Novel braking redundant mechanical system

Abstract

The invention relates to the technical field of vehicle braking, and discloses a novel braking redundant mechanical system which comprises a redundant control unit comprising a chassis domain controller A and a chassis domain controller B which are powered by an independent power supply; four wheel edge EMB actuator units, wherein a six-phase double-winding permanent magnet synchronous motor is arranged in each wheel edge EMB actuator unit as a power source; and a redundant sensing component providing redundant pedal travel and wheel speed signals. The six-phase double-winding permanent magnet synchronous motor is adopted, and power source redundancy is achieved in a single actuator. When one set of three-phase winding of the motor fails, the other set of healthy winding can still work independently, and the maximum clamping force not lower than 50% is provided for wheels. The redundancy control unit diagnoses faults in real time and dynamically redistributes braking force. According to the design, the problem that the wheel braking function of a traditional system is completely lost due to the fault of a single motor is solved, and the reliability and safety of the braking system are improved.

Description

Technical Field

[0001] This invention relates to the field of vehicle braking technology, specifically to a novel redundant mechanical braking system. Background Technology

[0002] With the evolution of automotive electrification and intelligent technologies, electromechanical braking systems (EMB) are becoming an important development direction for vehicle braking systems. EMB systems convert the rotational motion of the drive motor into the linear motion of the brake piston through a mechanical transmission mechanism, directly generating braking clamping force. Compared to traditional hydraulic braking systems, EMB systems offer advantages such as faster response, higher controllability, and a more compact structure.

[0003] However, existing electromechanical braking systems have shortcomings in terms of reliability in terms of hardware structure and control strategies. The currently common approach is to configure a three-phase motor at each wheel as the braking actuator. The redundancy mechanism of this design relies primarily on functional backup among the four wheels. When an electrical or mechanical failure occurs in the three-phase motor of a particular wheel, the braking function of that wheel is completely lost. Although the control system can attempt to compensate by adjusting the braking force of the other normal wheels, the faulty wheel itself cannot provide any braking force. This single point of failure mode poses a serious threat to driving safety, especially under emergency braking conditions.

[0004] Therefore, the core technical problem faced by the existing technology is the lack of an effective solution for internal faults in the wheel-side brake actuator, which makes it impossible to guarantee vehicle stability and braking performance when a single motor fails.

[0005] Therefore, this invention proposes a novel redundant mechanical braking system to address the shortcomings of existing technologies. Summary of the Invention

[0006] To address the shortcomings of existing technologies, this invention provides a novel redundant mechanical braking system that solves the technical problem that existing electromechanical braking systems experience a decrease or complete loss of braking capability when a single component fails.

[0007] To achieve the above objectives, the present invention provides the following technical solution:

[0008] This invention provides a novel redundant mechanical braking system, comprising: The system comprises a redundant control unit, consisting of two independent chassis domain controllers, A and B; wheel-side EMB actuator units located at each wheel of the vehicle; and redundant sensing components providing redundant input signals to the redundant control unit. Chassis domain controllers A and B are powered by separate, non-coordinated power supplies and interact with the vehicle via independent communication buses. They also maintain a dedicated communication link for heartbeat status monitoring and data synchronization, forming a primary-secondary backup control structure. In the event of a failure in the primary controller, the secondary controller can take over control tasks.

[0009] The core power source for each wheel-side EMB actuator unit is a six-phase dual-winding permanent magnet synchronous motor. Within a single motor housing, this six-phase dual-winding permanent magnet synchronous motor integrates two sets of electrically independent and electromagnetically partially decoupled three-phase windings. These two sets of three-phase windings are independently driven by different drive modules within a redundant control unit, achieving power source redundancy within a single motor physical unit.

[0010] The redundant sensing component includes a pedal simulator component that outputs two independent travel signals, and dual-chip redundant wheel speed sensors located at each wheel. From the source of signal acquisition, the redundant sensing component provides the redundant control unit with data input capable of cross-validation.

[0011] The innovative principle of the technical solution adopted in this invention lies in the construction of a full-link, multi-level redundant architecture from signal perception and logic control to final execution.

[0012] The core innovation lies at the actuator level. By using a six-phase dual-winding permanent magnet synchronous motor for each wheel, this invention achieves in-wheel redundancy in the final output of braking force. When one set of three-phase windings or the drive circuit of one set of three-phase windings inside the motor fails, the other healthy set of three-phase windings can still work independently, providing the corresponding wheel with braking torque no less than a preset ratio. This design avoids the complete loss of braking function of the entire wheel due to a single electrical fault.

[0013] Furthermore, this invention employs a domain-centralized control architecture. All braking control algorithms, fault diagnosis logic, and motor drive control functions are executed centrally within a redundant control unit. The wheel-side EMB actuator unit is designed as a purely electromechanical actuator without any electronic control unit. This architecture simplifies the complexity of the wheel-side hardware, reducing unsprung mass and potential points of failure.

[0014] In summary, by using redundant sensor inputs, redundant controller decisions, and redundant actuator outputs, the braking system constructed by this invention can automatically isolate faults and degrade functions when faced with single or multiple faults in the controller, power supply, communication link, sensors, or internal windings of the motor, thereby maintaining the vehicle's basic braking capability under various fault scenarios.

[0015] This invention provides a novel redundant mechanical braking system. It offers the following advantages: 1. This invention uses a six-phase dual-winding permanent magnet synchronous motor as the power source for the wheel-side EMB actuator unit. When one set of three-phase windings or the drive circuit of one set of three-phase windings inside the six-phase dual-winding permanent magnet synchronous motor fails, the other healthy set of three-phase windings can still work independently, ensuring that the wheel-side EMB actuator unit can continuously provide no less than 50% of the maximum design clamping force. This design avoids the problem of complete loss of wheel braking function due to a single electrical fault point, improving the operational reliability of the braking system and vehicle safety.

[0016] 2. This invention, through the configuration of redundant control units and a real-time fault diagnosis mechanism, can dynamically adjust the braking force distribution strategy when one or more wheel-side EMB actuator units fail. The redundant control unit redistributes the braking force among the remaining healthy wheels to compensate for the braking force lost by the failed unit. This dynamic adjustment capability enables the braking system to adapt to different failure conditions, maintaining the vehicle's braking stability and deceleration performance under fault conditions.

[0017] 3. This invention integrates two sets of three-phase windings into a single six-phase dual-winding permanent magnet synchronous motor, achieving power source redundancy and making the overall structure of the wheel-side EMB actuator unit more compact. Combined with a domain-centralized control architecture, the electronic control unit is removed from the wheel-side, reducing the vehicle's unsprung mass. This contributes to overall vehicle lightweighting and simplifies the layout of wheel-side components. Attached Figure Description

[0018] Figure 1 This is a system block diagram of the present invention; Figure 2 This is a flowchart of the method of the present invention; Figure 3 This is a comparison curve of the braking force of the left front wheel in a specific application embodiment of the present invention; Figure 4 This is a comparison curve of vehicle yaw rate in a specific application embodiment of the present invention.

[0019] The components include: 1. Redundant control unit; 2. Wheel-side EMB actuator unit; 3. Pedal simulator assembly; 4. Wheel speed sensor assembly. Detailed Implementation

[0020] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] Please refer to the appendix. Figure 1 This invention provides a novel redundant mechanical braking system (hereinafter referred to as the system), which is designed in accordance with the principle of domain centralization and hardware-software decoupling. The hardware entities of the system include a redundant control unit 1, a wheel-side EMB actuator unit 2, and redundant human-machine interaction and sensing components.

[0022] The redundant control unit 1 consists of chassis domain controller A and chassis domain controller B, forming a primary and secondary control backup. Both chassis domain controller A and chassis domain controller B integrate a microcontroller, power management module, communication module, braking control module, and motor drive module. Chassis domain controller A and chassis domain controller B are connected via a proprietary CAN bus for real-time data synchronization and mutual monitoring of heartbeat status.

[0023] The system employs a dual-redundant power supply. On-board power supply A powers chassis domain controller A, while on-board power supply B powers chassis domain controller B. On-board power supply A and on-board power supply B are two independent power supplies from different sources. Chassis domain controller A and chassis domain controller B communicate with the central control unit via dual vehicle CAN buses to receive braking commands and send system status information.

[0024] There are four wheel-side EMB actuator units 2, each corresponding to one of the four wheels of the vehicle. Each wheel-side EMB actuator unit 2 contains only one six-phase dual-winding permanent magnet synchronous motor and a mechanical transmission structure. The wheel-side EMB actuator unit 2 does not have an independent electronic control unit. The drive control of the six-phase dual-winding permanent magnet synchronous motor is executed by the motor drive module in the redundant control unit 1.

