Steer-by-wire system safety architecture, control method, and vehicle

Abstract

The disclosed steer-by-wire system safety architecture comprises four subsystems, namely, a first steer-by-wire hand wheel, a second steer-by-wire hand wheel, a first steer-by-wire road wheel and a second steer-by-wire road wheel, which are independent of each other. The same type of subsystems interact with each other through internal communication to exchange health states. The hand wheel subsystem and the corresponding road wheel subsystem transmit steering requests through control communication. The road wheel subsystem can also be connected to other systems of the vehicle through an external interface. A mode control module is provided in the architecture. When a subsystem failure is detected, the remaining effective subsystems are determined to see whether they can support the full steering torque available, and the main and standby subsystems are switched between active, standby, shutdown and other modes. If the architecture is determined to be completely failed, the other systems of the vehicle are triggered to perform preset safety measures. The architecture can solve the availability problem of complete system failure and single system failure, improve the availability, integrity and safety under failure, and also discloses corresponding control methods and vehicles.

Description

Technical Field

[0001] This invention belongs to the field of automotive technology. Specifically, this invention relates to a safety architecture, control method, and vehicle for a steer-by-wire system. Background Technology

[0002] In the automotive industry, especially with the rapid development of autonomous driving technology, steer-by-wire systems have become one of the key technologies for achieving high-level autonomous driving, such as L3-L5, because they can decouple autonomous driving from manual driving, improve the driving experience, and meet the requirements of high-precision and high-response steering control.

[0003] Current steer-by-wire systems generally employ redundant operation to ensure their reliability. However, existing systems have significant limitations when dealing with single-system failures: they typically only shut down the faulty system and switch to a backup system, rarely considering restoring the faulty system; at the same time, they fail to assess whether the remaining, fault-free portion of the system can support the full steering torque, a crucial condition, making it impossible to take safer and more reasonable countermeasures, resulting in poor system availability.

[0004] More seriously, if the backup system also fails and this failure is not detected in time, the driver often finds it difficult to react effectively in a short period of time when steering function is completely lost, which poses a significant safety risk to vehicle operation. Furthermore, current technology lacks effective external safety measures to address the problems of complete steering system failure and inadequate fault detection, failing to ensure that the vehicle can quickly reach a safe state in such extreme situations.

[0005] This paper provides a safety architecture for steer-by-wire systems, specifically addressing how to improve the availability, integrity, and safety of steer-by-wire systems in failure scenarios. Summary of the Invention

[0006] This invention aims to at least address one of the technical problems existing in the prior art. To this end, this invention provides a safety architecture for a steer-by-wire system, with the purpose of improving the availability, integrity, and safety of the steer-by-wire system in case of failure.

[0007] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is: a safety architecture for a steer-by-wire system, including a first steer-by-wire handwheel subsystem, a second steer-by-wire handwheel system, a first steer-by-wire road wheel system, and a second steer-by-wire road wheel system, which are independently configured.

[0008] The first steer-by-wire handwheel subsystem and the second steer-by-wire handwheel subsystem, as well as the first steer-by-wire road wheel subsystem and the second steer-by-wire road wheel subsystem, respectively exchange health status through preset internal communication methods;

[0009] The first steer-by-wire handwheel subsystem and the first steer-by-wire road wheel subsystem, and the second steer-by-wire handwheel subsystem and the second steer-by-wire road wheel subsystem, respectively transmit steering requests through preset control communication methods.

[0010] The first and second steer-by-wire wheel subsystems establish communication connections with other vehicle systems via external communication interfaces.

[0011] The safety architecture of the steer-by-wire system also includes a mode control module, which is used to control the main subsystem and the backup subsystem to switch operating modes when a subsystem failure is detected, based on the judgment result of whether the non-failed redundant subsystem supports the full torque of steering. When it is determined that the steer-by-wire system has completely failed, it triggers other systems of the vehicle to execute preset safety measures.

[0012] The operating modes include at least active mode, standby mode, and shutdown mode.

[0013] Both the first and second steer-by-wire handwheel systems include: steering wheel torque and angle sensors, torque feedback motor status detection components, hand feel simulation control unit, torque feedback motor drive module, internal power module, and internal communication interface; the torque feedback motor status detection components include torque feedback motor position sensor, current sensor, and temperature sensor.

[0014] Both the first and second steer-by-wire road wheel subsystems include: a road wheel angle sensor, a steering drive motor status detection component, a road wheel steering control unit, a steering drive motor drive module, an internal power module, an internal communication interface, and an external communication interface; the steering drive motor status detection component includes a steering drive motor position sensor, a current sensor, and a temperature sensor.

[0015] The preset internal communication method is SPI communication; the preset control communication method is CAN communication.

[0016] The safety architecture of the steer-by-wire system further includes a first low-voltage battery and a second low-voltage battery; the first low-voltage battery supplies power to the first steer-by-wire handwheel subsystem and the first steer-by-wire road wheel subsystem; the second low-voltage battery supplies power to the second steer-by-wire handwheel subsystem and the second steer-by-wire road wheel subsystem.

[0017] The other vehicle systems include at least one of the following: an autonomous driving assistance system, a brake-by-wire system, a vehicle control unit, an airbag control unit, and a DC-DC conversion system.

[0018] The operating mode switching logic executed by the mode control module includes: when there is no fault, the first steer-by-wire handwheel subsystem and the first steer-by-wire road wheel subsystem are in active mode by default, and the second steer-by-wire handwheel subsystem and the second steer-by-wire road wheel subsystem are in standby mode by default; when a fault is detected in the first steer-by-wire handwheel subsystem or the first steer-by-wire road wheel subsystem in active mode, the faulty subsystem is controlled to switch to shutdown mode, and the corresponding standby mode subsystem is controlled to switch to active mode according to the status of the non-failed redundant subsystem.

[0019] The mode control module is also used to: control the faulty subsystem to switch to standby mode after it recovers to normal, and select one of the active mode subsystems to switch from standby mode to active mode according to the current operating status of the active mode subsystem.

