A monitoring method for EMB emergency brake redundant power supply

Abstract

An EMB emergency braking redundant power supply and monitoring system and method. It relates to the technical field of electronic mechanical braking, and particularly relates to an EMB emergency braking redundant power supply and monitoring system and method. On the basis of the existing double-path input power supply of the EMB wheel controller, an auxiliary power supply path independent of the first input power supply and the second input power supply is added, so that the auxiliary power supply unit can provide short-time low-voltage working power to the microcontroller and the communication module through the auxiliary power supply input end of the wheel controller and the power management chip when the double-path input power supply fails; the voltage state of the first input power supply and the second input power supply is collected by the microcontroller, and the double-path input power supply failure information is reported to the main control unit or the redundant control unit through the communication module, and the motor drive module is controlled to enter the safe working mode.

Description

Technical Field

[0001] This invention relates to the field of electromechanical braking technology, specifically to a monitoring method for an EMB emergency braking redundant power supply. Background Technology

[0002] As the automotive industry moves towards electrification, intelligence, and drive-by-wire, braking systems are gradually evolving from traditional hydraulic braking systems to electronically controlled braking systems. While traditional hydraulic braking systems are technologically mature and highly reliable, they typically require hydraulic lines, brake fluid, hydraulic pumps, and related mechanical transmission mechanisms. This results in complex structures, limited space for installation, high maintenance requirements, and significant challenges in deep integration with the vehicle's electronic control system. Consequently, they cannot fully meet the demands of intelligent driving vehicles for rapid braking system response, integrated control, and drive-by-wire deployment.

[0003] Electromechanical braking systems, or EMB systems, directly drive the brake actuators with an electric motor to generate braking force, eliminating or reducing the traditional hydraulic transmission links. They offer advantages such as fast response, compact structure, easy modular layout, and easy integration with electronic control systems like ABS, ESC, and autonomous driving controllers. Therefore, EMB systems are considered one of the important braking execution solutions for intelligent vehicles and autonomous vehicles.

[0004] However, after eliminating the traditional hydraulic or pneumatic backup structure, the braking function of the EMB system relies more heavily on electrical and electronic components such as the power supply, controller, communication module, and motor drive module. An abnormal power supply, controller malfunction, or communication interruption may cause the wheel-side brake actuators to fail to operate according to braking commands. Since the braking system is directly related to vehicle safety, improving the power supply reliability, communication reliability, and fault detection capability of the EMB system under fault conditions has become a key issue in the engineering application of EMB systems.

[0005] Currently, EMB systems typically employ a dual-input power redundancy design, supplying power to the wheel-side controller via a first and a second input power source. When one input power source fails, the other can continue operating the wheel-side controller, thus improving system power supply reliability. While this dual-redundancy power supply structure addresses the problem of single-source power failure, it lacks an effective mechanism to handle extreme conditions where both input power sources fail simultaneously.

[0006] In situations such as severe vehicle collisions, simultaneous damage to the power supply harness, short circuits in the vehicle's high-voltage system, abnormalities in the low-voltage power supply system, or strong electromagnetic interference, the first and second input power supplies may fail simultaneously. In such cases, the microcontroller, communication module, and motor drive module in the wheel-side controller may all cease operation due to power loss. In particular, when the communication module loses power, the wheel-side controller cannot report the dual-input power supply failure information to the main control unit or redundant control unit. This makes it difficult for the main control unit to promptly obtain the true fault status of the wheel-side controller, thereby affecting the vehicle's degraded braking control and fault handling.

[0007] In other words, while existing dual-power redundancy solutions can improve the reliability of EMB systems under single-power-source failure, problems may still arise when both input power sources fail simultaneously, such as wheel-side controller power loss, inability to upload fault information, and failure of the motor drive module to enter a controlled safe state. Existing safety measures only design switching mechanisms for single-power-source failures and lack effective solutions for extreme scenarios of simultaneous dual-power-source failures, becoming a core bottleneck restricting EMB systems from advancing to the highest ASIL-D safety level. Summary of the Invention

[0008] To address the safety risks posed by the uncontrollable vehicle braking system under extreme conditions when both input power supplies fail simultaneously, the present invention aims to propose a monitoring method for an EMB emergency braking redundant power supply.