[0025] The redundant human-machine interface and perception components include a pedal simulator component 3 and a wheel speed sensor component 4. The pedal simulator component 3 internally houses a pushrod travel sensor with dual power supply and a dual-chip design. The pushrod travel sensor generates two independent pedal travel signals, which are sent to chassis domain controller A and chassis domain controller B, respectively. The wheel speed sensor component 4 has a dual-chip redundant wheel speed sensor at each wheel. The two output signals from the dual-chip redundant wheel speed sensors are processed by a logic AND gate circuit to generate the final wheel speed input signal, which is provided to the braking control modules within chassis domain controller A and chassis domain controller B.

[0026] The pedal simulator component 3 acquires the driver's braking intention and generates redundant pedal travel signals; chassis domain controller A and chassis domain controller B receive the pedal travel signals and wheel speed information fed back by wheel speed sensor component 4; chassis domain controller A and chassis domain controller B calculate braking control commands based on the received signals; the braking control commands are sent to the motor drive module integrated inside chassis domain controller A and chassis domain controller B; the motor drive module controls the six-phase dual-winding permanent magnet synchronous motor in the wheel-side EMB actuator unit 2 to generate braking torque.

[0027] See attached document Figure 1 The redundant control unit 1 is the core of the braking calculation and control. It consists of two physically independent hardware units: chassis domain controller A and chassis domain controller B. After the system is powered on and initialized, chassis domain controller A and chassis domain controller B establish a master-slave control relationship, forming a complete redundant control mechanism to ensure that the braking function is not interrupted when any single controller hardware or software fails.

[0028] Each independent chassis domain controller, including Chassis Domain Controller A and Chassis Domain Controller B, consists of a microcontroller, a power management module, a communication module, a braking control module, and a motor drive module. The microcontroller is the execution entity for data processing and logic operations. Internally, it includes a central processing unit, random access memory (RAM), read-only memory (ROM), and non-volatile memory for storing firmware programs. The microcontroller receives various sensor data and upper-level instructions from the communication module, executes built-in braking force distribution algorithms, fault diagnosis logic, and motor control algorithms, and ultimately generates drive commands.

[0029] The power management module is responsible for providing stable and reliable power to all electronic components within the chassis domain controller. It receives input from an external independent onboard power supply and, through internal DC-DC conversion, filtering, and voltage regulation circuits, generates multiple DC power supplies of different voltage levels. These supplies are then directed to the microcontroller, communication chip, sensor interface, and the pre-amplifier circuitry of the motor drive module. The power management module also monitors input voltage and output current, providing this data to the microcontroller as part of its self-diagnostic process.

[0030] The communication module provides the chassis domain controller with a physical interface and protocol support for data exchange with other electronic control units. Internally, the communication module integrates multiple Controller Area Network (CAN) transceivers to handle physical layer signals from the dual vehicle CAN bus and the proprietary CAN bus. The communication module decodes received CAN messages and submits the data payload to the microcontroller; simultaneously, it encapsulates the data to be sent by the microcontroller into messages conforming to the CAN protocol specification and transmits them to the bus via the CAN transceivers.

[0031] The braking control module is a set of software algorithms running on a microcontroller. It receives pre-processed pedal travel signals, wheel speed signals, and vehicle weight parameters, and calculates the target total braking force required by the vehicle under the current operating conditions in real time based on a preset fuzzy PID control algorithm. Subsequently, the braking force distribution submodule within the braking control module decomposes the target total braking force into target braking force values ​​for each of the four wheels, according to the vehicle dynamic model and preset distribution rules.

[0032] The motor drive module is a power conversion unit that connects the microcontroller to the wheel-side six-phase dual-winding permanent magnet synchronous motor. The motor drive module receives pulse-width modulated signals from the microcontroller and, through internal power devices such as metal-oxide-semiconductor field-effect transistors or insulated-gate bipolar transistors, inverts the direct current into precise, multi-phase alternating current to drive the six-phase dual-winding permanent magnet synchronous motor. The motor drive module includes current sensors for real-time feedback of the motor phase current, forming a current closed-loop control.

[0033] The coordination mechanism between chassis domain controller A and chassis domain controller B is implemented through a dedicated private CAN bus. During normal system operation, chassis domain controller A acts as the master controller, and chassis domain controller B acts as the auxiliary controller. The master controller, chassis domain controller A, is responsible for performing all braking calculations and generating control commands for all four wheel-side EMB actuator units 2. The auxiliary controller, chassis domain controller B, synchronously receives all input signals and executes the exact same calculation process as the master controller, chassis domain controller A, but the calculation results are only stored internally and not output to the motor drive module.

[0034] To ensure strict consistency between the main and auxiliary controllers, the main controller, chassis domain controller A, broadcasts a heartbeat message and a data synchronization message to the auxiliary controller, chassis domain controller B, via a private CAN bus at fixed time intervals, such as every 10 milliseconds. The heartbeat message contains the current operating status code of the main controller, chassis domain controller A, and a cyclically incrementing counter. The auxiliary controller, chassis domain controller B, continuously monitors this heartbeat message. The data synchronization message contains all key internal state variables, intermediate calculation results, and the final generated braking command for the current calculation cycle of the main controller, chassis domain controller A. If the auxiliary controller, chassis domain controller B, fails to receive a heartbeat message from the main controller, chassis domain controller A, within a preset time threshold, or if the received heartbeat message status code indicates a fault in the main controller, chassis domain controller A, the auxiliary controller, chassis domain controller B determines that the main controller, chassis domain controller A, has failed. At this point, the auxiliary controller, chassis domain controller B, immediately triggers a takeover procedure.

[0035] The takeover procedure executes the following steps: First, the auxiliary controller chassis domain controller B switches its operating mode from "auxiliary control" to "main control". Second, the auxiliary controller chassis domain controller B activates its motor drive module output function, applying the internally calculated and stored braking commands to the corresponding wheel-side EMB actuator unit 2 via the motor drive module. Since the internal state variables of the auxiliary controller chassis domain controller B have been synchronized with the main controller chassis domain controller A through the private CAN bus during the last normal cycle before the failure, the braking commands output after the switch can smoothly continue with the commands before the failure, avoiding sudden changes in braking force. Third, the auxiliary controller chassis domain controller B, having completed the switch, sends a status change message to the central control unit via the dual vehicle CAN bus, announcing the transfer of system control. This coordination mechanism ensures seamless continuation of the braking system's function in the event of a single point of failure in the main controller.

[0036] See attached document Figure 1 To ensure that redundant control unit 1 can continue to operate in the event of any single electrical failure or communication link interruption, the system is configured with a completely independent dual power supply system and dual communication link system. The design of the dual power supply system and dual communication link system is the physical basis for ensuring the functional safety and high availability of chassis domain controller A and chassis domain controller B.

[0037] The system's dual power supply system consists of on-board power supply A and on-board power supply B. On-board power supply A and on-board power supply B are physically isolated power supply units, both using 48V 100Ah lithium-ion battery packs. To achieve non-co-current power supply, on-board power supply A and on-board power supply B have their own independent battery management systems, independent charging and discharging circuits, and independent overcurrent and overvoltage protection devices. The positive and negative output terminals of on-board power supply A are connected to the power management module inside chassis domain control A via a dedicated, physically independent power supply harness. Similarly, the positive and negative output terminals of on-board power supply B are connected to the power management module inside chassis domain control B via another dedicated power supply harness, physically isolated from the aforementioned harness. The wiring paths of the two power supply harnesses on the vehicle chassis are chosen in different areas to reduce the risk of simultaneous damage to both harnesses due to localized physical damage.

[0038] The power management module within chassis domain A receives 48V DC power from the on-board power supply A and converts it into multiple stable operating voltages, such as 5V and 3.3V, required by the microcontroller, communication module, and motor drive module within chassis domain A. The power management module within chassis domain B performs the same function, but its power input comes from on-board power supply B. The power management module of chassis domain A continuously monitors the output voltage and current values ​​of on-board power supply A. When the monitored voltage value falls below a preset minimum operating voltage threshold, or the current value exceeds a preset normal operating current range, the microcontroller of chassis domain A determines that on-board power supply A has failed. Similarly, the power management module of chassis domain B monitors on-board power supply B in real time. This design ensures that any failure of on-board power supply A, including battery cell failure, battery management system failure, output short circuit, or power harness breakage, will only cause chassis domain A to lose power supply, without affecting the normal operation of chassis domain B, which is independently powered by on-board power supply B. The reverse is also true. Through this complete electrical isolation, the system eliminates the possibility of the entire redundant control unit 1 being paralyzed due to the failure of any link in a single power supply link.

[0039] The system's dual communication link system is implemented based on dual vehicle CAN buses. The dual vehicle CAN buses consist of two physically independent CAN buses: Vehicle CAN Bus A and Vehicle CAN Bus B. Each of Vehicle CAN Bus A and Vehicle CAN Bus B includes independent twisted-pair cables, 120-ohm terminating resistors at both ends of the bus, and the physical wiring paths of the two buses within the vehicle wiring harness are separate. The hardware circuitry of Chassis Domain Controller A integrates two independent CAN controllers and two independent CAN transceivers. The first CAN transceiver is connected to Vehicle CAN Bus A, and the second CAN transceiver is connected to Vehicle CAN Bus B. Similarly, the hardware circuitry of Chassis Domain Controller B also integrates two independent CAN controllers and two independent CAN transceivers, connected to Vehicle CAN Bus A and Vehicle CAN Bus B respectively.

