or simply that the first feature is at a higher horizontal level than the second feature. "Below," "below," and "under" the second feature can mean that the first feature is directly below or diagonally below the second feature, or simply that the first feature is at a lower horizontal level than the second feature.

[0068] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A drive-by-wire system (100), characterized in that, include: The first control loop (10) and the second control loop (20) are redundant with each other. The first control loop (10) includes a first shutdown module (11), a first power module (12), a first pre-drive chip (13), and a first main control module (14) connected in sequence. The first shutdown module (11) is also connected to the first main control module (14) and is adapted to connect to a first preset power supply (BAT1). The first power module (12) is adapted to connect to the controlled device. The first main control module (14) is used to output a first fault notification signal to the second main control module (24) in the second control loop (20) when it is determined that the first control loop (10) has a fault, so that the second control loop (20) starts control, controls the first pre-drive chip (13) to turn off the drive to the first power module (12), and controls the first shutdown module (11) to disconnect the power supply connection of the first power module (12).

2. The drive-by-wire system (100) according to claim 1, characterized in that, When the first main control module (14) determines that the first control loop (10) has malfunctioned, it is specifically used for: When at least one of the following occurs—detecting a fault in the first main control module (14), receiving a second fault notification signal sent by the first pre-drive chip (13), or determining that the first control loop (10) needs to enter a safe state—it is determined that the first control loop (10) has malfunctioned.

3. The drive-by-wire system (100) according to claim 1, characterized in that, The first main control module (14) is also used to check the hardware safety circuit when the first control circuit (14) is powered on or initialized, and when it is determined that the check fails, control the first shutdown module (11) to disconnect the power supply connection between the first preset power supply (BAT1) and the first power module (12).

4. The drive-by-wire system (100) according to any one of claims 1-3, characterized in that, The first control loop (10) further includes a first power management module (15), which is connected to the first main control module (14) and is adapted to connect to the first preset power supply (BAT1) for processing the voltage provided by the first preset power supply (BAT1) and supplying the processed voltage to the first main control module (14).

5. The drive-by-wire system (100) according to claim 4, characterized in that, The first main control module (14) is also used to output a third fault notification signal to the first power management module (15) when a fault is detected in the first main control module (14). The first power management module (15) is also used to output a reset signal to the first main control module (14) when a fault is detected in the first power management module (15) or when the third fault notification signal is received, so as to reset the first main control module (14).

6. The drive-by-wire system (100) according to claim 5, characterized in that, The first power management module (15) is also connected to the first shutdown module (11) and the second main control module (24) respectively. It is also used to control the first shutdown module (11) to disconnect the power supply connection of the first power module (12) and output a fourth fault notification signal to the second main control module (24) when the first power management module (15) is detected to have a fault or when the third fault notification signal is received, so that the second control loop (20) starts control. or, The first power management module (15) is also connected to the first pre-drive chip (13) and is also used to control the first pre-drive chip (13) to turn off the drive of the first power module (12) when the first power management module (15) is detected to have a fault or when the third fault notification signal is received.

7. The wire-controlled system (100) according to claim 6, characterized in that, The first power management module (15) is also used to perform a hardware safety circuit check when the first control circuit (14) is powered on or initialized, and to control the first shutdown module (11) to disconnect the power supply connection of the first power module (12) when the check fails.

8. The drive-by-wire system (100) according to claim 1, characterized in that, The first main control module (14) is also connected to the second main control module (24) through the controller local area network and / or the serial port, and is also used to output status notification information to the second main control module (24) through the controller local area network and / or the serial port when it is determined that the first control loop (10) has a fault.

9. The wire-controlled system (100) according to claim 6, characterized in that, The first shutdown module (11) includes: a first unidirectional conduction circuit (111), a second unidirectional conduction circuit (112), a filter circuit (113), and a switch circuit (114). Wherein, the first end of the first unidirectional conduction circuit (111) is connected to the first main control module (14), the first end of the second unidirectional conduction circuit (112) is connected to the first power management module (15), the second end of the first unidirectional conduction circuit (111) is connected to the control end of the switch circuit (114), the first end of the filter circuit (113), and the second end of the second unidirectional conduction circuit (112), respectively. The first end of the switch circuit is adapted to be connected to the first preset power supply (BAT1), the second end of the switch circuit (114) is connected to the first power module (12), and the second end of the filter circuit (113) is grounded.

10. A vehicle (1000), characterized in that, include: The drive-by-wire system (100) as described in any one of claims 1-9.

Images