Single-pedal control system and method after electromechanical brake system failure

Abstract

The application discloses a single-pedal control system after failure of an electromechanical brake system, which comprises a power domain controller, a master brake controller, an auxiliary brake controller and a wheel-side EMB executor.The power domain controller determines whether an electronic brake pedal failure condition exists according to a state message of the electronic brake pedal, determines whether a master-auxiliary dual brake controller total failure condition exists according to state messages of the master brake controller and the auxiliary brake controller, and determines whether a wheel-side EMB executor total link communication failure condition exists according to a state message of the wheel-side EMB executor.When any of the failure conditions exists, a single-pedal emergency brake mode is started.After the single-pedal emergency brake mode is started, a motor target torque is obtained through a pre-labeled exclusive single-pedal torque mapping relationship according to an opening degree of a throttle pedal, and a motor torque instruction is generated.The application improves brake safety.

Description

Technical Field

[0001] This invention relates to the field of automotive braking control technology, specifically to a single-pedal control system and method for a failed electromechanical braking system. Background Technology

[0002] With the rapid development of intelligent new energy vehicles and drive-by-wire chassis technology, electromechanical braking (EMB) systems have become the mainstream upgrade direction for automotive braking systems due to their core advantages such as fast response speed, high control precision, excellent structural integration, and adaptability to high-level autonomous driving control requirements. However, pure drive-by-wire EMB systems lack a mechanical backup structure, posing a significant challenge to braking redundancy safety. If any link in the electronic brake pedal, main and auxiliary brake controllers, or wheel-side EMB actuators fails, the vehicle's service braking function will be completely lost, easily leading to collisions. Conventional vehicle coasting energy recovery can only provide a weak deceleration effect. When drivers encounter sudden braking failure, they are prone to panic and cannot quickly utilize regenerative braking to control speed. In extreme conditions, if the brake control unit malfunctions or the signal transmission link is interrupted, the braking control command cannot be effectively transmitted to the wheel-side brake calipers, resulting in the complete loss of the vehicle's service braking function and easily causing serious traffic accidents.

[0003] In existing technologies, although regenerative braking of electric motors in new energy vehicles has auxiliary deceleration capabilities, it relies on the effectiveness of the electronic brake pedal and brake controller. If these fail, it cannot interact with the motor control and cannot activate regenerative braking deceleration. It also relies on brake pedal depth detection during emergency braking. If the brake pedal fails, it cannot control the intervention of regenerative braking. Summary of the Invention

[0004] The purpose of this invention is to provide a single-pedal control system and method for the failure of an electromechanical braking system. This invention enables smooth deceleration and stopping of the vehicle, and improves the overall vehicle braking safety under extreme failure conditions.

[0005] To achieve this objective, the present invention provides a single-pedal control system for the failure of an electromechanical braking system, comprising: The power domain controller is used to determine whether there is an electronic brake pedal failure condition based on the signal validity information in the status message of the electronic brake pedal; to determine whether there is a complete failure condition of the main and auxiliary brake controllers based on the signal validity information in the status messages of the main brake controller and the auxiliary brake controller; to determine whether there is a complete communication failure condition of the wheel-side EMB actuator based on the signal validity information in the status message of the wheel-side EMB actuator; and to activate the single-pedal emergency braking mode when any failure condition exists. The power domain controller is also used to generate motor torque commands after the single-pedal emergency braking mode is activated, based on the opening of the accelerator pedal and through a pre-calibrated dedicated single-pedal torque mapping relationship to obtain the corresponding target motor torque.

[0006] Preferably, the specific method for determining whether an electronic brake pedal failure condition exists based on the signal validity information in the electronic brake pedal status message includes: The electronic brake pedal is equipped with a first travel sensor and a second travel sensor. The main brake controller collects two hard-wired travel signals from the first travel sensor, and the auxiliary brake controller collects two hard-wired travel signals from the second travel sensor. The main brake controller verifies the validity of the two hard-wire travel signals it collects. When the main brake controller determines that both hard-wire travel signals are invalid, it identifies the first travel sensor as faulty and reports this to the power domain controller via a status message. The auxiliary brake controller verifies the validity of the two hard-wire travel signals it collects. When the auxiliary brake controller determines that both hard-wire travel signals are invalid, it identifies the second travel sensor as faulty and reports this to the power domain controller via a status message. When the power domain controller simultaneously receives a first stroke sensor failure signal reported by the main brake controller and a second stroke sensor failure signal reported by the auxiliary brake controller, it determines that the electronic brake pedal failure condition has been established.