[0040] When the central control unit sends critical messages such as braking commands, it broadcasts identical messages simultaneously on both the vehicle CAN bus A and the vehicle CAN bus B via its two CAN transceivers. The microcontroller of chassis domain controller A listens for messages from both vehicle CAN bus A and vehicle CAN bus B simultaneously through its two internal CAN controllers. When chassis domain controller A receives valid braking command messages from both vehicle CAN bus A and vehicle CAN bus B, the communication module performs a consistency check, such as comparing the message ID, data length, and data content. If the check passes, the message content is submitted to the braking control module. If, at any given moment, chassis domain controller A can only receive messages from vehicle CAN bus A and cannot receive messages from vehicle CAN bus B, the communication module of chassis domain controller A starts a timeout timer. If, within a preset time window, no messages are received from vehicle CAN bus B, or the CAN controller detects a bus error state (e.g., bus off), it is determined that vehicle CAN bus B or the corresponding communication hardware link has failed. At this time, chassis domain controller A will continue to use valid messages received from the vehicle CAN bus A for braking control, and at the same time, will synchronize the detected communication fault information to chassis domain controller B through the private CAN bus.

[0041] Chassis domain controller B executes the exact same communication message reception and verification logic as chassis domain controller A. Since both chassis domain controller A and chassis domain controller B are simultaneously connected to both vehicle CAN bus A and vehicle CAN bus B, the failure of either bus (e.g., a short circuit or open circuit) will not interrupt communication between the central control unit and redundant control unit 1. Even in extreme cases, such as the transceiver on chassis domain controller A connected to vehicle CAN bus A failing, and vehicle CAN bus B suffering physical damage, chassis domain controller A can still receive commands via vehicle CAN bus B, while chassis domain controller B can still receive commands via vehicle CAN bus A. Redundant control unit 1, as a whole, can still obtain valid braking commands. The dual communication link design provides two parallel, physically isolated channels for the transmission of braking commands, thereby ensuring the continuity and reliability of communication.

[0042] See attached document Figure 1 The wheel-side EMB actuator unit 2 of the system is the direct mechanism for generating braking force. The core power source of the wheel-side EMB actuator unit 2 is a six-phase dual-winding permanent magnet synchronous motor. Physically, the six-phase dual-winding permanent magnet synchronous motor is an integrated, independent motor unit, comprising a unified motor housing, stator, rotor, and rotor shaft. The design of the six-phase dual-winding permanent magnet synchronous motor incorporates electrical and electromagnetic redundancy within a single motor to prevent complete loss of wheel-side braking function due to a single electrical fault.

[0043] The stator of a six-phase dual-winding permanent magnet synchronous motor consists of a stator core and stator windings. The stator core is made of laminated electrical silicon steel sheets with high permeability and low loss. Multiple stator slots are evenly distributed on the inner circumference of the stator core; for example, one embodiment has 36 stator slots for housing the stator windings. The stator windings are the key component for electromagnetic energy conversion. The stator windings consist of two completely independent three-phase windings, referred to here as the first three-phase winding and the second three-phase winding.

[0044] The first and second three-phase windings are physically insulated from each other and electrically completely separated. The first three-phase winding has three independent leads, connected to phases U1, V1, and W1 of the external drive circuit, respectively. The second three-phase winding also has three independent leads, connected to phases U2, V2, and W2 of the external drive circuit, respectively. These two three-phase windings are spatially arranged in the stator slots with a predetermined electrical angle difference; for example, the magnetic axis of the second three-phase winding is spatially offset by 30 electrical angles relative to the magnetic axis of the first three-phase winding. This spatial displacement design ensures that the magnetic fields generated by the two three-phase windings during normal operation can be effectively coupled to synthesize a total rotating magnetic field, while achieving a high degree of electromagnetic decoupling, reducing electromagnetic interference from electrical events (such as short circuits or open circuits) of one winding to the other.

[0045] The rotor of a six-phase dual-winding permanent magnet synchronous motor is a permanent magnet structure, consisting of a rotor core, permanent magnet poles, and a rotor shaft. The rotor core is also made of laminated silicon steel sheets, and the permanent magnet poles are made of high-energy-product rare-earth permanent magnet materials (such as neodymium iron boron). The permanent magnet poles are fixed to the outer circumferential surface of the rotor core or embedded inside the rotor core with a specific number of pole pairs (e.g., 4 pairs). The rotor shaft, as a mechanical output component, passes through the center of the rotor core and is integrally formed with it. The rotor shaft is coaxially connected to the wheel axle via a cross bearing, directly transmitting the electromagnetic torque generated by the six-phase dual-winding permanent magnet synchronous motor to the wheel braking mechanism.

[0046] The working principle of a six-phase dual-winding permanent magnet synchronous motor is based on electromagnetic induction and the Lorentz force law. When the motor drive module in the redundant control unit 1 applies a set of three-phase AC current to the first set of three-phase windings (U1, V1, W1), a rotating magnetic field is generated in the air gap between the stator and rotor. Similarly, when the motor drive module applies another set of three-phase AC current to the second set of three-phase windings (U2, V2, W2), another independent rotating magnetic field is generated in the air gap. These two sets of rotating magnetic fields are vector-superimposed to form a total, stable, composite rotating magnetic field. The permanent magnet magnetic field established by the permanent magnet poles on the rotor is driven by an electromagnetic torque under the action of the composite rotating magnetic field, thereby driving the rotor shaft to rotate synchronously.

[0047] The total output electromagnetic torque of a six-phase dual-winding permanent magnet synchronous motor is the algebraic sum of the electromagnetic torques generated by the first set of three-phase windings and the second set of three-phase windings. Under decoupling control conditions, the total output electromagnetic torque can be expressed by the following formula: ; in, This represents the total electromagnetic torque output by a six-phase dual-winding permanent magnet synchronous motor. This represents the electromagnetic torque independently generated by the first set of three-phase windings; This indicates the electromagnetic torque independently generated by the second set of three-phase windings.

[0048] Under normal system operation, the redundant control unit 1 simultaneously supplies drive current to both the first and second three-phase windings according to braking requirements. The two windings together generate the required total electromagnetic torque. The redundant control unit 1 can control the current allocated to the two windings, enabling... and Output according to a preset ratio, for example, each bearing 50% of the torque demand.

[0049] The principle behind the in-wheel redundancy of a six-phase dual-winding permanent magnet synchronous motor lies in the fact that when any set of three-phase windings or its corresponding external drive circuit fails, the other set of windings can independently maintain the basic function of the motor. For example, when the system diagnostic module detects an open-circuit fault in the first set of three-phase windings or a failure in its drive circuit, the redundancy control unit 1 will immediately cut off the current supply to the first set of three-phase windings, thus preventing the electromagnetic torque generated by the motor from being interrupted. The value becomes zero. At this point, redundant control unit 1 will instruct the second set of three-phase windings to continue working and independently generate electromagnetic torque. In this fault degradation mode, the total electromagnetic torque of the motor... equal Since the second set of three-phase windings is intact and healthy, it can independently output 50% of the rated total torque of the six-phase dual-winding permanent magnet synchronous motor. Therefore, the wheel-side EMB actuator unit 2 has not completely failed, but retains half of its braking capability, ensuring that the vehicle still has basic braking function under a single electrical fault. Similarly, when the second set of three-phase windings or its drive circuit fails, the first set of three-phase windings can also work independently, providing redundant braking capability.

[0050] See attached document Figure 1 The six-phase dual-winding permanent magnet synchronous motor serves as the power source for the wheel-side EMB actuator unit 2. The electromagnetic torque it generates needs to be converted into a linear clamping force on the brake disc through a precise mechanical transmission mechanism. The mechanical transmission and integration method of the wheel-side EMB actuator unit 2 aims to achieve the conversion from rotary motion to linear motion and amplify the force, while ensuring the compactness and reliability of the entire actuator unit structure.

[0051] The wheel-side EMB actuator unit 2 is encapsulated within a unified housing, with a six-phase dual-winding permanent magnet synchronous motor fixedly mounted at one end. The rotor shaft of the six-phase dual-winding permanent magnet synchronous motor serves as the input end of the mechanical transmission mechanism, directly transmitting its output rotational motion to subsequent transmission components. The rotor shaft is coaxially connected to the input end of a multi-stage planetary gear reduction mechanism, namely the sun gear, via a cross bearing. The cross bearing design allows for smooth torque transmission even with minor angular deviations or vibrations in the transmission shaft, ensuring stable operation of the transmission system.