[0009] The method is based on the EMB emergency braking system, which includes: a vehicle power input module, an auxiliary power supply unit, a main control unit, and four wheel-side controllers. The vehicle power input module includes a first power output terminal and a second power output terminal. Each wheel-side controller includes a first power input terminal, a second power input terminal, an auxiliary power input terminal, a power management module, a microcontroller, a communication module, and a motor drive module; The first power output terminal is connected to the first power input terminal, and the second power output terminal is connected to the second power input terminal. The auxiliary power supply unit is connected to the auxiliary power input terminal of each wheel-side controller via the auxiliary power supply harness. It is used to provide auxiliary power to the power management module of each wheel-side controller when both the first and second input power supplies fail. The first power input terminal, the second power input terminal, and the auxiliary power input terminal are respectively connected to the power management module; The power management module includes a low-voltage power supply output terminal, which is connected to the microcontroller and the communication module respectively. The microcontroller includes a power sampling terminal and a communication terminal. The power sampling terminal is connected to a first power input terminal and a second power input terminal. The communication terminal is connected to the main control unit via a communication module. The microcontroller is also connected to the motor drive module; The method includes the following steps: S1. The microcontroller of each wheel-side controller acquires the voltage signals of the first power input terminal and the second power input terminal through the power sampling terminal; S2. When the voltages at both the first power input terminal and the second power input terminal are lower than the preset threshold, it is determined that both the first and second power input terminals of the current wheel-side controller are faulty, and the current wheel-side controller is recorded as a faulty wheel-side controller. S3, the auxiliary power supply unit provides auxiliary power to the faulty wheel-side controller; S4, the microcontroller of the fault wheel-side controller reports the information that both the first input power supply and the second input power supply have failed to the main control unit through the communication module; In step S4, the main control unit determines the location of the faulty wheel-side controller based on the information reported by the communication module, and redistributes the braking force to the remaining wheel-side controllers that have not experienced any faults based on the target total braking force of the vehicle, the location of the faulty wheel-side controller, and the working status of the remaining wheel-side controllers that have not experienced any faults. The redistribution of braking force includes, specifically: The reference braking force corresponding to the faulty wheel-side controller is determined as the missing braking force; Set a sharing coefficient for the remaining wheel-side controllers that have not failed, and distribute the missing braking force to the remaining wheel-side controllers that have not failed according to the sharing coefficient; The apportionment coefficient is based on the vehicle's braking deceleration. Perform dynamic assignment; The dynamic assignment specifically refers to: when hour, , , ; when hour, , , ; when hour, , , ; in, This indicates the main compensation wheel allocation coefficient. This represents the sharing coefficient of the diagonal auxiliary compensation wheel. Indicates the cost-sharing coefficient of the low-compensation wheel on the same side; The main compensation wheel refers to the remaining non-faulty wheel-side controllers that are coaxial with the faulty wheel-side controller. The diagonal auxiliary compensation wheel refers to the remaining non-faulty wheel-side controllers that are diagonally opposite to the faulty wheel-side controller and on the same side as the main compensation wheel. The same-side low compensation wheel refers to the remaining wheel-side controllers that are on the same side as the faulty wheel-side controller and are diagonally opposite to the main compensation wheel; S5, the microcontroller of the fault wheel-side controller, controls the motor drive module to enter a safe working mode.

[0010] Furthermore, the microcontroller of the fault wheel-side controller can also report the information that both the first and second input power supplies have failed to the redundant control unit via the communication module.

[0011] Furthermore, in step S3, the auxiliary power supply unit provides auxiliary power to the power management module of the faulty wheel-side controller; The power management module provides power to the microcontroller and communication module respectively through the low-voltage power supply output terminal.

[0012] Furthermore, the auxiliary power supply unit is located within the main control unit.

[0013] Furthermore, the system also includes a redundant control unit, and the auxiliary power supply unit is disposed within the redundant control unit.