[0020] The preset safety measures include: issuing an audible and visual alarm signal to the driver and performing deceleration, emergency braking, or parking maneuvers via the automated driving assistance system; when the automated driving assistance system fails to respond, triggering the brake-by-wire system to perform autonomous deceleration and parking maneuvers.

[0021] The first steer-by-wire handwheel system and the second steer-by-wire handwheel system are respectively used to control the three-phase torque output of the road feel feedback motor; the first steer-by-wire road wheel system and the second steer-by-wire road wheel system are respectively used to control the three-phase torque output of the steering drive motor.

[0022] The mode control module also includes a fault recovery unit, which controls the subsystem in the shutdown mode to switch from shutdown mode to standby mode after the fault of the subsystem in the shutdown mode is detected and resolved.

[0023] The external communication interface is a CAN communication interface. The first steer-by-wire wheel subsystem and the second steer-by-wire wheel subsystem are respectively connected to other vehicle systems through at least two CAN communication interfaces.

[0024] This invention also provides a control method for a safety architecture of a steer-by-wire system, comprising:

[0025] Define the operating modes of the safety architecture of the steer-by-wire system, wherein the operating modes include at least an active mode, a standby mode, and a shutdown mode;

[0026] Fault detection is performed on the first steerable handwheel subsystem, the second steerable handwheel subsystem, the first steerable road wheel system, and the second steerable road wheel system, which are independently configured in the safety architecture of the steerable steering system.

[0027] When a subsystem failure is detected, determine whether the non-failed redundant subsystem supports the availability of full steering torque;

[0028] Based on the judgment result, the main subsystem and the backup subsystem are switched to different operating modes. When the system is determined to be completely failed, other systems of the vehicle are triggered to perform preset safety measures.

[0029] Specifically, the first steer-by-wire handwheel subsystem and the second steer-by-wire handwheel subsystem, as well as the first steer-by-wire road wheel subsystem and the second steer-by-wire road wheel subsystem, interact with each other through preset internal communication methods to exchange health status; the first steer-by-wire handwheel subsystem and the first steer-by-wire road wheel subsystem, as well as the second steer-by-wire handwheel subsystem and the second steer-by-wire road wheel subsystem, transmit steering requests through preset control communication methods.

[0030] The steps for fault detection of the independently configured first steerable handwheel subsystem, second steerable handwheel subsystem, first steerable wheel system, and second steerable wheel system in the system include:

[0031] The operating parameters of the two systems are exchanged in real time through the internal communication interface between the first and second steer-by-wire subsystems to detect whether there is a fault in the steer-by-wire subsystem.

[0032] The operating parameters of the first and second steer-by-wire wheel subsystems are exchanged in real time through the internal communication interface between them to detect whether there is a fault in the steer-by-wire wheel subsystem.

[0033] The step of determining whether the remaining system supports full steering torque availability when a subsystem fault is detected includes:

[0034] When a fault is detected in the first or second steer-by-wire handwheel subsystem, the torque feedback motor status parameters of the non-failed redundant subsystem and the steering drive motor status parameters of the steer-by-wire road wheel system are used to determine whether the non-failed redundant subsystem supports full steering torque availability.

[0035] When a fault is detected in the first or second steer-by-wire wheel system, the system determines whether the remaining system supports full steering torque availability based on the status parameters of the steering drive motor of the remaining steer-by-wire wheel system and the status parameters of the torque feedback motor of the steer-by-wire handwheel system.

[0036] The step of controlling the switching of the operating mode between the primary subsystem and the backup subsystem based on the judgment result includes:

[0037] When no fault is detected, the first steer-by-wire handwheel subsystem and the first steer-by-wire road wheel subsystem are in active mode, while the second steer-by-wire handwheel subsystem and the second steer-by-wire road wheel subsystem are in standby mode.

[0038] When a fault is detected in the first steer-by-wire handwheel subsystem and the remaining systems support full steering torque, the first steer-by-wire handwheel subsystem is switched to the off mode, and the second steer-by-wire handwheel subsystem is switched from standby mode to active mode.

[0039] When a fault is detected in the first steer-by-wire wheel subsystem and the remaining systems support full steering torque, the first steer-by-wire wheel subsystem is switched to the off mode, and the second steer-by-wire wheel subsystem is switched from standby mode to active mode.

[0040] The step of controlling the switching of the operating mode between the primary subsystem and the backup subsystem based on the judgment result further includes:

[0041] When the faulty first steer-by-wire subsystem returns to normal, it switches from the off mode to the standby mode. If the second steer-by-wire subsystem is in active mode and fault-free at this time, it remains in active mode while the first steer-by-wire subsystem remains in standby mode. If the second steer-by-wire subsystem is not in active mode and fault-free at this time, it switches from standby mode to active mode while the second steer-by-wire subsystem remains in standby mode.

[0042] When the faulty first steerable wheel system returns to normal, it is controlled to switch from the off mode to the standby mode. If the second steerable wheel system is in the active mode and has no fault at this time, the active mode of the second steerable wheel system is maintained, and the first steerable wheel system remains in the standby mode. If the second steerable wheel system is not in the active mode and has no fault at this time, the first steerable wheel system is controlled to switch from the standby mode to the active mode, and the second steerable wheel system remains in the standby mode.

[0043] The step of triggering other vehicle systems to execute preset safety measures when the system is determined to have completely failed includes:

[0044] When a fault is detected in the first steer-by-wire handwheel subsystem and the remaining systems do not support the full torque of the steering, and the second steer-by-wire handwheel system also fails, the second steer-by-wire handwheel system is switched to the off mode, an audible and visual warning is issued to the driver, and other vehicle systems are triggered to perform deceleration, emergency braking, or parking maneuvers.

[0045] When a fault is detected in the first steer-by-wire wheel system and the remaining systems do not support full steering torque, and the second steer-by-wire wheel system also malfunctions, the second steer-by-wire wheel system is switched to the off mode, an audible and visual warning is issued to the driver, and other vehicle systems are triggered to perform deceleration, emergency braking, or pull-over operation.

[0046] The steps for triggering other vehicle systems to perform deceleration, emergency braking, or pulling over include:

[0047] Prioritize triggering the automated driving assistance system to perform deceleration, emergency braking, or parking maneuvers;

[0048] If the automatic driving assistance system fails to respond, the brake-by-wire system is triggered to perform autonomous deceleration and stop.