[0007] Preferably, the specific method for determining whether a complete failure condition of the main and auxiliary braking controllers exists based on the signal validity information in the status messages of the main braking controller and the auxiliary braking controller includes: The power domain controller receives status messages from the main brake controller and auxiliary brake controller in each communication cycle, and verifies the validity of the signal validity information in the status messages. Messages that pass the verification are considered valid. If the power domain controller does not receive valid messages from the main brake controller and the auxiliary brake controller within a preset number of consecutive communication cycles, the condition of complete failure of the main and auxiliary dual brake controllers is determined to be established. Alternatively, if both the main brake controller and the auxiliary brake controller report hardware or software failures in the core control unit, then the condition of complete failure of both main and auxiliary brake controllers is determined to be valid.

[0008] Preferably, the specific method for determining whether there is a full-link communication failure condition of the wheel-side EMB actuator based on the signal validity information in the status message of the wheel-side EMB actuator includes: In each communication cycle, the main brake controller and the auxiliary brake controller send braking torque commands to all wheel-side EMB actuators and receive status messages from each wheel-side EMB actuator. The feedback messages include braking pressure, position information and fault status. The power domain controller monitors the status messages of the main brake controller and the auxiliary brake controller, as well as the status messages fed back by the wheel-side EMB actuators in real time. If both the main brake controller and the auxiliary brake controller have issued valid braking torque commands, but all wheel-side EMB actuators have not fed back valid braking pressure establishment and have all reported a signal that no valid command has been received, and the duration reaches a preset threshold, then the wheel-side EMB actuator full-link communication failure condition is determined to be established. Alternatively, if both the main brake controller and the auxiliary brake controller detect that all wheel-side EMB actuators have lost communication, and the duration of the communication loss reaches a preset threshold, then the wheel-side EMB actuator full-link communication failure condition is determined to be established.

[0009] Preferably, after the single-pedal emergency braking mode is activated, the power domain controller uses a fixed-slope closed-loop control to uniformly reduce the positive drive torque to zero torque, and then outputs the negative feedback braking torque.

[0010] Preferably, the pre-calibrated exclusive single-pedal torque mapping relationship takes the accelerator pedal opening as the main dimension, the current vehicle speed as the second dimension, and the maximum feedback torque capability of the motor and the maximum charging power of the battery as boundary constraints to achieve the output of the target torque of the motor. It can be divided into drive limit range, torque transition range and strong feedback braking range according to the accelerator pedal opening. The drive restriction range is A≤accelerator pedal opening≤100%. Within the drive restriction range, the accelerator pedal is mainly used for drive control. The accelerator pedal opening is linearly positively correlated with the positive torque of the motor drive, that is, the larger the accelerator pedal opening, the higher the drive torque. The torque transition range is B < accelerator pedal opening < A. Within the torque transition range, the motor torque decreases linearly and smoothly from positive drive torque to 0 torque as the accelerator pedal opening decreases. The strong feedback braking range is defined as 0 ≤ accelerator pedal opening ≤ B. Within the strong feedback braking range, the accelerator pedal is mainly used for braking control. The smaller the accelerator pedal opening, the larger the absolute value of the feedback braking torque. When the accelerator pedal opening is 0%, the feedback braking torque reaches the maximum usable value under the current operating conditions. The maximum usable value is the minimum value between the maximum feedback torque capability of the motor and the allowable feedback torque calculated from the maximum charging power of the battery.

[0011] Preferably, the specific process of generating a motor torque command by obtaining the corresponding target motor torque based on the accelerator pedal opening through a pre-calibrated dedicated single-pedal torque mapping relationship includes: When the power domain controller switches to the single-pedal emergency braking mode, the power domain controller reads the accelerator pedal opening signal in real time and obtains the current vehicle speed, the maximum regenerative torque capability of the motor, and the maximum charging power of the battery. The power domain controller stores a pre-calibrated dedicated single-pedal torque mapping relationship. Based on the current accelerator pedal opening and current vehicle speed, the power domain controller obtains the initial target torque value through table lookup and linear interpolation. If the initial target torque is regenerative braking torque, it compares the regenerative braking torque with the maximum regenerative torque capability of the motor and the allowable regenerative torque calculated from the maximum charging power of the battery. The minimum value among these three values ​​is taken as the motor target torque. If the initial target torque is drive torque, the drive torque is directly used as the motor target torque. The power domain controller encapsulates the motor target torque into a motor torque command and sends the motor torque command to the motor controller, which then executes the corresponding torque output.