[0014] The beneficial effects of the method described in this invention are as follows: When both input power supplies of the wheel-side controller fail, the present invention maintains power supply to its low-voltage control circuit and communication module through an auxiliary power supply unit, enabling the faulty wheel-side controller to still complete fault identification and fault reporting. This avoids the failure of the upper control unit to detect faulty wheels after they are completely powered off, thus improving the fault observability and emergency response capability of the EMB system.

[0015] This invention determines the set of faulty wheels by controlling the control unit and redistributes the braking force to the normal wheels according to the missing braking force, thereby improving the braking redundancy and vehicle stability under dual power supply failure conditions. Attached Figure Description

[0016] Figure 1 This is a system structure diagram as described in Example 1; Figure 2 This is a flowchart illustrating the brake force redistribution process described in Example 1; Figure 3 This is a system structure diagram as described in Example 2; Figure 4 This is a system structure diagram as described in Example 3. Detailed Implementation

[0017] The technical solution of the present invention will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] Example 1 This embodiment provides a monitoring method for redundant power supplies for EMB emergency braking. The method is implemented based on an EMB emergency braking system, such as... Figure 1 As shown, the system includes: The system includes: a vehicle power input module, an auxiliary power supply unit, a main control unit or a redundant control unit, and four wheel-side controllers (left front wheel controller, right front wheel controller, left rear wheel controller and right rear wheel controller). The vehicle power input module includes a first power output terminal and a second power output terminal. The first power output terminal is used to provide a first input power VB1 to the wheel-side controller, and the second power output terminal is used to provide a second input power VB2 to the wheel-side controller.

[0019] Each wheel-side controller includes a first power input terminal, a second power input terminal, an auxiliary power input terminal, a power management module, a microcontroller (MCU), a communication module (CAN), and a motor drive module; The first power output terminal is connected to the first power input terminal, the second power output terminal is connected to the second power input terminal, and the first power input terminal, the second power input terminal, and the auxiliary power input terminal are respectively connected to the power management module.

[0020] The auxiliary power supply unit is connected to the auxiliary power input terminal of each wheel-side controller via an external auxiliary power supply harness. This external auxiliary power supply harness is independent of the power supply harness corresponding to the first input power supply VB1 and the power supply harness corresponding to the second input power supply VB2. Therefore, even if the power supply paths corresponding to the first input power supply VB1 and the second input power supply VB2 are abnormal, the auxiliary power supply unit can still provide auxiliary power to the wheel-side controllers through an independent auxiliary power supply path.

[0021] The auxiliary power supply unit provides emergency auxiliary power to the low-voltage control section of the wheel-side controller when both the first input power supply VB1 and the second input power supply VB2 fail. The low-voltage control section includes a microcontroller (MCU) and a communication module (CAN). The auxiliary power provided by the auxiliary power supply unit is not used as the regular power drive power for the EMB brake motor, but rather to maintain the short-term operation of the MCU and CAN communication module after the failure of both input power supplies, in order to complete power fault detection, fault information uploading, and triggering the safe operating mode of the motor drive module.

[0022] To improve power supply safety, the output terminal of the auxiliary power supply unit or the auxiliary power input terminal of the wheel-side controller can be equipped with an output control circuit, a reverse current protection circuit, a fuse, or a current limiting protection circuit. The reverse current protection circuit blocks the reverse current path between the auxiliary power supply and the first input power supply VB1 and the second input power supply VB2, preventing current backflow between different power supply paths. The output control circuit controls the conduction state of the auxiliary power supply output path, keeping the auxiliary power supply unit in standby output or constantly connected state, and providing auxiliary power to the wheel-side controller when both the first input power supply VB1 and the second input power supply VB2 fail.

[0023] The power supply capacity of the auxiliary power supply unit is determined based on the power consumption of the microcontroller (MCU), CAN communication module, power management module, and related power detection circuits in emergency situations, as well as the target holding time. The target holding time is determined to meet the requirements for the microcontroller (MCU) to complete power status sampling, fault code generation, fault information uploading, and safe status control of the motor drive module.