[0049] The operating modes also include an active mode and a passive mode; the active mode is the operating state in which the system can assist the driver in steering the vehicle; the passive mode is the state in which the system is in standby mode and can be directly switched to active mode.

[0050] The present invention also provides a vehicle including the aforementioned steer-by-wire system safety architecture.

[0051] The safety architecture of the steer-by-wire system of the present invention, by assessing whether each subsystem can be recovered after a failure and switching the operating states of each subsystem, and by determining whether the remaining parts of the system can provide full steering torque after a failure of the steer-by-wire system, and by combining steer-by-wire braking, autonomous driving, and rear-wheel steering functions to implement different external safety measures in different scenarios, thoroughly solves the safety problem of complete system failure and the availability problem of single system failure, thereby improving the availability, integrity, and safety of the steer-by-wire system in failure situations. Attached Figure Description

[0052] Figure 1 This is a safety architecture diagram of a steer-by-wire system;

[0053] Figure 2 This is a schematic diagram of a safe operation strategy in case of failure of the steering wheel system;

[0054] Figure 3 This is a schematic diagram of a fail-safe operation strategy for a road steering wheel system. Detailed Implementation

[0055] To facilitate understanding of the present invention, a more comprehensive description of the present invention will be given below with reference to the accompanying drawings, which illustrate several embodiments of the present invention. However, the present invention can be implemented in different forms and is not limited to the embodiments described in the text. Rather, these embodiments are provided to make the disclosure of the present invention more thorough and complete.

[0056] It should be noted that when an element is referred to as being "fixed to" another element, it can be directly on the other element or there may be an intervening element. When an element is referred to as being "connected to" another element, it can be directly connected to the other element or there may be an intervening element. The terms "vertical," "horizontal," "upper," "lower," and similar expressions used in this document are for illustrative purposes only.

[0057] It should be noted that in the following embodiments, the terms "first," "second," and "third" do not represent an absolute distinction in structure and / or function, nor do they represent the order of execution; they are merely for the convenience of description.

[0058] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly associated with those skilled in the art to which this invention pertains. The terminology used herein in the specification of this invention is for the purpose of describing particular embodiments and is not intended to limit the invention. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed items.

[0059] Firstly, such as Figure 1 As shown, this embodiment of the invention provides a safety architecture for a steer-by-wire system, including a first steer-by-wire handwheel subsystem, a second steer-by-wire handwheel subsystem, a first steer-by-wire road wheel subsystem, and a second steer-by-wire road wheel subsystem, all independently configured. The first and second steer-by-wire handwheel subsystems, as well as the first and second steer-by-wire road wheel subsystems, interact in terms of health status via preset internal communication methods. Steering requests are transmitted between the first and second steer-by-wire handwheel subsystems, and between the second steer-by-wire handwheel and road wheel subsystems, via preset control communication methods. The first and second steer-by-wire road wheel subsystems establish communication connections with other vehicle systems via external communication interfaces.

[0060] like Figure 1 As shown, the safety architecture of the steer-by-wire system in this embodiment of the invention also includes a mode control module, which is used to control the main subsystem and the backup subsystem to switch operating modes when a subsystem failure is detected, based on the judgment result of whether the non-failed redundant subsystem supports the availability of full steering torque, and to trigger other vehicle systems to execute preset safety measures when it is determined that the steer-by-wire system has completely failed; the operating modes include at least an active mode, a standby mode and a shutdown mode.

[0061] Specifically, the steer-by-wire system safety architecture of this invention is mainly applied to situations requiring high-precision and high-response steering control, especially in the field of autonomous driving. Autonomous driving systems need to be able to quickly and accurately adjust steering according to road conditions and traffic conditions. Furthermore, steer-by-wire can decouple autonomous driving and manual driving, improving the driving experience. Steer-by-wire systems have become one of the key technologies for achieving high-level autonomous driving (such as L3-L5 levels).

[0062] In this embodiment of the invention, after the safety architecture of the steer-by-wire system is activated, if no system fault is detected, one of the redundant feel simulation control units switches to active mode, and the other backup system switches to standby mode. If a fault is detected in one of the feel simulation control units, it is determined whether it can be recovered. If it can be recovered, it switches to standby mode; if it cannot be recovered, the faulty unit switches to shutdown mode. Then, it is determined whether the remaining steer-by-wire system supports full steering torque availability. If it does and the backup system is fault-free, a yellow warning light is issued to the driver to slow down and drive home. If both redundant feel simulation control units fail, a red warning light is issued to the driver to slow down and stop. If the driver cannot stop in time, the steer-by-wire brakes are notified to automatically slow down and brake. If the vehicle supports autonomous driving, automatic slowdown / stopping / emergency steering / emergency braking are performed according to the scenario and autonomous driving capabilities. Similarly, when the fully redundant wheel steering execution control system fails, the above safety method and strategy are also applied.

[0063] In this embodiment of the invention, the availability, integrity and safety of the system are greatly enhanced by switching the operating states between the main system and the backup system after the fault is recovered and by judging whether the remaining part of the system supports the full torque of the steering. Furthermore, the problems of complete failure of the steering system and insufficient fault detection are solved by coordinating and responding to external safety measures, such as autonomous driving and automatic braking by steer, so that the vehicle can reach a safe state as soon as possible.

[0064] In embodiments of the present invention, such as Figure 1 As shown, the safety architecture diagram of the steer-by-wire system is divided into four subsystems: the first steer-by-wire handwheel subsystem (SbW_HWS_1), the second steer-by-wire handwheel subsystem (SbW_HWS_2), the first steer-by-wire road wheel subsystem (SbW_RWS_1), and the second steer-by-wire road wheel subsystem (SbW_RWS_2).

[0065] In embodiments of the present invention, such as Figure 1As shown, both the first and second steer-by-wire handwheel subsystems include: steering wheel torque and angle sensors, torque feedback motor status detection components, hand feel simulation control unit, torque feedback motor drive module, internal power module, and internal communication interface; the torque feedback motor status detection components include torque feedback motor position sensor, current sensor, and temperature sensor.