[0052] A multi-stage planetary gear reducer is the core component for achieving speed reduction and torque amplification. In one embodiment, the multi-stage planetary gear reducer includes two stages of planetary gear sets. The sun gear of the first stage planetary gear set is connected to the rotor shaft of a six-phase dual-winding permanent magnet synchronous motor. The planet carrier of the first stage planetary gear set serves as the output and is connected to the sun gear of the second stage planetary gear set. The planet carrier of the second stage planetary gear set serves as the final output end of the entire reduction mechanism. The gear rings of both stages of planetary gear sets are fixedly connected to the inner wall of the housing of the wheel-side EMB actuator unit 2. Through this transmission design, the high-speed, low-torque rotary motion output by the six-phase dual-winding permanent magnet synchronous motor is converted into low-speed, high-torque rotary motion.

[0053] The output end of the multi-stage planetary gear reducer, specifically the planet carrier of the second-stage planetary gear set, is fixedly connected to the lead screw shaft of a ball screw mechanism. The ball screw mechanism is used to precisely convert rotary motion into linear motion. It consists of a lead screw shaft, a nut, and multiple steel balls that circulate between the helical grooves of the lead screw shaft and nut. When the planet carrier drives the lead screw shaft to rotate, the nut's circumferential movement is restricted, causing it to undergo linear displacement along the axial direction of the lead screw shaft. The rolling contact of the steel balls inside the ball screw mechanism replaces the sliding contact of a traditional sliding screw, reducing frictional loss and improving transmission efficiency and positioning accuracy.

[0054] The nut of the ball screw mechanism is connected to the brake piston. The brake piston is a cylindrical push rod, one end of which is connected to the nut, and the other end directly acts on the inner brake friction pad. When the nut undergoes linear displacement, the brake piston moves forward or backward synchronously. The movement of the brake piston pushes the inner brake friction pad to contact the inner surface of the brake disc and apply pressure. The brake caliper of the wheel-side EMB actuator unit 2 adopts a floating design, and the caliper itself can slide along a guide pin parallel to the direction of brake piston movement. When the inner brake friction pad is pressed against the brake disc, the principle of action and reaction forces causes the entire brake caliper to slide relative to the brake disc, thereby pulling the outer brake friction pad towards the brake disc and pressing it against the outer surface of the brake disc. Finally, the inner and outer brake friction pads together apply a clamping force to the rotating brake disc, generating a braking friction torque to achieve braking of the wheel.

[0055] The total clamping force ultimately applied to the brake disc has a definite transmission relationship with the total electromagnetic torque output by the six-phase dual-winding permanent magnet synchronous motor, which can be expressed by the following formula: ; in, This indicates the total clamping force applied to the brake disc by the inner and outer brake friction pads; This represents the total electromagnetic torque output by a six-phase dual-winding permanent magnet synchronous motor. This indicates the overall transmission ratio of a multi-stage planetary gear reduction mechanism; The lead of the ball screw mechanism is the distance the nut moves axially for each revolution of the screw shaft. It represents the total transmission efficiency of the entire mechanical transmission system from the motor rotor shaft to the brake piston.

[0056] The system follows a domain-centralized design principle in its integration approach. The entire wheel-side EMB actuator unit 2, comprising a six-phase dual-winding permanent magnet synchronous motor, a multi-stage planetary gear reduction mechanism, a ball screw mechanism, and a brake caliper, is integrated into a single, independent, onboard-less mechatronic module. The external electrical interface of wheel-side EMB actuator unit 2 consists only of six power lines for driving the two sets of three-phase windings and position sensor signal lines for feedback on the motor rotor position. All motor control algorithms, such as field-oriented control (FOC), current loop, speed loop control logic, and braking force calculation and fault diagnosis functions, are all computed and executed within the redundant control unit 1, namely the microcontrollers of chassis domain controller A and chassis domain controller B. This integration method centralizes control intelligence in the chassis domain controller, making wheel-side EMB actuator unit 2 a purely electromechanical actuator. This reduces unsprung mass, decreases the complexity and potential failure points of wheel-side components, and facilitates unified optimization and management of braking performance through software updates.

[0057] See attached document Figure 1 The system acquires the driver's braking intention through the pedal simulator component 3. The pedal simulator component 3 is an independent electromechanical assembly used to accurately measure the driver's input to the brake pedal and convert the input into redundant electrical signals, while providing the driver with pedal force feedback consistent with traditional braking habits. The redundant design of the pedal simulator component 3 is fundamental to ensuring the reliability of the input signal source, preventing errors or loss of braking commands due to a single sensor failure.

[0058] The pedal simulator component 3 mainly consists of a brake pedal, a push rod, a force feedback generation mechanism, and a push rod travel sensor (PTS). The brake pedal is the driver's direct operating interface. The brake pedal is connected to one end of the push rod via a lever mechanism. When the driver depresses the brake pedal, the angular displacement of the brake pedal is converted into a linear displacement of the push rod through the lever mechanism. The other end of the push rod interacts with the force feedback generation mechanism.

[0059] The force feedback generation mechanism simulates the pedal feel of a traditional hydraulic braking system. Enclosed in a sealed cavity, it contains one or more sets of elastic elements, such as compression springs and rubber bumpers with varying stiffness coefficients. As the push rod undergoes linear displacement, it sequentially compresses these elastic elements. Initially, the push rod compresses the spring with the lower stiffness coefficient, providing minimal initial resistance. As the stroke deepens, the push rod contacts and compresses the spring or rubber bumper with a higher stiffness coefficient, causing the pedal resistance to increase non-linearly. This design produces a progressive, clearly perceptible pedal force-stroke characteristic curve, providing the driver with a stable braking expectation.

[0060] The pushrod stroke sensor is the core component for converting the braking intention electrical signal. The pushrod stroke sensor is designed with electrical redundancy. In one specific embodiment, the pushrod stroke sensor employs a dual-power supply and a dual-chip redundant configuration. The entire pushrod stroke sensor is integrated into a separate sensor housing, but the housing contains two electrically isolated independent sensing and processing channels, defined here as sensing channel A and sensing channel B.

[0061] Sensing channels A and B are physically coupled to the same push rod to measure the linear displacement of the same push rod. Each sensing channel contains an independent non-contact sensing element (such as a Hall effect-based angle or linear displacement sensor) and a dedicated signal processing integrated circuit. Sensing channel A is powered by vehicle power supply A, while sensing channel B is powered by vehicle power supply B. This dual independent power supply design ensures that if either vehicle power supply A or vehicle power supply B fails, the other sensing channel can still operate normally, thus avoiding the loss of the entire pedal travel signal due to the failure of a single power source.

[0062] The signal processing integrated circuit of sensor channel A converts the physical displacement measured by the sensing element into a standard analog voltage signal or digital bus signal, defined as pedal travel signal A. Pedal travel signal A is directly connected to the signal input interface of chassis domain controller A via a separate physical line. Similarly, the signal processing integrated circuit of sensor channel B converts the same measured physical displacement into another independent signal, defined as pedal travel signal B. Pedal travel signal B is also directly connected to the signal input interface of chassis domain controller B via another separate physical line. Thus, from physical measurement to signal output and then to controller reception, two completely parallel and non-interfering signal links are formed.

[0063] After receiving their respective pedal travel signals, chassis domain controllers A and B perform validity checks and consistency comparisons. Chassis domain controller A uses the received pedal travel signal A as the primary basis for calculating braking force, while simultaneously acquiring the value of pedal travel signal B from chassis domain controller B via its private CAN bus. Chassis domain controller B uses the received pedal travel signal B as the primary basis for calculating braking force, while simultaneously acquiring the value of pedal travel signal A from chassis domain controller A via its private CAN bus. Each chassis domain controller compares the difference between pedal travel signal A and pedal travel signal B in real time. If the absolute value of the difference between the two signals is within a preset tolerance range, the pedal travel signal input is considered valid. If the absolute value of the difference exceeds the preset tolerance threshold and persists for a period of time, the system diagnostic module will determine that the push rod travel sensor has malfunctioned and trigger the corresponding fault alarm and brake degradation strategy. This redundant design and cross-validation mechanism ensures high integrity and high availability of the driver's braking intention signal.

[0064] See attached document Figure 1 To enable precise closed-loop control of the wheel-side EMB actuator unit 2, the system is equipped with redundant wheel speed sensor components 4 to continuously acquire the rotational status information of each wheel in real time. Wheel speed sensor components 4 are the fundamental data source for the brake control module to calculate braking force and make anti-lock braking logic judgments; their reliability directly affects the performance of the entire braking system.

[0065] Each wheel is equipped with a wheel speed sensor assembly 4. The wheel speed sensor assembly 4 consists of a magnetic or toothed target wheel that rotates coaxially with the wheel and a sensor probe fixedly mounted on the steering knuckle. Alternating N / S magnetic poles or physical tooth grooves are evenly distributed along the circumference of the target wheel. The sensor probe is a non-contact design, and it encapsulates two electrically independent but physically parallel sensing chips, referred to here as the first sensing chip and the second sensing chip.