[0024] In this embodiment, the auxiliary power supply unit is located within the main control unit or redundant control unit. The auxiliary power supply unit outputs a 12V auxiliary power supply, which is input to the auxiliary power input terminal of the wheel-side controller via an external auxiliary power supply harness.

[0025] The power management module within the wheel-side controller receives a first input power supply VB1, a second input power supply VB2, and a 12V auxiliary power supply. The power management module includes a low-voltage power supply output terminal, which converts the received input power supply into a low-voltage operating power supply and supplies power to the microcontroller MCU and the communication module CAN through the low-voltage power supply output terminal. In this embodiment, when both the first input power supply VB1 and the second input power supply VB2 fail, the power management module converts the 12V auxiliary power supply into a 5V low-voltage operating power supply and outputs this 5V low-voltage operating power supply to both the microcontroller MCU and the communication module CAN, enabling the microcontroller MCU and the communication module CAN to maintain operation briefly after the failure of both input power supplies.

[0026] The microcontroller (MCU) includes a power sampling ADC and a communication terminal. The power sampling ADC is connected to a first power input terminal and a second power input terminal, respectively. The communication terminal communicates with the main control unit or redundant control unit via a CAN communication module. The MCU acquires the voltage signals of the first input power supply VB1 and the second input power supply VB2 through the power sampling ADC and compares the acquired voltage signals with a preset threshold. When the voltage signals of both the first input power supply VB1 and the second input power supply VB2 are lower than the preset threshold, the MCU determines that the wheel-side controller has experienced a dual-input power supply failure and generates corresponding power fault information. In this embodiment, the preset threshold is 10V.

[0027] In this embodiment, the communication protocol of the CAN module predefines fault codes corresponding to power failures of the wheel-side controller. After determining that both the first input power supply VB1 and the second input power supply VB2 have failed, the microcontroller (MCU) generates a corresponding fault code based on the fault type and sends the fault code to the main control unit or redundant control unit via the CAN module. Upon receiving the fault code, the main control unit or redundant control unit parses the fault code according to the preset communication protocol to identify the power failure status of the corresponding wheel-side controller. The power failure information may include at least one of the following: wheel-side controller location, first input power supply status, second input power supply status, fault code, and fault occurrence time.

[0028] The main control unit and the redundant control unit serve as the upper-level controllers for the vehicle's braking control. They are connected to each wheel-side controller via a communication bus to receive power fault information uploaded by the wheel-side controllers and identify the power status of the corresponding wheel-side controllers based on the fault information.

[0029] The microcontroller (MCU) is also connected to the motor drive module. When the MCU detects that both the first input power supply VB1 and the second input power supply VB2 have failed, the MCU sends a safety status control signal to the motor drive module, causing the motor drive module to enter a safe operating mode. This safe operating mode includes at least one of the following: power output shutdown, prohibition of receiving conventional braking drive commands, high impedance state, undervoltage protection state, or fault latching state. Therefore, in the event of an abnormality in the main power supply of the wheel-side controller, the motor drive module can remain in a controlled and safe state, reducing the risk of malfunction or damage to the power switching devices due to power supply abnormalities.

[0030] The wheel-side controller circuit design consists of a control ground and a motor circuit ground. The control ground is used for low-voltage control circuits such as the microcontroller (MCU), CAN communication module, and power management module. The motor circuit ground is used for the power circuit of the motor drive module and the EMB brake motor. The control ground and the motor circuit ground are isolated from each other to reduce interference from large current fluctuations, switching noise, or ground potential fluctuations in the motor power circuit to the low-voltage control circuit, and to improve the working stability of the microcontroller (MCU) and CAN communication module under auxiliary power supply conditions.

[0031] This invention adds an auxiliary power supply path independent of the first and second input power supplies to the existing dual-input power supply of the EMB wheel-side controller. This allows the auxiliary power supply unit to provide short-term low-voltage operating power to the microcontroller and communication module via the auxiliary power input terminal of the wheel-side controller and the power management chip when both input power supplies fail. The microcontroller collects the voltage status of the first and second input power supplies and reports the dual-input power supply failure information to the main control unit or redundant control unit through the communication module. At the same time, it controls the motor drive module to enter a safe operating mode.