[0012] A single-pedal control method for a failed electromechanical braking system includes the following steps: Based on the signal validity information in the status message of the electronic brake pedal, determine whether there is an electronic brake pedal failure condition; based on the signal validity information in the status messages of the main brake controller and the auxiliary brake controller, determine whether there is a complete failure condition of the main and auxiliary dual brake controllers; based on the signal validity information in the status message of the wheel-side EMB actuator, determine whether there is a complete communication failure condition of the wheel-side EMB actuator; when any failure condition exists, activate the single-pedal emergency braking mode. After the single-pedal emergency braking mode is activated, the corresponding target torque of the motor is obtained according to the opening of the accelerator pedal through a pre-calibrated exclusive single-pedal torque mapping relationship, thereby generating a motor torque command.

[0013] A computer program product includes a computer program that, when executed by a processor, implements the steps of the above-described method.

[0014] A computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the above-described method.

[0015] The beneficial effects of this invention are: This invention addresses the failure of the entire EMB dual-redundant system by employing cross-domain collaborative control via the power domain controller and utilizing motor energy recovery for emergency braking. This eliminates the need for an additional hydraulic backup system or dedicated emergency braking hardware, reducing system hardware costs and architectural complexity. Furthermore, by using a pre-calibrated dedicated single-pedal torque mapping relationship and a multi-interval linear calibration strategy, the invention divides the accelerator pedal opening into a drive limit interval, a torque transition interval, and a strong feedback braking interval. Combined with torque change rate limiting control, this ensures forced deceleration under emergency conditions while preventing driving shocks caused by sudden torque changes, thus improving braking safety and driving smoothness. Attached Figure Description

[0016] Figure 1 This is a diagram comparing the pedal torque characteristics of the vehicle in single-pedal mode and non-single-pedal mode. Figure 2 This is a flowchart of the present invention. Detailed Implementation

[0017] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments: Example 1 A single-pedal control system for use after failure of an electromechanical braking system, comprising: The Power Domain Control Unit (PDCU) is used to determine whether an electronic brake pedal failure exists based on the signal validity information in the status messages of the electronic brake pedal; to determine whether a complete failure of both main and auxiliary brake controllers exists based on the signal validity information in the status messages of the main and auxiliary brake controllers; and to determine whether a complete communication failure of the wheel-side EMB actuators exists based on the signal validity information in the status messages of the wheel-side EMB actuators. When any failure condition exists, a single-pedal emergency braking mode is activated. This design relies on the collected braking domain (the braking domain refers to all hardware and software logic related to the vehicle's braking function, including the electronic brake pedal, main brake controller, auxiliary brake controller, and auxiliary brake controller) to determine whether a full-link communication failure of the wheel-side EMB actuators exists. The system centrally manages the signal validity, communication status, and fault code information of all hardware (including the main brake controller, auxiliary brake controller, and wheel-side EMB actuators) both physically and logically. Failure logic judgment is performed by a power domain controller independent of the brake controller, unaffected by brake controller malfunctions. Even if both the main and auxiliary brake controllers fail, the power domain controller can still independently identify the brake paralysis state, ensuring the emergency braking trigger logic remains intact. Furthermore, it covers three types of fatal end-to-end failure scenarios in the EMB system, does not rely on a single signal source, and can accurately identify fault states even if a link fails, avoiding misjudgments or omissions. In some preferred embodiments of the present invention, when any failure condition is determined to exist, the any failure condition refers to the failure of the electronic brake pedal, the complete failure of the main and auxiliary dual brake controllers, or the failure of the wheel-side EMB actuator full-link communication.

[0018] The power domain controller is also used to generate motor torque commands after the single-pedal emergency braking mode is activated (i.e., switching from the normal driving mode (non-single-pedal mode) to the single-pedal emergency braking mode). Based on the accelerator pedal opening, it obtains the corresponding target motor torque through a pre-calibrated dedicated single-pedal torque mapping relationship (i.e., Pedal Torque Mapping). This design uses the accelerator pedal as the sole input carrier of driver intent, dividing the torque range to achieve smooth and controllable vehicle deceleration without brake pedal input. Based on the accelerator pedal opening, it calls the dedicated calibrated torque mapping relationship to output motor torque commands, which can eliminate the dependence on the faulty brake pedal. It can accurately and continuously control the regenerative braking intensity by relying solely on the driver's normal operation of the accelerator pedal, reducing the learning cost of emergency operation for the driver.

[0019] In a specific implementation of the present invention, it also includes a motor drive unit, which receives motor torque commands issued by the power domain controller, performs torque linear transition control, and outputs drive or energy regenerative braking torque to drive the vehicle motor to operate. The torque execution result is fed back to the power domain controller for closed-loop verification. It also includes a vehicle human-machine interaction unit, which receives fault alarms and operation guidance commands pushed by the power domain controller, and simultaneously outputs light warnings, voice and text prompts, and central control visual operation guidance to provide feedback to the driver on the fault status of the electromechanical braking system and emergency operation procedures.