[0066] In embodiments of the present invention, such as Figure 1 As shown, both the first and second steer-by-wire wheel subsystems include: a wheel angle sensor, a steering drive motor status detection component, a wheel steering control unit, a steering drive motor drive module, an internal power module, an internal communication interface, and an external communication interface; the steering drive motor status detection component includes a steering drive motor position sensor, a current sensor, and a temperature sensor.

[0067] In embodiments of the present invention, such as Figure 1 As shown, the preset internal communication mode is SPI communication; the preset control communication mode is CAN communication.

[0068] In embodiments of the present invention, such as Figure 1 As shown, the external communication interface is a CAN communication interface. The first steer-by-wire wheel subsystem and the second steer-by-wire wheel subsystem are respectively connected to other vehicle systems through at least two CAN communication interfaces.

[0069] In embodiments of the present invention, such as Figure 1 As shown, the steer-by-wire system safety architecture of this embodiment further includes a first low-voltage battery (low-voltage battery 1) and a second low-voltage battery (low-voltage battery 2); the first low-voltage battery supplies power to the first steer-by-wire handwheel subsystem and the first steer-by-wire road wheel subsystem; the second low-voltage battery supplies power to the second steer-by-wire handwheel subsystem and the second steer-by-wire road wheel subsystem. Each subsystem of the steer-by-wire system safety architecture is designed to meet the highest vehicle safety integrity level - ASILD.

[0070] In embodiments of the present invention, such as Figure 1 As shown, the first and second steer-by-wire wheel systems communicate with other vehicle systems (ADAS advanced driver assistance system, IPB intelligent integrated brake-by-wire system, VCU vehicle control unit, ACU airbag control unit, and DC-DC converter) via two external CAN communication channels.

[0071] In this embodiment of the invention, other vehicle systems include at least one of an automatic driving assistance system, a brake-by-wire system, a vehicle control unit, a rear-wheel steering system, an airbag control unit, and a DC-DC conversion system.

[0072] In this embodiment of the invention, within the steer-by-wire system, the first steer-by-wire handwheel subsystem and the first steer-by-wire road wheel subsystem transmit the driver's steering request from the first steer-by-wire handwheel subsystem to the first steer-by-wire road wheel system and the second steer-by-wire road wheel system via CAN or other communication methods; the second steer-by-wire handwheel subsystem and the second steer-by-wire road wheel system transmit the driver's steering request from the second steer-by-wire handwheel subsystem to the second steer-by-wire road wheel system and the first steer-by-wire road wheel system via CAN or other communication methods; the first steer-by-wire handwheel subsystem and the second steer-by-wire handwheel subsystem perform mutual health status checks on each other's normal operation via SPI or other communication methods; and the first steer-by-wire road wheel system and the second steer-by-wire road wheel system perform mutual health status checks on each other's normal operation via SPI or other communication methods.

[0073] In this embodiment of the invention, the operating mode switching logic executed by the mode control module includes: when there is no fault, the first steer-by-wire handwheel subsystem and the first steer-by-wire road wheel subsystem are in active mode by default, and the second steer-by-wire handwheel subsystem and the second steer-by-wire road wheel subsystem are in standby mode by default; when a fault is detected in the first steer-by-wire handwheel subsystem or the first steer-by-wire road wheel subsystem in active mode, the faulty subsystem is controlled to switch to the off mode, and the corresponding standby mode subsystem is controlled to switch to active mode according to the status of the non-failed redundant subsystem.

[0074] If a fault is detected in the first steer-by-wire subsystem of the active mode, the faulty first steer-by-wire subsystem is switched to the off mode, and the second steer-by-wire subsystem of the standby mode (i.e., the non-failed redundant subsystem) is switched to the active mode.

[0075] If a fault is detected in the first steer-by-wire wheel subsystem in active mode, the faulty first steer-by-wire wheel subsystem is switched to the off mode, and the second steer-by-wire wheel subsystem in standby mode (i.e., the non-failed redundant subsystem) is switched to active mode.

[0076] In this embodiment of the invention, the mode control module is further configured to: control the faulty subsystem to switch to standby mode after the faulty subsystem returns to normal, and select one of the standby mode subsystems to switch to active mode according to the current operating status of the active mode subsystem.

[0077] When the faulty first steer-by-wire subsystem returns to normal, the first steer-by-wire subsystem is switched to standby mode, and the standby mode subsystem (either the first or second steer-by-wire subsystem) is switched to active mode according to the current operating status of the active mode subsystem (either the first or second steer-by-wire subsystem).

[0078] When the faulty first steerable wheel subsystem returns to normal, the first steerable wheel subsystem is switched to standby mode, and the standby mode subsystem (first steerable wheel subsystem or second steerable wheel subsystem) is switched to active mode according to the current operating status of the active mode subsystem (first steerable wheel subsystem or second steerable wheel subsystem).

[0079] In this embodiment of the invention, the preset safety measures include: issuing an audible and visual alarm signal to the driver and performing deceleration, emergency braking, or parking operations through the automatic driving assistance system; when the automatic driving assistance system fails to respond, triggering the brake-by-wire system to perform autonomous deceleration and parking operations.

[0080] In this embodiment of the invention, the first steer-by-wire handwheel subsystem and the second steer-by-wire handwheel subsystem are respectively used to control the three-phase torque output of the road feel feedback motor; the first steer-by-wire road wheel subsystem and the second steer-by-wire road wheel subsystem are respectively used to control the three-phase torque output of the steering drive motor, and the steering drive motor is used to provide the driving force required when the wheels are turning.

[0081] In this embodiment of the invention, the mode control module further includes a fault recovery unit, which is used to control the subsystem in the shutdown mode to switch from the shutdown mode to the standby mode after the fault of the subsystem in the shutdown mode is detected and resolved.

[0082] In this embodiment of the invention, the operating modes include at least an on mode, an active mode, a passive mode, a standby mode, and a off mode. The operating modes of each subsystem are defined as follows:

[0083] On Mode: The steer-by-wire system is in a state where it assists the driver in steering the vehicle. In this mode, the system is either in standby or active mode.