[0066] The first and second sensing chips together constitute a dual-chip redundant wheel speed sensor. Each chip has its own independent power supply pin, ground pin, and signal output pin, ensuring that an electrical fault in one chip (such as a short circuit or open circuit) will not affect the normal operation of the other. Both sensing chips operate based on the magnetoresistive effect or Hall effect principle. As the target wheel rotates with the wheel, the alternating magnetic poles or grooves on its surface cause a periodic change in the magnetic field strength at the sensor probe location. The first and second sensing chips independently detect this magnetic field change and convert it into a digital pulse signal.

[0067] Therefore, at any given time, each wheel speed sensor assembly 4 outputs two independent pulse signals in parallel. The first sensor chip outputs the first pulse signal, and the second sensor chip outputs the second pulse signal. When the wheel speed is constant, both pulse signals are square wave signals with the same frequency and essentially the same phase. These two independent pulse signals are transmitted to the redundant control unit 1, namely the signal input interfaces of chassis domain controller A and chassis domain controller B, respectively, through dedicated shielded wiring harnesses.

[0068] Before the microcontrollers of chassis domain controllers A and B receive these two pulse signals, the signals first enter a logic AND gate circuit for processing. This logic AND gate circuit is a hardware signal verification module used to confirm the validity and consistency of the two pulse signals. The logic AND gate circuit monitors the status of the first and second pulse signals in real time. The processing logic is as follows: First, it determines whether both signals are active, i.e., whether there is a periodic switching between high and low levels. If either signal remains high or low for an extended period, the corresponding sensor chip is considered faulty. Second, assuming both signals are active, the pulse frequencies of the two signals are compared within a very short time window. If the frequency difference between the two signals is less than a preset threshold, the sensor is considered to be working normally, and both signals are valid signals.

[0069] When the AND gate circuit determines that both signals are valid, the circuit selects one as the final wheel speed pulse output signal and transmits it to the brake control module. If the AND gate circuit detects that one signal is invalid while the other is valid, the circuit immediately uses the valid signal as the final wheel speed pulse output signal and simultaneously reports a single-chip fault diagnostic code to the diagnostic module. If the AND gate circuit detects that both signals are invalid simultaneously, or that the frequency difference between the two signals exceeds a threshold, the circuit determines that the entire wheel speed sensor assembly 4 has a serious fault. In this case, it outputs an invalid status flag and reports a serious fault diagnostic code.

[0070] The braking control module calculates the real-time linear velocity of the wheel, i.e., the wheel linear velocity, based on the received valid wheel speed pulse output signal. The formula for calculating the wheel linear velocity is as follows: ; in, This represents the calculated linear velocity of the wheel; Indicates the effective rolling radius of the wheel; This indicates the frequency of the final wheel speed pulse signal output after processing by the AND gate circuit; This indicates the number of magnetic pole pairs or teeth on the target wheel.

[0071] Through the aforementioned dual-chip redundancy design and the processing of logic AND gate circuits, the system ensures high integrity and availability of the wheel speed signals input to the braking control module. Even if a single sensor chip fails, the provision of wheel speed information will not be interrupted, thus providing uninterrupted data support for the continuous operation of functions such as precise braking force distribution and anti-lock braking control.

[0072] See attached document Figure 2 The braking control process, where all hardware components are in normal working order, is a precise and closed-loop sequential execution process. The entire process utilizes the high-integrity input signals provided by the aforementioned redundant sensing components to ensure the accurate generation and execution of braking commands.

[0073] The first step in the braking control process is acquiring and processing the braking intent. When the driver presses the brake pedal, the push rod in the pedal simulator assembly 3 is displaced. A dual-chip redundant push rod travel sensor, mechanically connected to the push rod, detects the amount of displacement in real time. Due to the dual-chip design, the first and second sensing chips convert the detected mechanical displacement into two electrical signals in parallel and independently: a first pedal travel signal and a second pedal travel signal. These two electrical signals are physically and electrically isolated from each other. The first pedal travel signal is sent to chassis domain controller A, and the second pedal travel signal is sent to chassis domain controller B. At the same time, the wheel speed sensor assembly 4, installed at each of the four wheels, continuously collects wheel speed information. After dual-chip redundancy and logic AND gate circuit processing, four highly reliable wheel speed pulse signals are generated, which are also input to chassis domain controller A and chassis domain controller B respectively.

[0074] After receiving their respective input signals, chassis domain controllers A and B exchange the received pedal travel signal values ​​via a private CAN bus. The main controller (e.g., chassis domain controller A) compares its received first pedal travel signal with the second pedal travel signal received from chassis domain controller B in real time to verify data consistency. Once the two signal values ​​are confirmed to be consistent within a preset error range, the main controller recognizes the pedal travel signal as a valid input. Simultaneously, the main controller integrates four valid wheel speed pulse signals for subsequent vehicle state calculations.

[0075] The second step in the braking control process is the calculation of the target braking force. This step is executed within the braking control module of the main controller. The braking control module first calculates the current brake pedal opening based on the received effective pedal travel signal. Subsequently, the braking control module uses the received four wheel speed pulse signals and preset vehicle tire radius parameters to calculate the real-time linear velocity of each wheel, and further calculates the reference vehicle speed characterizing the overall vehicle speed.

[0076] The braking control module internally incorporates a fuzzy PID algorithm module. This module receives three key inputs: the calculated brake pedal opening, the calculated vehicle speed, and a vehicle weight parameter pre-configured in the controller's memory. Based on these three inputs, the fuzzy PID algorithm module performs nonlinear calculations using an internally pre-defined fuzzy rule base and PID parameter tuning logic, ultimately outputting a scalar value—the target total braking force currently required by the vehicle. The calculation relationship for the target total braking force can be expressed as: ; in, This indicates the target total braking force currently required by the entire vehicle; This represents the nonlinear mapping function that represents the fuzzy PID algorithm; This indicates the brake pedal opening degree detected and verified by the pedal simulator component 3. This indicates the current vehicle speed, which is acquired and calculated by the wheel speed sensor assembly 4. This indicates the preset vehicle weight parameters.

[0077] The third step in the braking control process is the distribution and command issuance of braking force. The braking control module transmits the calculated target total braking force to the internal braking force distribution module. The braking force distribution module executes a braking force distribution strategy based on vehicle dynamics principles. This strategy decomposes the target total braking force into four independent braking force values, corresponding to the target braking forces of the left front wheel, right front wheel, left rear wheel, and right rear wheel, respectively. The distribution process references the ideal braking force distribution curve and considers factors such as the vehicle's axle load distribution and driving conditions to ensure vehicle stability during braking.

[0078] After obtaining the target braking force for each wheel, the braking force distribution module needs to convert these linear force commands into torque commands for the six-phase dual-winding permanent magnet synchronous motor in each wheel-side EMB actuator unit 2. This conversion process uses known mechanical transmission system parameters (including the overall transmission ratio of the multi-stage planetary gear reduction mechanism and the lead of the ball screw mechanism) to calculate the total output electromagnetic torque of the motor required to generate the target braking force for each wheel. Finally, the braking force distribution module outputs four independent target motor torque commands, each corresponding to one wheel-side EMB actuator unit 2. These target motor torque commands are sent to the corresponding motor drive modules via the internal buses of chassis domain controller A and chassis domain controller B.

[0079] The fourth step in the braking control process is the execution of drive and braking by the wheel-side motors. Upon receiving the target motor torque command, the motor drive module integrated within chassis domain controller A and chassis domain controller B begins precise motor control. Under normal operating conditions, the motor drive module distributes the target motor torque command evenly to the two sets of three-phase windings of the six-phase dual-winding permanent magnet synchronous motor. For example, 50% of the target torque is allocated to the first set of three-phase windings, and the other 50% to the second set of three-phase windings.

[0080] The motor drive module internally operates a field-oriented control algorithm. Based on the target torque allocated to each set of three-phase windings and the real-time rotor position feedback signal obtained from the motor position sensor, the algorithm precisely calculates the amplitude, frequency, and phase of the three-phase AC current required to drive each set of three-phase windings. Subsequently, the motor drive module generates the required six pulse-width modulation waves by controlling the high-speed switching of internal power semiconductor devices, driving the two sets of three-phase windings of the six-phase dual-winding permanent magnet synchronous motor.

[0081] A six-phase, dual-winding permanent magnet synchronous motor, driven by precise current, generates a total output electromagnetic torque that matches the target motor torque command. This torque is amplified and converted by a mechanical transmission mechanism, ultimately driving the brake piston to clamp the brake pads onto the brake disc, thereby generating braking force on the wheels and slowing the vehicle down. The entire process constitutes a complete closed-loop control system. The system continuously repeats the above four steps, adjusting the braking force of each wheel in real time according to changes in driver operation and vehicle status until the braking process ends.