[0032] The technical contribution of this solution is not simply adding a backup power supply, but rather preserving minimum control and communication capabilities for the wheel-side controller in the extreme condition of simultaneous failure of both input power supplies. This enables the controller to complete a closed-loop process of "failure detection - fault reporting - safe state switching," thereby reducing the risk that the fault will be undetectable, unreportable, and the drive state will be uncontrollable after the wheel-side controller loses power completely.

[0033] In this embodiment, after the main control unit or redundant control unit receives dual-input power failure information uploaded by any wheel-side controller, it executes a post-fault safety handling mechanism. This safety handling mechanism includes faulty wheel-side controller identification, faulty wheel-side controller isolation, redistribution of braking force from remaining wheel-side controllers, fault indication, and degraded braking control.

[0034] Specifically, under normal driving or braking conditions, the main control unit (or redundant control unit) periodically polls the status of each wheel-side controller and obtains in real time the total target braking force of the vehicle, the operating parameters of each wheel-side controller's motor, and the actual braking force of each wheel-side controller. When the first input power supply VB1 and the second input power supply VB2 of any wheel-side controller are both below a preset threshold, the wheel-side controller maintains the short-term operation of the CAN communication module through the auxiliary power supply unit and uploads a fault code to the main control unit or redundant control unit via the CAN communication module. The main control unit or redundant control unit determines the location of the wheel-side controller based on the fault code and the wheel-side controller identifier, and verifies the fault information via CAN communication.

[0035] After confirming that the fault persists, the main control unit or redundant control unit marks the location of the faulty wheel-side controller as a wheel with limited braking capacity and stops sending normal braking output commands to the faulty wheel-side controller, thus completing the isolation of the faulty wheel-side controller.

[0036] At the same time, such as Figure 2 As shown, the main control unit or redundant control unit redistributes the braking force to the remaining normal wheels based on the total target braking force of the vehicle and the working status of the remaining normal wheels, so that the vehicle enters a degraded braking mode.

[0037] Based on the location of the faulty wheel-side controller, identify the main compensation wheel, the diagonal auxiliary compensation wheel, and the same-side low compensation wheel among the remaining unfailed wheels.

[0038] The main compensation wheel is a non-failed wheel located on the same axle as the target wheel and on the opposite side of the vehicle, used to bear the main compensation part of the missing braking force; the diagonal auxiliary compensation wheel is a non-failed wheel located on a different axle than the target wheel and on the opposite side of the vehicle, used to bear the auxiliary compensation part of the missing braking force and help improve the vehicle's yaw stability; the same-side low compensation wheel is a non-failed wheel located on a different axle than the target wheel and on the same side of the vehicle, used to bear the smaller compensation part of the missing braking force, in order to reduce the stability risk caused by excessive increase in same-side braking force.

[0039] Taking the failure of dual-input power supply in the left front wheel controller as an example, let the target total braking force of the vehicle be... The braking force of the left front wheel controller is The braking force of the right front wheel controller is The braking force of the left rear wheel controller is The braking force of the right rear wheel controller is In a traditional four-wheel load distribution system, the left front wheel and the right front wheel bear the load respectively. The left and right rear wheels bear the load respectively. ,Right now , .

[0040] When the left front wheel controller braking force malfunctions, the left front wheel braking force is set to zero, i.e., the left front wheel controller braking force... At this time, the lack of braking force is The missing braking force is controlled by the right front wheel controller. Left rear wheel controller braking force Right rear wheel controller braking force Shared cost. Assume the braking force of the right front wheel controller is... The apportionment factor is The braking force of the left rear wheel controller is The apportionment factor is The braking force of the right rear wheel controller is The apportionment factor is Then it satisfies .

[0041] The remaining wheel braking forces after distribution are as follows: ; ; .

[0042] In this embodiment, the right front wheel controller is the primary compensation wheel, the right rear wheel controller is the diagonally auxiliary compensation wheel, and the left rear wheel controller is the same-side low-compensation wheel. Therefore, a set of normalized allocation coefficients is determined as follows: , , Substituting into the above allocation formula, we get: ; ; .