[0084] Passive Mode: When the steer-by-wire system is in standby mode and believes it can assist the driver in steering the vehicle, it will directly switch to active mode unless there are other conditions preventing it from doing so.

[0085] Active Mode: The steering-by-wire system considers itself capable of assisting the driver in steering the vehicle.

[0086] Standby Mode: The steer-by-wire system is in the active mode but does not generate control output. In this mode, the system can be in passive mode or inactive mode.

[0087] Off Mode: The steer-by-wire system is in a state where it cannot assist the driver in steering the vehicle.

[0088] Safe operation strategy for failover of steering wheel system based on Figure 2 As described below:

[0089] When the steer-by-wire system safety architecture is activated and no system fault is detected, the first steer-by-wire handwheel subsystem switches from passive mode to active mode, and the second steer-by-wire handwheel subsystem switches from passive mode to standby mode. When a fault is detected in the first steer-by-wire handwheel subsystem, it switches from active mode to off mode to isolate and prevent the fault from propagating. After the first steer-by-wire handwheel subsystem switches from active mode to off mode, if the non-failed redundant subsystem (second steer-by-wire handwheel subsystem) supports full steering torque, the second steer-by-wire handwheel subsystem switches from standby mode to active mode and issues a yellow warning light to the driver, instructing the driver to slow down and drive home on a slope.

[0090] After the first steer-by-wire handwheel system switches from active mode to off mode, if the non-failed redundant subsystem does not support full steering torque availability and a fault is detected in the second steer-by-wire handwheel system, the second steer-by-wire handwheel system is shut down, and an audible warning and red warning light are emitted to the driver. Simultaneously, a serious fault status for both the first and second steer-by-wire handwheel systems is reported to the automated driving assistance system and the brake-by-wire system. If the driver does not decelerate and stop in time, the automated driving assistance system should assist the driver in decelerating and stopping / emergency braking / emergency steering / pushing to the side of the road according to the specific hazardous scenario. If the automated driving assistance system does not support this, the brake-by-wire system can also autonomously assist in decelerating and stopping, bringing the vehicle to a safe state.

[0091] If the first steerable handwheel system recovers from a fault, it switches from off mode to standby mode. If the second steerable handwheel system recovers from a fault, it switches from off mode to standby mode. If the first steerable handwheel system is not in active mode and the second steerable handwheel system is fault-free, it switches from standby mode to active mode. If the second steerable handwheel system is not in active mode and the first steerable handwheel system is fault-free, it switches from standby mode to active mode. If the second steerable handwheel system is in active mode, the first steerable handwheel system switches from active mode to standby mode. If the first steerable handwheel system is in active mode, the second steerable handwheel system switches from active mode to standby mode. The main system and the backup system can switch between each other, ensuring redundant and safe operation.

[0092] Safe operation strategy for failure of steer-by-wire road wheel system Figure 3 As described below:

[0093] When the steer-by-wire system safety architecture is activated and no system fault is detected, the first steer-by-wire wheel subsystem switches from passive mode to active mode, and the second steer-by-wire wheel subsystem switches from passive mode to standby mode. When the steer-by-wire system safety architecture detects a fault in the first steer-by-wire wheel subsystem, the first steer-by-wire wheel subsystem switches from active mode to off mode to isolate and prevent the fault from propagating. After the first steer-by-wire wheel subsystem switches from active mode to off mode, if the non-failed redundant subsystem (second steer-by-wire wheel subsystem) supports full steering torque, the second steer-by-wire wheel subsystem switches from standby mode to active mode and issues a yellow warning light to the driver, instructing the driver to slow down and drive back home on a slope.

[0094] After the first steer-by-wire wheel system switches from active mode to off mode, if the non-failed redundant subsystem does not support full steering torque availability and a fault is detected in the second steer-by-wire wheel system, the second steer-by-wire wheel system is shut down, and an audible warning and red warning light are emitted to the driver. At the same time, a serious fault status is issued to the automatic driving assistance system and the brake-by-wire system for both the first and second steer-by-wire wheel systems. If the driver does not decelerate and stop in time, the automatic driving assistance system should assist the driver in decelerating and stopping / emergency braking according to the specific hazardous scenario. If the automatic driving assistance system does not support braking, the brake-by-wire system can also autonomously assist in decelerating and stopping or provide limited steering support for the rear wheels to bring the vehicle into a safe state.

[0095] If the first steerable wheel system recovers from a fault, it switches from off mode to standby mode. If the second steerable wheel system recovers from a fault, it switches from off mode to standby mode. If the first steerable wheel system is not in active mode and the second steerable wheel system is fault-free, it switches from standby mode to active mode. If the second steerable wheel system is not in active mode and the first steerable wheel system is fault-free, it switches from standby mode to active mode. If the second steerable wheel system is in active mode and the first steerable wheel system is fault-free, it switches from standby mode to active mode. If the second steerable wheel system is in active mode, the first steerable wheel system switches from active mode to standby mode. If the first steerable wheel system is in active mode, the second steerable wheel system switches from active mode to standby mode. The main system and the backup system can switch between each other, ensuring redundant and safe operation.

[0096] Secondly, embodiments of the present invention provide a control method for a safety architecture of a steer-by-wire system, including:

[0097] Define the operating modes of the safety architecture of the steer-by-wire system, which include at least active mode, standby mode, and off mode;

[0098] Fault detection is performed on the first steerable handwheel subsystem, the second steerable handwheel subsystem, the first steerable road wheel system, and the second steerable road wheel system, which are independently configured in the safety architecture of the steerable steering system.

[0099] When a subsystem failure is detected, determine whether the non-failed redundant subsystem supports the availability of full steering torque;

[0100] Based on the judgment result, the main subsystem and the backup subsystem are switched to different operating modes. When the system is determined to be completely failed, other systems of the vehicle are triggered to perform preset safety measures.

[0101] Specifically, the first steer-by-wire handwheel subsystem and the second steer-by-wire handwheel subsystem, as well as the first steer-by-wire road wheel subsystem and the second steer-by-wire road wheel subsystem, interact with each other through preset internal communication methods to exchange health status; the first steer-by-wire handwheel subsystem and the first steer-by-wire road wheel subsystem, as well as the second steer-by-wire handwheel subsystem and the second steer-by-wire road wheel subsystem, transmit steering requests through preset control communication methods.