[0020] In the above technical solution, the specific method for determining whether an electronic brake pedal failure condition exists based on the signal validity information in the electronic brake pedal status message includes: The electronic brake pedal is equipped with a first stroke sensor and a second stroke sensor (dual-channel redundant non-contact stroke sensor). The main brake controller collects two hard-wired stroke signals from the first stroke sensor, and the auxiliary brake controller collects two hard-wired stroke signals from the second stroke sensor. The main brake controller performs validity checks on the two hard-wire travel signals it collects (validity checks include CRC checks, rolling counter checks, and signal range checks). When the main brake controller determines that both hard-wire travel signals are invalid, it identifies the first travel sensor as faulty and reports this to the power domain controller via a status message. The auxiliary brake controller also performs validity checks on the two hard-wire travel signals it collects. When the auxiliary brake controller determines that both hard-wire travel signals are invalid, it identifies the second travel sensor as faulty and reports this to the power domain controller via a status message. When the power domain controller simultaneously receives a first travel sensor failure signal reported by the main brake controller and a second travel sensor failure signal reported by the auxiliary brake controller, it determines that the electronic brake pedal failure condition has been established. At this time, neither the main brake controller nor the auxiliary brake controller can obtain a valid brake pedal travel signal, that is, they cannot recognize the driver's braking request. The above design allows the main brake controller and the auxiliary brake controller to independently collect two hard-wired signals from two sets of travel sensors. Only when all four signals from both sets of sensors are invalid is the brake pedal completely deemed to have failed. Even if one set of sensors is damaged, the other set of sensors can still be used to normally recognize the braking request, improving the accuracy of fault diagnosis, reducing the probability of false triggering, and accurately distinguishing between single-sensor failure and complete brake pedal failure, avoiding false triggering of emergency mode and interference with normal driving due to a single sensor failure.

[0021] In the above technical solution, the specific method for determining whether a complete failure condition of the main and auxiliary brake controllers exists based on the signal validity information in the status messages of the main brake controller and the auxiliary brake controller includes: The main brake controller and the auxiliary brake controller encapsulate their respective operating status and braking function availability information into status messages, which are periodically sent to the power domain controller (PDCU) via the vehicle CAN bus. The status message contains the controller operating status field and the braking function availability flag (e.g., the brake-by-wire flag, with a valid value of VALID and an invalid value of INVALID). The power domain controller receives status messages from the main brake controller and auxiliary brake controller in each communication cycle and verifies the validity of the signals in the status messages. The verification includes whether the message has been received, whether the rolling counter in the message is continuously increasing, and whether the CRC check is passed. Messages that meet all of the above conditions are considered valid messages. If the power domain controller does not receive valid messages from the main brake controller and the auxiliary brake controller within a preset number of consecutive communication cycles (preferably three), then the condition of complete failure of the main and auxiliary dual brake controllers is determined to be established. Alternatively, if both the main brake controller and the auxiliary brake controller report hardware or software faults in the core control unit, that is, the PDCU receives valid messages from both the main brake controller and the auxiliary brake controller, but the braking function availability flag of both is INVALID, indicating that both the main brake controller and the auxiliary brake controller have reported hardware or software faults in the core control unit, then the dual brake controller failure condition is determined to be valid. The above design sets two criteria: message loss timeout judgment and core fault reporting judgment of the main brake controller and the auxiliary brake controller. If no valid message is received for a continuous preset communication period, it means that the communication link is completely interrupted. If the main brake controller and the auxiliary brake controller report hardware or software faults simultaneously, it means that the controller itself is damaged. Both types of failures can be quickly identified without any blind spots. It can take into account both communication interruption and hardware / software fault controller failure scenarios and avoid omissions due to a single judgment condition.