[0043] Therefore, in the event of a failure of the left front wheel controller, the right front wheel controller, the right rear wheel controller, and the left rear wheel controller will bear approximately 55%, 25%, and 20% of the target total braking force, respectively, thereby compensating for the braking force gap caused by the failure of the left front wheel.

[0044] In this embodiment, to adapt to changes in axle load transfer and adhesion state under different braking intensities, the main control unit or redundant control unit can adjust the vehicle braking deceleration according to the vehicle's braking deceleration. Dynamically assigning values ​​to the apportionment coefficients enables precise distribution of braking force.

[0045] First, who has the factor that varies with braking deceleration: the factor of the main compensation wheel. Diagonal auxiliary compensation wheel allocation coefficient Same-side low compensation wheel allocation coefficient ; Substituting the scenario of a malfunction in the left front wheel controller, i.e. , , And always satisfy .

[0046] Then the braking deceleration The braking system is divided into three segments: low braking, medium braking, and high braking. When the vehicle is under low braking conditions and the road surface adhesion is relatively sufficient, the rear wheels are less likely to lock up. In this situation, the weight allocated to the diagonal assist compensation wheels can be appropriately increased. , , This is to enhance the corrective torque and improve lateral stability.

[0047] when At that time, the vehicle is in a medium braking state, and the balance calibration coefficient is used. , , To balance braking efficiency, front and rear axle braking force distribution, and yaw stability.

[0048] when At this time, the vehicle is under high braking, and a large portion of the load is transferred to the front axle, while the rear axle load is small and the adhesion margin is tight. Therefore, the weight allocated to the right front wheel controller should be increased while the weight allocated to the right rear wheel controller should be decreased. , , This is to reduce the risk of rear wheel slippage and meet the vehicle's lateral stability constraint, namely, the vehicle's lateral acceleration ≤ 0.2g constraint.

[0049] After completing the redistribution of braking force, the main control unit or redundant control unit sends the redistributed braking control command to the remaining normal wheel-side controllers, causing the remaining normal wheel-side controllers to perform compensating braking. At the same time, the main control unit or redundant control unit stores fault codes and reports the fault status to the instrument system, illuminating the brake system warning light, or displaying the location of the faulty wheel graphically.

[0050] like Figure 2 As shown, during the brake force redistribution process, the main control unit or redundant control unit also activates limp mode and limits the vehicle speed, for example, limiting the vehicle speed below 80 km / h. The system then periodically and continuously monitors the status of the faulty wheel and the remaining wheel-side controllers. When the fault is detected as not being recovered, the system maintains the isolation of the faulty wheel-side controller, brake force redistribution, and limp mode; when the fault is detected as recovered and the recovery confirmation conditions are met, the main control unit or redundant control unit clears the fault code, turns off the warning light, exits limp mode, and restores the normal four-wheel braking control logic.

[0051] In the event of a dual-input power failure in the right front wheel controller, left rear wheel controller, or right rear wheel controller, the main control unit or redundant control unit can refer to the handling method described above for a left front wheel controller failure to redistribute braking force to the remaining normal wheels. The distribution coefficient can be calibrated or dynamically adjusted based on vehicle axle load, vehicle speed, braking deceleration, yaw rate, wheel speed, estimated road adhesion, and the available braking force of each normal wheel-side controller.

[0052] When only one wheel fails, a three-wheel braking allocation logic of "primary compensation wheel, diagonal auxiliary compensation wheel, and same-side low compensation wheel" can be used. When two or more wheels fail, the three-wheel allocation rule is no longer forcibly applied. Instead, a set of failed wheels is first formed, and then the maximum available braking force of the remaining normal wheels is calculated. If the remaining available total braking force can cover the target total braking force, it is allocated among the remaining normal wheels according to a dynamic allocation coefficient. If it cannot cover the target total braking force, a limited-amplitude downgrade braking is performed according to the remaining available total braking force, while triggering a braking system fault alarm, speed limit, or limp mode.