[0102] In this embodiment of the invention, the step of fault detection for the first steer-by-wire handwheel subsystem, the second steer-by-wire handwheel subsystem, the first steer-by-wire road wheel subsystem, and the second steer-by-wire road wheel subsystem, which are independently configured in the system, includes:

[0103] The operating parameters of the two systems are exchanged in real time through the internal communication interface between the first and second steer-by-wire subsystems to detect whether there is a fault in the steer-by-wire subsystem.

[0104] The operating parameters of the first and second steer-by-wire wheel subsystems are exchanged in real time through the internal communication interface between them to detect whether there is a fault in the steer-by-wire wheel subsystem.

[0105] In this embodiment of the invention, the step of determining whether the remaining system supports the availability of full steering torque when a subsystem fault is detected includes:

[0106] When a fault is detected in the first or second steer-by-wire handwheel subsystem, the torque feedback motor status parameters of the non-failed redundant subsystem and the steering drive motor status parameters of the steer-by-wire road wheel system are used to determine whether the non-failed redundant subsystem supports full steering torque availability.

[0107] When a fault is detected in the first or second steer-by-wire wheel system, the system determines whether the remaining system supports full steering torque availability based on the status parameters of the steering drive motor of the remaining steer-by-wire wheel system and the status parameters of the torque feedback motor of the steer-by-wire handwheel system.

[0108] In this embodiment of the invention, the step of controlling the primary subsystem and the backup subsystem to switch operating modes according to the judgment result includes:

[0109] When no fault is detected, the first steer-by-wire handwheel subsystem and the first steer-by-wire road wheel subsystem are in active mode, while the second steer-by-wire handwheel subsystem and the second steer-by-wire road wheel subsystem are in standby mode.

[0110] When a fault is detected in the first steer-by-wire handwheel subsystem and the remaining systems support full steering torque, the first steer-by-wire handwheel subsystem is switched to the off mode, and the second steer-by-wire handwheel subsystem is switched from standby mode to active mode.

[0111] When a fault is detected in the first steer-by-wire wheel subsystem and the remaining systems support full steering torque, the first steer-by-wire wheel subsystem is switched to the off mode, and the second steer-by-wire wheel subsystem is switched from standby mode to active mode.

[0112] In this embodiment of the invention, the step of controlling the primary subsystem and the backup subsystem to switch operating modes according to the judgment result further includes:

[0113] When the faulty first steer-by-wire subsystem returns to normal, it switches from the off mode to the standby mode. If the second steer-by-wire subsystem is in active mode and fault-free at this time, it remains in active mode while the first steer-by-wire subsystem remains in standby mode. If the second steer-by-wire subsystem is not in active mode and fault-free at this time, it switches from standby mode to active mode while the second steer-by-wire subsystem remains in standby mode.

[0114] When the faulty first steerable wheel system returns to normal, it is controlled to switch from the off mode to the standby mode. If the second steerable wheel system is in the active mode and has no fault at this time, the active mode of the second steerable wheel system is maintained, and the first steerable wheel system remains in the standby mode. If the second steerable wheel system is not in the active mode and has no fault at this time, the first steerable wheel system is controlled to switch from the standby mode to the active mode, and the second steerable wheel system remains in the standby mode.

[0115] In this embodiment of the invention, when a complete system failure is determined, the step of triggering other vehicle systems to execute preset safety measures includes:

[0116] When a fault is detected in the first steer-by-wire handwheel subsystem and the remaining systems do not support the full torque of the steering, and the second steer-by-wire handwheel system also fails, the second steer-by-wire handwheel system is switched to the off mode, an audible and visual warning is issued to the driver, and other vehicle systems are triggered to perform deceleration, emergency braking, or parking maneuvers.

[0117] When a fault is detected in the first steer-by-wire wheel system and the remaining systems do not support full steering torque, and the second steer-by-wire wheel system also malfunctions, the second steer-by-wire wheel system is switched to the off mode, an audible and visual warning is issued to the driver, and other vehicle systems are triggered to perform deceleration, emergency braking, or pull-over operation.

[0118] In this embodiment of the invention, the step of triggering other vehicle systems to perform deceleration, emergency braking, or pulling over includes:

[0119] Prioritize triggering the automated driving assistance system to perform deceleration, emergency braking, or parking maneuvers;

[0120] If the automatic driving assistance system fails to respond, the brake-by-wire system is triggered to perform autonomous deceleration and stop.

[0121] In this embodiment of the invention, the operating mode further includes an active mode and a passive mode; the active mode is the operating state in which the system can assist the driver in steering the vehicle; the passive mode is the state in which the system is in standby mode and can be directly switched to active mode.

[0122] The above-described steer-by-wire system safety architecture and control method have the following advantages:

[0123] 1: Safety architecture of online steering system Figure 1 As shown, the various subsystems within the steer-by-wire system can form a complete closed-loop communication system. The disconnection or interruption of any communication line will not affect the normal communication and safety monitoring between the subsystems.

[0124] 2: Safety architecture of online steering system Figure 1 As shown, when two redundant wheel subsystems need to output simultaneously to meet the full steering torque control, each handwheel subsystem can communicate synchronously with the two redundant wheel subsystems to avoid asynchronous steering torque output caused by communication delay.

[0125] 3: Safety architecture of online steering system Figure 1As shown, each subsystem has the highest safety integrity level (ASILD) for automobiles, implements high diagnostic coverage for faults, and safety policies perform fault recovery processing for each subsystem to achieve the highest reliability and availability of the system.

[0126] 4: Safety operation strategy for failure of online steering system Figure 2 and Figure 3 As shown, when a fault occurs in each subsystem, a judgment is made on whether the remaining part of the steer-by-wire system can support the full torque output control of the steering. Based on the severity of the fault and the driving scenario, the most reasonable safety measures are implemented to ensure the driving safety of the vehicle.