[0082] See attached document Figure 1 and attached Figure 2 While the system executes the braking control process under normal operating conditions, its internal diagnostic module also runs continuously, performing real-time status monitoring and fault diagnosis of key hardware components. The logic of the diagnostic module is executed in parallel in the microcontrollers of redundant control unit 1, namely chassis domain controller A and chassis domain controller B, to ensure the redundancy of the diagnostic function itself.

[0083] The primary task of the real-time fault diagnosis mechanism is to monitor the health status of the redundant control unit 1 itself. Chassis domain controllers A and B exchange heartbeat information periodically via an independent private CAN bus. Chassis domain controller A sends a message containing its own status code and counter to chassis domain controller B at fixed time intervals, and chassis domain controller B sends a similar message to chassis domain controller A at the same time intervals. Each controller has an internal timeout timer. If a controller fails to receive a heartbeat message from another controller within a preset timeout period, the diagnostic module determines that the other controller has experienced a communication interruption or a serious fault. Simultaneously, each controller's power management module monitors the input voltage provided by vehicle power supply A or vehicle power supply B in real time. When the monitored voltage value remains below a preset minimum operating voltage threshold for a certain period, the diagnostic module records an undervoltage fault for the corresponding power supply.

[0084] A real-time fault diagnosis mechanism continuously verifies the signal integrity of redundant sensing components. For pedal simulator component 3, the main controller not only uses the first pedal travel signal it receives, but also receives a second pedal travel signal forwarded by chassis domain controller B via a private CAN bus. The diagnostic module compares the deviations of these two signals within a synchronous sampling period. If the absolute difference between the two signals consistently exceeds a preset tolerance threshold, the diagnostic module determines that the push rod travel sensor of pedal simulator component 3 has malfunctioned. This verification logic can be expressed by the following formula: ; in, This represents the instantaneous value of the first pedal travel signal received by chassis domain controller A; This represents the instantaneous value of the second pedal travel signal received by chassis domain controller B; This indicates the maximum allowable deviation threshold for the preset pedal travel signal.

[0085] For wheel speed sensor component 4, in addition to the preliminary signal verification performed by the aforementioned hardware logic and gate circuits, the diagnostic module performs a deeper diagnostic at the software level. The diagnostic module analyzes the wheel speed pulse signals that ultimately enter the braking control module. The diagnostic content includes: signal presence diagnosis, i.e., determining whether the pulse signal remains at a constant level for an extended period while the vehicle is in motion; frequency reasonableness diagnosis, i.e., determining whether the wheel speed calculated from the pulse signal frequency exceeds the maximum physical speed that the vehicle can reach; and wheel speed consistency diagnosis, i.e., when the vehicle is traveling in a straight line without braking or driving intervention, comparing the speed difference between the left and right wheels on the same axle or the diagonal wheels, if the speed difference continuously exceeds a preset threshold, then the relevant wheel speed sensor component 4 is determined to be abnormal.

[0086] The real-time fault diagnosis mechanism comprehensively monitors the six-phase dual-winding permanent magnet synchronous motor and its drive circuit within the wheel-side EMB actuator unit 2. The motor drive module integrates real-time sampling of the output current of each phase at the hardware level. The diagnostic module utilizes these sampled values ​​for multi-dimensional fault diagnosis.

[0087] To detect open-circuit faults in motor windings, the diagnostic module compares the command current with the actual feedback current when the motor requires torque output. The command current is the theoretical current value calculated by the field-oriented control algorithm based on the target torque. If the command current is not zero in a certain phase of a three-phase winding, while the actual feedback current value detected over multiple consecutive sampling cycles remains close to zero, the diagnostic module determines that an open-circuit fault has occurred in that phase winding.

[0088] For short-circuit faults in the motor windings, diagnosis primarily relies on the hardware overcurrent protection function of the motor drive module. The power device drive circuit of the motor drive module has hardware overcurrent detection points. When the actual current of any phase instantaneously exceeds the maximum safe current threshold set by the hardware, the hardware protection circuit immediately shuts off the drive signal for that phase to prevent damage to the power device and sends a hardware interrupt signal to the microcontroller. Upon receiving this interrupt signal, the diagnostic module immediately marks the corresponding motor phase as having a short-circuit fault. For faults in the motor position sensor, the diagnostic module continuously analyzes the rotor angle signal fed back by the position sensor. Diagnostic content includes: signal loss diagnosis, i.e., determining whether the signal has not been updated within a specified time; signal noise diagnosis, i.e., determining whether the signal value exhibits severe fluctuations beyond the normal range; and signal consistency diagnosis, i.e., estimating a theoretical rotor position by establishing a motor electromagnetic model based on the applied voltage and detected current, and comparing the estimated value with the actual measured value from the sensor. If the deviation between the estimated value and the measured value consistently exceeds a preset range, the diagnostic module determines that the position sensor has failed.

[0089] Finally, the real-time fault diagnosis mechanism is also responsible for monitoring the communication status of the dual vehicle CAN buses. Each controller's communication module contains a CAN controller, which has an error counter. The diagnostic module periodically reads the values ​​of the transmit and receive error counters. If the value of either counter exceeds a preset warning threshold, or if the CAN controller enters a bus-off state, the diagnostic module determines that a communication fault has occurred on the corresponding CAN bus.

[0090] When any of the above diagnostic logics detects a fault, the diagnostic module immediately generates a unique Diagnostic Trouble Code (DTC) and stores the DTC along with vehicle status snapshot information at the time of the fault (such as vehicle speed, brake pedal opening, timestamp, etc.) in the controller's non-volatile memory. Simultaneously, the diagnostic module reports the fault information to the central control unit via the vehicle's CAN bus, so that a warning can be issued to the driver on the instrument panel, and subsequent fault degradation control strategies can be triggered.

[0091] See attached document Figure 2 When the system's internal real-time fault diagnosis mechanism detects a fault in any hardware component and generates a definite fault diagnosis code, the system immediately switches from the braking control flow under normal operating conditions to a preset graded fault degradation strategy. The graded fault degradation strategy dynamically adjusts the braking control method according to the type, location, and severity of the fault, in order to retain braking function to the maximum extent while ensuring the basic stability of the vehicle.

[0092] The first-level degradation strategy addresses scenarios where a single six-phase dual-winding permanent magnet synchronous motor experiences partial failure. When the real-time fault diagnosis mechanism determines that one of the two sets of three-phase windings or its corresponding motor drive circuit in a wheel-side EMB actuator unit 2 of a six-phase dual-winding G-group permanent magnet synchronous motor has an open circuit, short circuit, or other fault, the braking control module immediately performs the following operations. First, the braking control module instructs the motor drive module to completely stop supplying any drive current to the confirmed faulty first set of three-phase windings, achieving electrical isolation. Second, the braking control module modifies the control commands for the wheel-side EMB actuator unit 2. The total target motor torque originally allocated to the wheel is now entirely applied to the remaining, healthy second set of three-phase windings. The motor drive module adjusts the current control for the second set of three-phase windings, allowing it to independently undertake the task of generating all the braking torque for the wheel. In this degradation mode, because only one set of three-phase windings is working, the maximum braking pressure that the wheel-side EMB actuator unit 2 can provide is limited to 50% of its design maximum value. When the brake force distribution module performs the vehicle brake force distribution calculation, it will use this new capacity limit as a constraint condition for that wheel. In subsequent braking requests, the target braking force allocated to that wheel will not exceed its current maximum value.

[0093] The second-level degradation strategy targets scenarios where a single wheel-side EMB actuator unit 2 completely fails. When the real-time fault diagnosis mechanism determines that a wheel-side EMB actuator unit 2 cannot provide any braking force due to mechanical jamming, simultaneous failure of both sets of motor windings, or complete failure of the motor position sensor, the brake control module marks the actuator unit as completely failed. The brake control module immediately instructs the motor drive module to cut off all power supply to the six-phase dual-winding permanent magnet synchronous motor within the failed actuator unit. Subsequently, the braking force distribution module's allocation algorithm is dynamically reconstructed. The braking force distribution module sets the target braking force allocated to the failed wheel to zero and, based on the vehicle dynamics model, redistributes the braking force that should have been borne by that wheel to the remaining three healthy wheel-side EMB actuator units 2. The principle of redistribution is to prioritize the vehicle's yaw stability. For example, if the left front wheel fails, the braking force distribution module will moderately increase the braking force of the right rear wheel to balance the diagonal torque, and simultaneously adjust the braking force ratio of the right front wheel and the left rear wheel according to the current vehicle speed and adhesion coefficient to suppress vehicle deviation and fishtailing tendencies during braking.