[0022] In the above technical solution, the specific method for determining whether there is a full-link communication failure condition of the wheel-side EMB actuator based on the signal validity information in the status message of the wheel-side EMB actuator includes: In each communication cycle, the main brake controller and the auxiliary brake controller send braking torque commands to all wheel-side EMB actuators (four wheel-side EMB actuators) and receive status messages from each wheel-side EMB actuator. The feedback messages include braking pressure, position information and fault status. The power domain controller monitors the status messages of the main brake controller and the auxiliary brake controller, as well as the status messages fed back by the wheel-side EMB actuators in real time. If both the main brake controller and the auxiliary brake controller have issued valid braking torque commands, but all wheel-side EMB actuators have not fed back valid braking pressure establishment and have reported a signal that no valid command has been received, and the duration reaches a preset threshold (the preset threshold is 20ms), then the wheel-side EMB actuator full-link communication failure condition is determined to be established. Alternatively, if both the main brake controller and the auxiliary brake controller detect that all wheel-side EMB actuators have lost communication (i.e., the bus offline status bit of all wheel-side EMB actuators is set to 1, and the downlink transmission of braking commands cannot be achieved), and the duration of the communication loss reaches a preset threshold, then the wheel-side EMB actuator full-link communication failure condition is determined to be established. At this time, the braking torque command cannot be effectively transmitted to any wheel-side EMB actuator, and the electromechanical braking system cannot establish braking pressure. The above design continuously monitors the braking torque command issuance status, wheel-side actuator pressure feedback, and bus communication status. Failure is determined only after the condition of no braking pressure establishment or all actuators being offline for a preset duration is met. This filters out false judgments caused by instantaneous bus interference and activates the emergency mode only when the braking link is completely paralyzed. It can accurately identify the hidden failure of no braking force output at the wheel end after the braking torque command is issued and trigger emergency deceleration in advance to avoid the risk of brake failure.

[0023] In the above technical solution, after the single-pedal emergency braking mode is activated, the power domain controller uses a fixed-slope closed-loop control to uniformly reduce the positive drive torque to zero torque before outputting negative feedback braking torque, thus eliminating the vehicle impact caused by sudden torque changes. The above design, after the single-pedal emergency braking mode is activated, first uniformly reduces the positive drive torque to zero at a fixed slope before gradually outputting negative feedback braking torque. A smooth transition process is set between the drive and braking torques to eliminate the risk of vehicle vibration and loss of control caused by torque jumps. It can eliminate the torque jump at the moment of mode switching, avoid vehicle impact and jerking, and ensure the smoothness of driving during emergency deceleration.

[0024] Regarding the specific method of using a fixed-slope closed-loop control to uniformly reduce the positive drive torque to zero torque before outputting negative feedback braking torque, some optimized technical solutions include: When the power domain controller determines that a failure condition has been established and initiates the single-pedal emergency braking mode, the switching of the torque command is executed in two stages. The first stage is the positive drive torque unloading stage: The power domain controller takes the current positive drive torque output by the motor as the starting value, and uses a preset fixed slope (e.g., 4000 N·m / s, which is a calibrable constant) as the rate of change. Within each control cycle (e.g., 1 ms), it calculates the maximum allowable torque change (i.e., slope × control cycle), and makes the torque command value approach the zero torque target value cycle by cycle along the decreasing direction with this change, until the positive drive torque is completely reduced to zero. The second stage is the regenerative braking torque establishment stage: Based on the current accelerator pedal opening, the power domain controller looks up the target regenerative braking torque (negative value) using a pre-calibrated dedicated single-pedal torque mapping relationship (dedicated Pedal Map). Then, using the same fixed change slope (or a separately calibrated slope) as the rate of change, the torque command value is made to approach the target regenerative braking torque cycle by cycle from zero in the negative direction until the target value is reached. Throughout this process, the rate of change of the torque command is strictly limited within the preset slope, thereby eliminating sudden torque changes and achieving shock-free mode switching. It should be noted that the slope limiting control is an open-loop rate limiting method, and does not rely on actual torque feedback for closed-loop adjustment.

[0025] In the above technical solution, the pre-calibrated exclusive single-pedal torque mapping relationship (exclusive Pedal Map) takes the accelerator pedal opening (accelerator pedal opening is 0~100%) as the main dimension, the current vehicle speed as the second dimension, and the maximum feedback torque capability of the motor and the maximum charging power of the battery as boundary constraints to achieve the output of the target torque of the motor (where positive torque is driving torque and negative torque is feedback braking torque). It can be divided into driving limit range, torque transition range and strong feedback braking range according to the accelerator pedal opening. The drive limit range is A (A can be 20%) ≤ accelerator pedal opening ≤ 100%. Within the drive limit range, the accelerator pedal is mainly used for drive control. The accelerator pedal opening is linearly positively correlated with the positive torque of the motor drive, that is, the larger the accelerator pedal opening, the higher the drive torque. The torque transition range is B (B can be 10%) < accelerator pedal opening < A. Within the torque transition range, the motor torque decreases linearly and smoothly from positive drive torque to 0 torque as the accelerator pedal opening decreases, so as to achieve smooth unloading of drive torque and avoid generating obvious driving shock. The strong regenerative braking zone (core emergency braking zone) is defined as 0 ≤ accelerator pedal opening ≤ B. Within this zone, the accelerator pedal is primarily used for braking control; the smaller the accelerator pedal opening, the greater the absolute value of the regenerative braking torque. When the accelerator pedal opening is 0%, the regenerative braking torque reaches its maximum usable value under the current operating conditions. This maximum usable value is the minimum of the allowable regenerative torque calculated from the motor's maximum regenerative torque capability (in Nm) and the battery's maximum charging power (in kW), thereby achieving maximum braking deceleration to meet the deceleration requirements of emergency braking and quickly reduce vehicle speed to avoid collision risks. The above design divides the vehicle into three linear zones: drive limitation, torque transition, and strong regenerative braking. The drive zone ensures basic acceleration capability, the transition zone eliminates torque abrupt changes, and the strong regenerative braking zone achieves maximum deceleration. Simultaneously, the maximum regenerative torque capability of the motor and the maximum charging power of the battery serve as upper torque limits to prevent hardware damage caused by exceeding the rated operating conditions of components. This design can simultaneously meet the needs of normal driving, smooth torque transition, and high-intensity emergency regenerative braking, while protecting the motor and power battery from operating beyond their rated conditions.