[0053] Example 2 This embodiment further defines embodiment 1, such as... Figure 3 As shown, in this embodiment, the main control unit or redundant control unit directly provides a 5V auxiliary low-voltage power supply to the wheel-side controller. After the 5V auxiliary low-voltage power supply is input to the wheel-side controller, it is connected to the power supply terminals of the microcontroller (MCU) and the communication module (CAN), respectively, to maintain the short-term operation of the microcontroller (MCU) and the communication module (CAN) when both the conventional dual-input power supplies VB1 and VB2 fail.

[0054] Unlike Example 1, the 5V auxiliary low-voltage power supply in this example already meets the operating voltage requirements of the microcontroller (MCU) and the communication module (CAN), therefore, voltage conversion is not required through the power management module within the wheel-side controller. When powered by the 5V auxiliary low-voltage power supply, the MCU collects the voltage status of the conventional dual-input power supplies VB1 and VB2. If both VB1 and VB2 are below a preset threshold, the MCU uploads power fault information to the main control unit or redundant control unit via the CAN communication module.

[0055] Other structures, connections, fault judgment methods, fault information uploading methods, and safe operating modes of the motor drive module in this embodiment can be referred to in Embodiment 1, and will not be repeated here.

[0056] Example 3 This embodiment further defines embodiment 1, such as... Figure 4 As shown, in this embodiment, the auxiliary power supply unit is not located within the main control unit or redundant control unit, but is instead an independent auxiliary power supply unit using an external lithium battery, directly providing a 5V auxiliary low-voltage power supply to the wheel-side controller. After the 5V auxiliary low-voltage power supply is input to the wheel-side controller, it provides short-term operating power to both the microcontroller (MCU) and the communication module (CAN), maintaining the minimum control and communication capabilities of the wheel-side controller when both conventional dual-input power supplies VB1 and VB2 fail.

[0057] The remaining structural settings, fault detection and judgment methods, fault information uploading mechanism, and safe working mode of the motor drive module in this embodiment are the same as in Embodiment 1, and will not be repeated here.

[0058] Example 4 This embodiment further defines embodiments 1 to 3, and includes the following steps: S1. The microcontroller of each wheel-side controller acquires the voltage signals of the first power input terminal and the second power input terminal through the power sampling terminal; S2. The microcontroller compares the collected first power input terminal voltage and second power input terminal voltage with preset thresholds respectively; when both the first power input terminal voltage and the second power input terminal voltage are lower than the preset thresholds, it is determined that both the first input power supply and the second input power supply are faulty.

[0059] S3. The auxiliary power supply unit provides auxiliary power to each wheel-side controller. Specifically, the auxiliary power supply unit can be in standby output or constant connection state. Its output terminal inputs auxiliary power to the power management module of each wheel-side controller. The power management module provides low-voltage operating power to the microcontroller and communication module respectively through the low-voltage power supply output terminal, thereby maintaining the short-term operation of the microcontroller and communication module when the dual input power fails.

[0060] S4. The microcontroller of each wheel-side controller generates corresponding power fault information based on the judgment result that both the first input power and the second input power are failed, and reports the power fault information to the main control unit or redundant control unit through the communication module CAN.

[0061] In this embodiment, the communication protocol of the CAN module predefines fault codes corresponding to power failures of the wheel-side controller. After determining that both the first and second input power supplies have failed, the microcontroller generates the corresponding fault code and sends it to the main control unit or redundant control unit via the CAN module. The main control unit or redundant control unit parses the fault code according to the preset communication protocol to identify the power failure status of the corresponding wheel-side controller.

[0062] S5. The microcontroller of each wheel-side controller sends a safety status control signal to the motor drive module, causing the motor drive module to enter a safe operating mode. The safe operating mode includes at least one of the following: power output terminal off, prohibition of receiving conventional braking drive commands, high impedance state, undervoltage protection state, or fault latching state.