[0094] The third-level degradation strategy is activated when the system enters emergency braking mode, which is triggered when the real-time fault diagnosis mechanism confirms that two wheel-side EMB actuator units 2 have completely failed. In this mode, the brake control module first performs the same operation as the second-level degradation strategy, marking the two failed actuator units as invalid and cutting off their power supply. A crucial additional operation is that the brake control module limits the driver's braking requests. The target total braking force calculated using the fuzzy PID algorithm is constrained by an upper limit. This upper limit is set to 85% of the vehicle's weight. The specific limiting logic is as follows: ; in, This indicates the final target total braking force after the upper limit has been applied; This represents the target total braking force calculated by the fuzzy PID algorithm based on the driver's intention and the vehicle's state. This indicates the preset vehicle weight parameters; This represents the gravitational acceleration constant.

[0095] The braking force distribution module will use this limited final target total braking force to distribute it between the remaining two healthy, working wheel-side EMB actuator units 2. The distribution logic depends on the position of the two healthy wheels. If the remaining two wheels are on the same axle, the braking force will be distributed proportionally between the left and right wheels to maintain directional stability. If the remaining two wheels are diagonally positioned, which is a relatively stable configuration, the braking force distribution will be mainly based on the dynamic axle load transfer between the front and rear axles.

[0096] The fourth-level degradation strategy is activated when the system enters a safe braking mode, which is triggered when the real-time fault diagnosis mechanism confirms that three wheel-side EMB actuator units 2 have completely failed. This is the highest level of fault the system can withstand. The brake control module marks the three failed actuator units as invalid and cuts off their power supply. Simultaneously, the system's limit on the target total braking force becomes more stringent. In this mode, the upper limit of the target total braking force is set to 70% of the vehicle's weight. The brake force distribution module applies this further limited final target total braking force entirely to the single, still functioning wheel-side EMB actuator unit 2. To prevent vehicle instability that might be caused by single-wheel braking, the brake control module also limits the rate of increase of braking force, i.e., by controlling the braking force applied to that single wheel through a ramp function, allowing it to increase gradually, thereby decelerating the vehicle to a stop as smoothly as possible with only one braking point.

[0097] After all the aforementioned degradation strategies are activated, once the real-time fault diagnosis mechanism detects that the original fault state has returned to normal, the system will execute the fault recovery procedure. The braking control module will confirm that the relevant component functions have returned to normal, automatically exit the degradation mode, restore the normal braking control process, and reload the braking parameters and allocation strategies before the fault occurred.

[0098] See attached document Figure 1 and attached Figure 2 After the system's braking control module activates any of the aforementioned graded fault degradation strategies, the system will simultaneously initiate the fault information reporting and storage process, providing a basis for subsequent fault recovery. The first part of the fault information reporting and recovery mechanism is the recording and communication of fault data. When the real-time fault diagnosis mechanism confirms a fault and generates a unique fault diagnostic code, the redundant control unit 1 will immediately execute the data freeze frame capture operation. The data freeze frame is a data set containing key vehicle state parameters at the moment the fault occurs. The content recorded in the data freeze frame includes, but is not limited to: the vehicle speed when the fault diagnostic code is triggered, the brake pedal opening, the system operating timestamp, the identifier of the component that failed, the operating voltage and current values ​​of the relevant components, and the temperature of the motor drive module, etc.

[0099] The captured data freeze frame, along with the corresponding fault diagnostic code, is immediately written to the non-volatile memory inside chassis domain controller A and chassis domain controller B. Storage in both independent controllers ensures redundant backup of the fault history. After storage, the main controller broadcasts a diagnostic message containing the fault diagnostic code and fault severity level to the central control unit via the dual vehicle CAN bus. Upon receiving this diagnostic message, the central control unit instructs the vehicle's instrument panel system to illuminate the corresponding fault warning light and displays specific text warning information on the multi-function display screen to inform the driver that the braking system is currently in a degraded operating state.

[0100] Fault information stored in non-volatile memory can be accessed externally via the vehicle's onboard diagnostic (OBD) interface. Maintenance technicians can use dedicated diagnostic equipment connected to the vehicle's CAN bus via the OBD interface. The diagnostic equipment sends a request message conforming to a preset remote terminal monitoring protocol. Upon receiving the request, the redundant control unit 1 reads the stored fault diagnostic code and corresponding data freeze frame from the non-volatile memory and transmits the data back to the diagnostic equipment via the CAN bus. This mechanism provides precise data support for subsequent fault investigation and repair. The second part of the fault information reporting and recovery mechanism is the judgment and execution of fault recovery. After the system enters any degraded operating mode, the real-time fault diagnosis mechanism does not stop working but continues to monitor the status of the hardware components identified as faulty at the same diagnostic frequency. The triggering of the fault recovery mechanism depends on confirmation that the fault state has been truly eliminated.

[0101] When a previously faulty component's output signal or operating parameters return to normal range, the real-time fault diagnosis mechanism does not immediately determine that the fault has been resolved. Instead, it initiates a fault recovery confirmation timer and enters an observation period. During this period, the mechanism performs multiple status checks on the component. Only when all relevant parameters of the component remain stably within the normal operating range throughout the entire preset observation period will the real-time fault diagnosis mechanism finally confirm that the fault has been eliminated. This time-delay-based confirmation logic filters out brief signal recovery caused by transient electrical interference or mechanical vibration, ensuring the reliability of the recovery decision.

[0102] Once the real-time fault diagnosis mechanism confirms that the fault has been eliminated, it sends an internal "fault clearing" signal to the braking control module. Upon receiving this signal, the braking control module begins executing the fault recovery procedure. The fault recovery procedure first safely deactivates previously activated graded fault degradation strategies. For example, if the system is in emergency braking mode, the braking control module removes the upper limit limit on the target total braking force.

[0103] Subsequently, the braking control module reintegrates components previously marked as failed or partially failed into the normal braking control process. For a six-phase dual-winding permanent magnet synchronous motor recovering from partial failure, the braking control module re-enables the coordinated control of the two sets of three-phase windings. For a wheel-side EMB actuator unit 2 recovering from complete failure, the braking control module reintegrates it into the braking force distribution calculation and restores its power supply and control. To ensure a smooth transition in control, the braking control module reloads the braking control parameters and braking force distribution strategy from the moment the fault occurred when resuming normal operation. This operation ensures that the system does not cause discontinuities or shocks in the vehicle's braking feel due to abrupt changes in the control strategy when exiting degraded mode.

[0104] After the control layer completes the recovery, redundant control unit 1 updates the status of the fault diagnostic codes stored in non-volatile memory. Fault diagnostic codes previously marked as "current fault" or "active fault" will have their status changed to "historical fault" or "stored fault," but the fault diagnostic codes themselves and their data freeze frames will not be deleted for later review. Simultaneously, the main controller will send another diagnostic message to the central control unit via the vehicle's CAN bus, notifying the central control unit that the fault has been cleared. Based on this, the central control unit instructs the instrument panel system to turn off the previously illuminated fault warning lights and cancel the related text warning messages. At this point, the entire fault information reporting and recovery mechanism process is complete, and the system has fully recovered to normal operating status.

[0105] Specific application examples: To aid in understanding the technical solution of this invention, a specific application scenario embodiment is provided below.

[0106] In one embodiment, a vehicle weight parameter The test vehicle, weighing 2000 kg, was fully equipped with the system. The vehicle was tested on a dry, level asphalt surface. The system is traveling at a constant straight speed of 60 km / h, during which all components are functioning normally. At t=1.0 second, the driver initiates a moderate braking operation, pressing the brake pedal. The pedal simulator component 3 detects the corresponding pedal opening. The target braking force is 40%. The main controller, chassis domain controller A, receives this braking request and, combined with the current vehicle speed calculated from the wheel speed sensors, calculates the required total braking force using a fuzzy PID algorithm. The brake force distribution module will The torque is assigned to the four wheels, and the corresponding target motor torque command is generated and sent to the EMB actuator unit 2 at each wheel.

[0107] At t=1.2 seconds, or 0.2 seconds after braking begins, a fault is artificially injected into the system: the U1 phase of the first three-phase winding of the six-phase dual-winding permanent magnet synchronous motor in the EMB actuator unit 2 located at the left front wheel of the vehicle becomes open-circuited. The real-time fault diagnosis mechanism within the system immediately responds to this fault. In the next sampling cycle (e.g., t=1.21 seconds), the diagnostic module of chassis domain controller A compares the command current of phase U1 with the actual feedback current, finding that the command current is not zero while the feedback current remains zero, thus determining that the first three-phase winding has an open-circuit fault. The diagnostic module immediately generates the corresponding diagnostic fault code (DTC) and triggers the first-level degradation strategy.