[0026] The allowable feedback torque (Nm) converted from the maximum charging power of the battery = maximum charging power of the battery (kW) × 9550 ÷ current motor speed (rpm); In a preferred embodiment, such as Figure 1 The diagram shown illustrates the Pedal Map characteristics of a vehicle at a certain speed. The horizontal axis represents the accelerator pedal opening (%), and the vertical axis represents the motor torque output (Nm). The positive half of the vertical axis represents the drive torque, and the negative half represents the regenerative braking torque. The solid line in the diagram represents the torque output curve in the one-pedal mode described in this invention, while the dashed line represents the torque output curve in the conventional non-one-pedal mode (i.e., coasting energy recovery off mode). Figure 1As can be seen, in single-pedal mode, when the accelerator pedal opening is between 0% and 10% (strong regenerative braking range), the motor outputs negative regenerative braking torque, and the smaller the accelerator pedal opening, the greater the braking torque, reaching maximum regenerative braking intensity when the accelerator is fully released (0% opening). When the accelerator pedal opening is between 10% and 20% (torque transition range), the motor torque linearly and smoothly transitions from the maximum negative regenerative value to 0 Nm. When the accelerator pedal opening is greater than or equal to 20% (drive limiting range), the motor outputs positive drive torque, which increases linearly with the increase of the opening. In contrast, in non-single-pedal mode, the torque is basically maintained at 0 Nm (no braking effect) in the 0% to 10% opening range, and only begins to provide drive torque after exceeding 10%. Through this characteristic curve design, the present invention achieves seamless connection and smooth switching between normal driving and emergency braking.

[0027] In the above technical solution, the specific process of generating a motor torque command by obtaining the corresponding target motor torque based on the accelerator pedal opening through a pre-calibrated dedicated single-pedal torque mapping relationship includes: When the power domain controller switches to the single-pedal emergency braking mode, the power domain controller reads the accelerator pedal opening signal in real time, and at the same time obtains the current vehicle speed, the maximum regenerative torque capability of the motor reported by the motor controller, and the maximum charging power of the battery from the vehicle network. The power domain controller internally stores a pre-calibrated, dedicated single-pedal torque mapping relationship. Based on the current accelerator pedal opening and current vehicle speed, the power domain controller obtains a preliminary target torque value through table lookup and linear interpolation. If the preliminary target torque is regenerative braking torque (negative torque), it compares the regenerative braking torque with the maximum regenerative torque capability of the motor and the allowable regenerative torque calculated from the maximum charging power of the battery. The minimum value among these three is taken as the motor target torque. If the preliminary target torque is drive torque (positive torque), the drive torque is directly used as the motor target torque. The power domain controller then... The target torque is encapsulated as a motor torque command, which is sent to the motor controller via the CAN bus. The motor controller then executes the corresponding torque output, thereby achieving smooth deceleration control that changes with the accelerator pedal opening. The above design quickly obtains the basic torque by looking up a table based on a pre-calibrated dedicated single-pedal torque mapping relationship and using linear interpolation. Under feedback conditions, it automatically takes the minimum allowable feedback torque of the motor and battery as the target torque for the motor, and then encapsulates the command and sends it to the motor controller. The calculation logic is simple and efficient, adapting to the millisecond-level real-time control cycle of the entire vehicle. It can quickly and accurately calculate the safe feedback torque that meets the hardware limits of the entire vehicle, improving the real-time performance and reliability of torque control.

[0028] Example 2 A single-pedal control method after failure of an electromechanical braking system, such as Figure 2 As shown, the system determines whether there is an electronic brake pedal failure condition based on the status message of the electronic brake pedal, whether there is a complete failure condition of the main and auxiliary brake controllers based on the status messages of the main brake controller and the auxiliary brake controller, and whether there is a failure condition of the wheel-side EMB actuator full-link communication based on the status message of the wheel-side EMB actuator. When any failure condition exists, the single-pedal emergency braking mode is activated. After the single-pedal emergency braking mode is activated, the target torque of the motor is obtained according to the opening of the accelerator pedal through the pre-calibrated exclusive single-pedal torque mapping relationship, and the motor torque command is generated.