[0127] 5: Safety operation strategy for failure of online steering system Figure 2 and Figure 3 As shown, when the steer-by-wire system is completely unavailable during manual driving and the driver fails to decelerate or brake in time, other vehicle systems (automatic driving assistance system, brake-by-wire system, rear-wheel steering system) and different driving scenarios assist the driver in decelerating and stopping / emergency braking / emergency steering / pushing to the side of the road.

[0128] Thirdly, embodiments of the present invention provide a vehicle including a safety architecture for a steer-by-wire system with the aforementioned structure. This safety architecture for a steer-by-wire system can be referred to... Figures 1 to 3 Further details will not be elaborated here. Since the vehicle of the present invention includes the steer-by-wire system safety architecture described in the above embodiments, it possesses all the advantages of the aforementioned steer-by-wire system safety architecture.

[0129] The present invention has been described above by way of example with reference to the accompanying drawings. Obviously, the specific implementation of the present invention is not limited to the above-described manner. Any non-substantial improvements made using the inventive concept and technical solution of the present invention, or the direct application of the inventive concept and technical solution of the present invention to other occasions without modification, are all within the protection scope of the present invention.

Claims

1. A safety architecture for a steer-by-wire system, characterized in that, It includes a first steer-by-wire handwheel subsystem, a second steer-by-wire handwheel subsystem, a first steer-by-wire road wheel system, and a second steer-by-wire road wheel system, all of which are independently configured. The first steer-by-wire handwheel subsystem and the second steer-by-wire handwheel subsystem, as well as the first steer-by-wire road wheel subsystem and the second steer-by-wire road wheel subsystem, respectively exchange health status through preset internal communication methods; The first steer-by-wire handwheel subsystem and the first steer-by-wire road wheel subsystem, and the second steer-by-wire handwheel subsystem and the second steer-by-wire road wheel subsystem, respectively transmit steering requests through preset control communication methods. The first and second steer-by-wire wheel subsystems establish communication connections with other vehicle systems via external communication interfaces. The safety architecture of the steer-by-wire system also includes a mode control module, which is used to control the main subsystem and the backup subsystem to switch operating modes when a subsystem failure is detected, based on the judgment result of whether the non-failed redundant subsystem supports the full torque of steering. When it is determined that the steer-by-wire system has completely failed, it triggers other systems of the vehicle to execute preset safety measures. The operating modes include at least active mode, standby mode, and shutdown mode.

2. The safety architecture of the steer-by-wire system according to claim 1, characterized in that, Both the first and second steer-by-wire handwheel systems include: steering wheel torque and angle sensors, torque feedback motor status detection components, hand feel simulation control unit, torque feedback motor drive module, internal power module, and internal communication interface; the torque feedback motor status detection components include torque feedback motor position sensor, current sensor, and temperature sensor.

3. The safety architecture of the steer-by-wire system according to claim 1, characterized in that, Both the first and second steer-by-wire road wheel subsystems include: a road wheel angle sensor, a steering drive motor status detection component, a road wheel steering control unit, a steering drive motor drive module, an internal power module, an internal communication interface, and an external communication interface; the steering drive motor status detection component includes a steering drive motor position sensor, a current sensor, and a temperature sensor.

4. The safety architecture of the steer-by-wire system according to any one of claims 1 to 3, characterized in that, The preset internal communication method is SPI communication; the preset control communication method is CAN communication.

5. The safety architecture of the steer-by-wire system according to any one of claims 1 to 3, characterized in that, It also includes a first low-voltage battery and a second low-voltage battery; the first low-voltage battery supplies power to the first steer-by-wire handwheel subsystem and the first steer-by-wire road wheel system; the second low-voltage battery supplies power to the second steer-by-wire handwheel system and the second steer-by-wire road wheel system.

6. The safety architecture of the steer-by-wire system according to any one of claims 1 to 3, characterized in that, The other vehicle systems include at least one of the following: an autonomous driving assistance system, a brake-by-wire system, a vehicle control unit, an airbag control unit, and a DC-DC conversion system.

7. The safety architecture of the steer-by-wire system according to any one of claims 1 to 3, characterized in that, The operating mode switching logic executed by the mode control module includes: when there is no fault, the first steer-by-wire handwheel subsystem and the first steer-by-wire road wheel subsystem are in active mode by default, and the second steer-by-wire handwheel subsystem and the second steer-by-wire road wheel subsystem are in standby mode by default; when a fault is detected in the first steer-by-wire handwheel subsystem or the first steer-by-wire road wheel subsystem in active mode, the faulty subsystem is controlled to switch to shutdown mode, and the corresponding standby mode subsystem is controlled to switch to active mode according to the status of the non-failed redundant subsystem.

8. The safety architecture of the steer-by-wire system according to claim 7, characterized in that, The mode control module is also used to: control the faulty subsystem to switch to standby mode after it recovers to normal, and select one of the active mode subsystems to switch from standby mode to active mode according to the current operating status of the active mode subsystem.

9. The safety architecture of the steer-by-wire system according to any one of claims 1 to 3, characterized in that, The preset safety measures include: issuing an audible and visual alarm signal to the driver and performing deceleration, emergency braking, or parking maneuvers via the automated driving assistance system; when the automated driving assistance system fails to respond, triggering the brake-by-wire system to perform autonomous deceleration and parking maneuvers.

10. The safety architecture of the steer-by-wire system according to any one of claims 1 to 3, characterized in that, The first steer-by-wire handwheel system and the second steer-by-wire handwheel system are respectively used to control the three-phase torque output of the road feel feedback motor; the first steer-by-wire road wheel system and the second steer-by-wire road wheel system are respectively used to control the three-phase torque output of the steering drive motor.

11. The safety architecture of the steer-by-wire system according to any one of claims 1 to 3, characterized in that, The mode control module also includes a fault recovery unit, which controls the subsystem in the shutdown mode to switch from shutdown mode to standby mode after the fault of the subsystem in the shutdown mode is detected and resolved.

12. The safety architecture of the steer-by-wire system according to any one of claims 1 to 3, characterized in that, The external communication interface is a CAN communication interface. The first steer-by-wire wheel subsystem and the second steer-by-wire wheel subsystem are respectively connected to other vehicle systems through at least two CAN communication interfaces.