[0108] According to the first-level degradation strategy, the braking control module immediately executes the following actions: It instructs the motor drive module to stop outputting any drive current to all three phases (U1, V1, W1) of the first three-phase winding of the left front wheel motor; it redirects the total target motor torque originally allocated to the left front wheel to the healthy second three-phase winding; the motor drive module adjusts the current control of the second three-phase winding (U2, V2, W2) to allow it to independently generate all the required torque; the braking control module updates the maximum braking capacity limit of the left front wheel to 50% of its design maximum value; in subsequent calculation cycles, the braking force distribution module recalculates the braking force distribution ratio of the four wheels based on the new capacity limit of the left front wheel. To compensate for the lost braking force of the left front wheel, the system appropriately increases the braking torque of the right front wheel, left rear wheel, and right rear wheel, while actively suppressing the vehicle yaw moment that may be caused by the asymmetry of braking force by precisely adjusting the braking force difference between the left and right wheels; the main controller chassis domain controller A reports a fault diagnostic code to the central control unit via the vehicle CAN bus, and the vehicle's instrument panel illuminates the braking system fault warning light.

[0109] Throughout the entire fault occurrence and handling process, because the healthy second three-phase winding seamlessly took over the braking task, the braking force of the left front wheel only decreased from the normal level to 50%, and was not completely lost. Simultaneously, thanks to the rapid redistribution of the braking force distribution module, the total braking force of the vehicle was maintained at approximately the level requested by the driver, resulting in stable vehicle deceleration without significant deviation or directional instability. The driver was aware of the system fault through the instrument panel, but the vehicle's braking control was not significantly affected, and the vehicle ultimately decelerated safely and smoothly to a stop. This embodiment demonstrates that the system provided by this invention can ensure uninterrupted braking function and maintain vehicle dynamic stability, thereby improving driving safety, even when critical components experience partial failure, through internal redundancy and intelligent degradation strategies.

[0110] To verify the technical effects of the embodiments of the present invention, a hardware-in-the-loop simulation test platform was built.

[0111] The test platform consists of the following components: Real-time simulator: Runs a high-precision vehicle dynamics model to simulate the vehicle's driving state under different operating conditions. Controller hardware: Connects the redundant control units 1 (chassis domain controller A and chassis domain controller B) of this invention as the device under test to the platform. Motor load simulator: Simulates the load characteristics of four six-phase dual-winding permanent magnet synchronous motors and the mechanical transmission system, and is connected to the motor drive module of the controller hardware. Sensor signal simulation board: Simulates signals from pedal travel sensors, wheel speed sensors, etc., providing input to the controller hardware.

[0112] This invention employs the technical solution of this invention, with the wheel-side actuator being a six-phase dual-winding permanent magnet synchronous motor. The comparative embodiment represents prior art, replacing the six-phase motor in this invention with a traditional, equivalent-power three-phase permanent magnet synchronous motor, while maintaining the same control system. Similar to the scenario in the above specific application embodiment, the vehicle travels in a straight line at 60 km / h and begins braking at t=1.0 seconds. At t=1.2 seconds, a single-phase winding open-circuit fault is injected into the motor of the left front wheel.

[0113] The experimental results are as follows: See attached document Figure 3 , attached Figure 3 The horizontal axis represents time (in seconds), and the vertical axis represents the ground braking force generated by the left front wheel (in Newtons). The curves show that before the fault injection at t=1.2 seconds, the left front wheel braking force curves of the embodiment of the present invention and the comparative embodiment completely overlap. At t=1.2 seconds, the left front wheel braking force of the comparative embodiment drops rapidly to zero due to the motor stopping because a single phase of the three-phase motor is open. However, the left front wheel braking force of the embodiment of the present invention, after a brief dynamic adjustment following the fault, stabilizes at approximately 50% of the braking force before the fault and continues to provide braking effect until the vehicle stops.

[0114] See attached document Figure 4 , attached Figure 4 The x-axis represents time (in seconds), and the yaw rate represents the vehicle's yaw rate (in degrees per second). Yaw rate is a key indicator of vehicle stability. The curve shows that at t=1.2 seconds after the fault injection, the sudden change in the braking force of the left front wheel caused fluctuations in the yaw rate of both solutions. The comparative embodiment, due to the complete loss of braking force on the left front wheel, exhibited severe fluctuations in yaw rate, with a large peak value, indicating a significant tendency for the vehicle to veer to the right. In contrast, the embodiment of this invention, by retaining 50% of the braking force and actively redistributing it, showed a much smaller peak value in yaw rate fluctuation compared to the comparative embodiment, and the fluctuation was quickly suppressed and converged to near zero, indicating that the vehicle maintained good driving stability.

[0115] Experimental results show that, compared with the comparative embodiment using a traditional three-phase motor, the present invention can maintain 50% braking capacity on the faulty wheel after a fault occurs, avoiding complete loss of braking force. Simultaneously, through a graded degradation strategy and braking force redistribution, the present invention can suppress vehicle yaw rate fluctuations within a small range, maintaining the vehicle's braking directional stability.

Claims

1. A novel redundant mechanical braking system, characterized in that, include: Redundant human-machine interaction and sensing components are used to collect the driver's braking intention and wheel rotation status, and generate redundant pedal travel signals and wheel speed information. A redundant control unit is used to receive the redundant pedal travel signal and the wheel speed information, and to calculate the braking control command based on the redundant pedal travel signal and the wheel speed information. The redundant control unit consists of chassis domain controller A and chassis domain controller B forming a main and auxiliary control backup. The chassis domain controller A and the chassis domain controller B are connected through a private CAN bus. The wheel-side EMB actuator unit is provided in four units. Each wheel-side EMB actuator unit contains a six-phase dual-winding permanent magnet synchronous motor. The wheel-side EMB actuator unit does not have an independent electronic control unit. The wheel-side EMB actuator unit is used to receive the braking control command and drive the six-phase dual-winding permanent magnet synchronous motor to generate braking torque.

2. The novel redundant mechanical braking system according to claim 1, characterized in that, The six-phase dual-winding permanent magnet synchronous motor includes a stator and a rotor. The stator winding of the stator consists of two completely independent three-phase windings. The two sets of three-phase windings have a preset electrical angle difference in their spatial arrangement in the stator slots.

3. The novel redundant mechanical braking system according to claim 1, characterized in that, The chassis domain controller A and the chassis domain controller B establish a main controller and auxiliary controller relationship. The main controller is responsible for executing all braking calculations and generating the braking control commands. The auxiliary controller synchronously receives all input signals and executes the same calculation process as the main controller in parallel. When the auxiliary controller determines that the main controller has failed, the auxiliary controller immediately triggers the takeover procedure, switches its own operating mode to main control, and outputs the braking control command that has been calculated and stored internally.

4. The novel redundant mechanical braking system according to claim 1, characterized in that, It also includes dual redundant power supplies and dual vehicle CAN buses; the dual redundant power supplies consist of two independent power supplies that are not from the same source, namely vehicle power supply A and vehicle power supply B. Vehicle power supply A supplies power to chassis domain controller A, and vehicle power supply B supplies power to chassis domain controller B; both chassis domain controller A and chassis domain controller B are connected to the dual vehicle CAN buses.

5. A novel redundant mechanical braking system according to claim 1, characterized in that, The wheel-side EMB actuator unit also includes a multi-stage planetary gear reduction mechanism and a ball screw mechanism. The multi-stage planetary gear reduction mechanism and the ball screw mechanism are used to convert the rotational motion output by the six-phase dual-winding permanent magnet synchronous motor into a linear clamping force on the brake disc.

6. A novel redundant mechanical braking system according to claim 1, characterized in that, The redundant human-computer interaction and perception components include a pedal simulator component. The pedal simulator component is equipped with a push rod stroke sensor with dual power supply and dual chip design. The push rod stroke sensor is used to generate two independent pedal stroke signals.

7. A novel redundant mechanical braking system according to claim 1, characterized in that, The redundant human-computer interaction and perception component also includes a wheel speed sensor component. The wheel speed sensor component is equipped with a dual-chip redundant wheel speed sensor at each wheel. The dual-chip redundant wheel speed sensor is used to output two independent pulse signals in parallel. The two independent pulse signals are processed by a logic AND gate circuit to generate the final wheel speed input signal.

8. A novel redundant mechanical braking system according to claim 1, characterized in that, The redundant control unit is also used to: when a fault is detected in one of the three-phase windings in the six-phase dual-winding permanent magnet synchronous motor, instruct the remaining healthy three-phase winding to work independently to provide 50% of the maximum design braking pressure of the six-phase dual-winding permanent magnet synchronous motor.

9. A novel redundant mechanical braking system according to claim 1, characterized in that, The redundant control unit is also configured to: activate the emergency braking mode when two of the wheel-side EMB actuator units are detected to have completely failed, set the upper limit of the target total braking force of the vehicle to 85% of the vehicle weight, and distribute the target total braking force among the remaining two healthy wheel-side EMB actuator units.

10. A novel redundant mechanical braking system according to claim 1, characterized in that, The redundant control unit is also used to: activate the safety braking mode when it is detected that three of the wheel-side EMB actuator units have completely failed, set the upper limit of the target total braking force of the vehicle to 70% of the vehicle weight, and apply the target total braking force entirely to the only healthy wheel-side EMB actuator unit.

Images