[0029] The specific method for single-pedal control after the failure of the electromechanical braking system includes the following steps: Based on the signal validity information in the status message of the electronic brake pedal, determine whether there is an electronic brake pedal failure condition; based on the signal validity information in the status messages of the main brake controller and the auxiliary brake controller, determine whether there is a complete failure condition of the main and auxiliary dual brake controllers; based on the signal validity information in the status message of the wheel-side EMB actuator, determine whether there is a complete communication failure condition of the wheel-side EMB actuator; when any failure condition exists, activate the single-pedal emergency braking mode. After the single-pedal emergency braking mode is activated, the corresponding target torque of the motor is obtained according to the opening of the accelerator pedal through a pre-calibrated exclusive single-pedal torque mapping relationship, thereby generating a motor torque command.

[0030] Example 3 A computer program product includes a computer program that, when executed by a processor, implements the steps of the method described in Embodiment 2.

[0031] Example 4 A computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the method as described in Embodiment 2.

[0032] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0033] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A system that specifies functions in one or more boxes.

[0034] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including an instruction set implemented in a process. Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0035] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0036] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit its scope of protection. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that after reading the present invention, they can still make various changes, modifications or equivalent substitutions to the specific implementation of the invention, but these changes, modifications or equivalent substitutions are all within the scope of protection of the pending claims of the invention.

[0037] The contents not described in detail in this specification are existing technologies known to those skilled in the art.

Claims

1. A single-pedal control system for a failed electromechanical braking system, characterized in that, It includes: The power domain controller is used to determine whether there is an electronic brake pedal failure condition based on the signal validity information in the status message of the electronic brake pedal; to determine whether there is a complete failure condition of the main and auxiliary brake controllers based on the signal validity information in the status messages of the main brake controller and the auxiliary brake controller; to determine whether there is a complete communication failure condition of the wheel-side EMB actuator based on the signal validity information in the status message of the wheel-side EMB actuator; and to activate the single-pedal emergency braking mode when any failure condition exists. The power domain controller is also used to generate motor torque commands after the single-pedal emergency braking mode is activated, based on the opening of the accelerator pedal and through a pre-calibrated dedicated single-pedal torque mapping relationship to obtain the corresponding target motor torque.

2. A single-pedal control system for a failed electromechanical braking system according to claim 1, characterized in that: The specific methods for determining whether an electronic brake pedal failure condition exists based on the signal validity information in the electronic brake pedal status message include: The electronic brake pedal is equipped with a first travel sensor and a second travel sensor. The main brake controller collects two hard-wired travel signals from the first travel sensor, and the auxiliary brake controller collects two hard-wired travel signals from the second travel sensor. The main brake controller verifies the validity of the two hard-wire travel signals it collects. When the main brake controller determines that both hard-wire travel signals are invalid, it identifies the first travel sensor as faulty and reports this to the power domain controller via a status message. The auxiliary brake controller verifies the validity of the two hard-wire travel signals it collects. When the auxiliary brake controller determines that both hard-wire travel signals are invalid, it identifies the second travel sensor as faulty and reports this to the power domain controller via a status message. When the power domain controller simultaneously receives a first stroke sensor failure signal reported by the main brake controller and a second stroke sensor failure signal reported by the auxiliary brake controller, it determines that the electronic brake pedal failure condition has been established.

3. A single-pedal control system for a failed electromechanical braking system according to claim 1, characterized in that: Based on the signal validity information in the status messages of the main brake controller and the auxiliary brake controller, the specific methods for determining whether a complete failure condition of the main and auxiliary brake controllers exists include: The power domain controller receives status messages from the main brake controller and auxiliary brake controller in each communication cycle, and verifies the validity of the signal validity information in the status messages. Messages that pass the verification are considered valid. If the power domain controller does not receive valid messages from the main brake controller and the auxiliary brake controller within a preset number of consecutive communication cycles, the condition of complete failure of the main and auxiliary dual brake controllers is determined to be established. Alternatively, if both the main brake controller and the auxiliary brake controller report hardware or software failures in the core control unit, then the condition of complete failure of both main and auxiliary brake controllers is determined to be valid.