13. The control method for the safety architecture of the steer-by-wire system as described in any one of claims 1 to 12, characterized in that, include: Define the operating modes of the safety architecture of the steer-by-wire system, wherein the operating modes include at least an active mode, a standby mode, and a shutdown mode; Fault detection is performed on the first steerable handwheel subsystem, the second steerable handwheel subsystem, the first steerable road wheel system, and the second steerable road wheel system, which are independently configured in the safety architecture of the steerable steering system. When a subsystem failure is detected, determine whether the non-failed redundant subsystem supports the availability of full steering torque; Based on the judgment result, the main subsystem and the backup subsystem are switched to different operating modes. When the system is determined to be completely failed, other systems of the vehicle are triggered to perform preset safety measures. Specifically, the first steer-by-wire handwheel subsystem and the second steer-by-wire handwheel subsystem, as well as the first steer-by-wire road wheel subsystem and the second steer-by-wire road wheel subsystem, interact with each other through preset internal communication methods to exchange health status; the first steer-by-wire handwheel subsystem and the first steer-by-wire road wheel subsystem, as well as the second steer-by-wire handwheel subsystem and the second steer-by-wire road wheel subsystem, transmit steering requests through preset control communication methods.

14. The control method for the safety architecture of the steer-by-wire system according to claim 13, characterized in that, The steps for fault detection of the independently configured first steerable handwheel subsystem, second steerable handwheel subsystem, first steerable wheel system, and second steerable wheel system in the system include: The operating parameters of the two systems are exchanged in real time through the internal communication interface between the first and second steer-by-wire subsystems to detect whether there is a fault in the steer-by-wire subsystem. The operating parameters of the first and second steer-by-wire wheel subsystems are exchanged in real time through the internal communication interface between them to detect whether there is a fault in the steer-by-wire wheel subsystem.

15. The control method for the safety architecture of the steer-by-wire system according to claim 13, characterized in that, The step of determining whether the remaining system supports full steering torque availability when a subsystem fault is detected includes: When a fault is detected in the first or second steer-by-wire handwheel subsystem, the torque feedback motor status parameters of the non-failed redundant subsystem and the steering drive motor status parameters of the steer-by-wire road wheel system are used to determine whether the non-failed redundant subsystem supports full steering torque availability. When a fault is detected in the first or second steer-by-wire wheel system, the system determines whether the remaining system supports full steering torque availability based on the status parameters of the steering drive motor of the remaining steer-by-wire wheel system and the status parameters of the torque feedback motor of the steer-by-wire handwheel system.

16. The control method for the safety architecture of the steer-by-wire system according to claim 13, characterized in that, The step of controlling the switching of the operating mode between the primary subsystem and the backup subsystem based on the judgment result includes: When no fault is detected, the first steer-by-wire handwheel subsystem and the first steer-by-wire road wheel subsystem are in active mode, while the second steer-by-wire handwheel subsystem and the second steer-by-wire road wheel subsystem are in standby mode. When a fault is detected in the first steer-by-wire handwheel subsystem and the remaining systems support full steering torque, the first steer-by-wire handwheel subsystem is switched to the off mode, and the second steer-by-wire handwheel subsystem is switched from standby mode to active mode. When a fault is detected in the first steer-by-wire wheel subsystem and the remaining systems support full steering torque, the first steer-by-wire wheel subsystem is switched to the off mode, and the second steer-by-wire wheel subsystem is switched from standby mode to active mode.

17. The control method for the safety architecture of the steer-by-wire system according to claim 16, characterized in that, Also includes: When the faulty first steer-by-wire subsystem returns to normal, it switches from the off mode to the standby mode. If the second steer-by-wire subsystem is in active mode and fault-free at this time, it remains in active mode while the first steer-by-wire subsystem remains in standby mode. If the second steer-by-wire subsystem is not in active mode and fault-free at this time, it switches from standby mode to active mode while the second steer-by-wire subsystem remains in standby mode. When the faulty first drive-by-wire steering wheel subsystem returns to normal, it is controlled to switch from the off mode to the standby mode; if the second drive-by-wire steering wheel subsystem is in the active mode and has no fault at this time, the active mode of the second drive-by-wire steering wheel subsystem is maintained, and the first drive-by-wire steering wheel subsystem remains in the standby mode. If the second steer-by-wire wheel system is not in active mode and is not faulty at this time, the first steer-by-wire wheel system is switched from standby mode to active mode, while the second steer-by-wire wheel system remains in standby mode.

18. The control method for the safety architecture of the steer-by-wire system according to claim 13, characterized in that, The step of triggering other vehicle systems to execute preset safety measures when the system is determined to have completely failed includes: When a fault is detected in the first steer-by-wire handwheel subsystem and the remaining systems do not support the full torque of the steering, and the second steer-by-wire handwheel system also fails, the second steer-by-wire handwheel system is switched to the off mode, an audible and visual warning is issued to the driver, and other vehicle systems are triggered to perform deceleration, emergency braking, or parking maneuvers. When a fault is detected in the first steer-by-wire wheel system and the remaining systems do not support full steering torque, and the second steer-by-wire wheel system also malfunctions, the second steer-by-wire wheel system is switched to the off mode, an audible and visual warning is issued to the driver, and other vehicle systems are triggered to perform deceleration, emergency braking, or pull-over operation.

19. The control method for the safety architecture of the steer-by-wire system according to claim 18, characterized in that, The steps for triggering other vehicle systems to perform deceleration, emergency braking, or pulling over include: Prioritize triggering the automated driving assistance system to perform deceleration, emergency braking, or parking maneuvers; If the automatic driving assistance system fails to respond, the brake-by-wire system is triggered to perform autonomous deceleration and stop.

20. The control method for the safety architecture of the steer-by-wire system according to any one of claims 13 to 19, characterized in that, The operating modes also include an active mode and a passive mode; the active mode is the operating state in which the system can assist the driver in steering the vehicle; the passive mode is the state in which the system is in standby mode and can be directly switched to active mode.

21. A vehicle, characterized in that, The safety architecture of the steer-by-wire system as described in any one of claims 1 to 12 is included.

Images