Claims

1. A monitoring method for an EMB emergency braking redundant power supply, characterized in that, The method is based on the EMB emergency braking system, which includes: a vehicle power input module, an auxiliary power supply unit, a main control unit, and four wheel-side controllers. The vehicle power input module includes a first power output terminal and a second power output terminal. Each wheel-side controller includes a first power input terminal, a second power input terminal, an auxiliary power input terminal, a power management module, a microcontroller, a communication module, and a motor drive module; The first power output terminal is connected to the first power input terminal, and the second power output terminal is connected to the second power input terminal. The auxiliary power supply unit is connected to the auxiliary power input terminal of each wheel-side controller via the auxiliary power supply harness. It is used to provide auxiliary power to the power management module of each wheel-side controller when both the first and second input power supplies fail. The first power input terminal, the second power input terminal, and the auxiliary power input terminal are respectively connected to the power management module; The power management module includes a low-voltage power supply output terminal, which is connected to the microcontroller and the communication module respectively. The microcontroller includes a power sampling terminal and a communication terminal. The power sampling terminal is connected to a first power input terminal and a second power input terminal. The communication terminal is connected to the main control unit via a communication module. The microcontroller is also connected to the motor drive module; The method includes the following steps: S1. The microcontroller of each wheel-side controller acquires the voltage signals of the first power input terminal and the second power input terminal through the power sampling terminal; S2. When the voltages at both the first power input terminal and the second power input terminal are lower than the preset threshold, it is determined that both the first and second power input terminals of the current wheel-side controller are faulty, and the current wheel-side controller is recorded as a faulty wheel-side controller. S3, the auxiliary power supply unit provides auxiliary power to the faulty wheel-side controller; S4, the microcontroller of the fault wheel-side controller reports the information that both the first input power supply and the second input power supply have failed to the main control unit through the communication module; In step S4, the main control unit determines the location of the faulty wheel-side controller based on the information reported by the communication module, and redistributes the braking force to the remaining wheel-side controllers that have not experienced any faults based on the target total braking force of the vehicle, the location of the faulty wheel-side controller, and the working status of the remaining wheel-side controllers that have not experienced any faults. The redistribution of braking force includes, specifically: The reference braking force corresponding to the faulty wheel-side controller is determined as the missing braking force; Set a sharing coefficient for the remaining wheel-side controllers that have not failed, and distribute the missing braking force to the remaining wheel-side controllers that have not failed according to the sharing coefficient; The apportionment coefficient is based on the vehicle's braking deceleration. Perform dynamic assignment; The dynamic assignment specifically refers to: when hour, , , ; when hour, , , ; when hour, , , ; in, This indicates the main compensation wheel allocation coefficient. This represents the sharing coefficient of the diagonal auxiliary compensation wheel. Indicates the cost-sharing coefficient of the low-compensation wheel on the same side; The main compensation wheel refers to the remaining non-faulty wheel-side controllers that are coaxial with the faulty wheel-side controller. The diagonal auxiliary compensation wheel refers to the remaining non-faulty wheel-side controllers that are diagonally opposite to the faulty wheel-side controller and on the same side as the main compensation wheel. The same-side low compensation wheel refers to the remaining wheel-side controllers that are on the same side as the faulty wheel-side controller and are diagonally opposite to the main compensation wheel; S5, the microcontroller of the fault wheel-side controller, controls the motor drive module to enter a safe working mode.

2. The monitoring method for an EMB emergency braking redundant power supply according to claim 1, characterized in that, The microcontroller of the fault wheel-side controller can also report the information that both the first and second input power supplies have failed to the redundant control unit via the communication module.

3. The monitoring method for an EMB emergency braking redundant power supply according to claim 2, characterized in that, In step S3, the auxiliary power supply unit provides auxiliary power to the power management module of the faulty wheel-side controller; The power management module provides power to the microcontroller and communication module respectively through the low-voltage power supply output terminal.

4. The monitoring method for an EMB emergency braking redundant power supply according to claim 3, characterized in that, The auxiliary power supply unit is located within the main control unit.

5. The monitoring method for an EMB emergency braking redundant power supply according to claim 4, characterized in that, The system also includes a redundant control unit, and the auxiliary power supply unit is located within the redundant control unit.

Images