4. A single-pedal control system for a failed electromechanical braking system according to claim 1, characterized in that: The specific methods for determining whether there is a full-link communication failure in the wheel-side EMB actuator based on the signal validity information in the status message of the wheel-side EMB actuator include: In each communication cycle, the main brake controller and the auxiliary brake controller send braking torque commands to all wheel-side EMB actuators and receive status messages from each wheel-side EMB actuator. The feedback messages include braking pressure, position information and fault status. The power domain controller monitors the status messages of the main brake controller and the auxiliary brake controller, as well as the status messages fed back by the wheel-side EMB actuators in real time. If both the main brake controller and the auxiliary brake controller have issued valid braking torque commands, but all wheel-side EMB actuators have not fed back valid braking pressure establishment and have all reported a signal that no valid command has been received, and the duration reaches a preset threshold, then the wheel-side EMB actuator full-link communication failure condition is determined to be established. Alternatively, if both the main brake controller and the auxiliary brake controller detect that all wheel-side EMB actuators have lost communication, and the duration of the communication loss reaches a preset threshold, then the wheel-side EMB actuator full-link communication failure condition is determined to be established.

5. A single-pedal control system for a failed electromechanical braking system according to claim 1, characterized in that: After the single-pedal emergency braking mode is activated, the power domain controller uses a fixed-slope closed-loop control to uniformly reduce the positive drive torque to zero torque and then outputs negative feedback braking torque.

6. A single-pedal control system for a failed electromechanical braking system according to claim 1, characterized in that: The pre-calibrated exclusive single-pedal torque mapping relationship takes the accelerator pedal opening as the main dimension, the current vehicle speed as the second dimension, and the maximum feedback torque capability of the motor and the maximum charging power of the battery as boundary constraints to achieve the output of the target torque of the motor. It can be divided into drive limit range, torque transition range and strong feedback braking range according to the accelerator pedal opening. The drive restriction range is A≤accelerator pedal opening≤100%. Within the drive restriction range, the accelerator pedal is mainly used for drive control. The accelerator pedal opening is linearly positively correlated with the positive torque of the motor drive, that is, the larger the accelerator pedal opening, the higher the drive torque. The torque transition range is B < accelerator pedal opening < A. Within the torque transition range, the motor torque decreases linearly and smoothly from positive drive torque to 0 torque as the accelerator pedal opening decreases. The strong feedback braking range is defined as 0 ≤ accelerator pedal opening ≤ B. Within the strong feedback braking range, the accelerator pedal is mainly used for braking control. The smaller the accelerator pedal opening, the larger the absolute value of the feedback braking torque. When the accelerator pedal opening is 0%, the feedback braking torque reaches the maximum usable value under the current operating conditions. The maximum usable value is the minimum value between the maximum feedback torque capability of the motor and the allowable feedback torque calculated from the maximum charging power of the battery.

7. A single-pedal control system for a failed electromechanical braking system according to claim 6, characterized in that: The specific process of generating motor torque commands by obtaining the corresponding target motor torque based on the accelerator pedal opening through a pre-calibrated dedicated single-pedal torque mapping relationship includes: When the power domain controller switches to the single-pedal emergency braking mode, the power domain controller reads the accelerator pedal opening signal in real time and obtains the current vehicle speed, the maximum regenerative torque capability of the motor, and the maximum charging power of the battery. The power domain controller stores a pre-calibrated dedicated single-pedal torque mapping relationship. Based on the current accelerator pedal opening and current vehicle speed, the power domain controller obtains the initial target torque value through table lookup and linear interpolation. If the initial target torque is the regenerative braking torque, it compares the regenerative braking torque with the maximum regenerative torque capability of the motor and the allowable regenerative torque calculated from the maximum charging power of the battery. The minimum value among these three values ​​is taken as the motor target torque. If the initial target torque is the drive torque, the drive torque is directly used as the motor target torque. The power domain controller encapsulates the motor target torque into a motor torque command and sends the motor torque command to the motor controller, which then executes the corresponding torque output.

8. A single-pedal control method after failure of an electromechanical braking system, characterized in that, It includes the following steps: Based on the signal validity information in the status message of the electronic brake pedal, determine whether there is an electronic brake pedal failure condition; based on the signal validity information in the status messages of the main brake controller and the auxiliary brake controller, determine whether there is a complete failure condition of the main and auxiliary dual brake controllers. Based on the signal validity information in the status message of the wheel-side EMB actuator, determine whether there is a failure condition in the end-to-end communication of the wheel-side EMB actuator. When any failure condition exists, activate the single-pedal emergency braking mode; After the single-pedal emergency braking mode is activated, the corresponding target torque of the motor is obtained according to the opening of the accelerator pedal through a pre-calibrated exclusive single-pedal torque mapping relationship, thereby generating a motor torque command.

9. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method of claim 8.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, it implements the steps of the method as described in claim 8.

Images