An electromechanical brake system with full-link redundancy and a control method thereof

Abstract

The application discloses an electromechanical brake system with full-link redundancy and a control method thereof, and relates to the technical fields of automobile chassis electronic control and brake-by-wire technology. The application provides a system and a method, the system comprising a brake intention acquisition assembly configured with a redundant sensor array, an upper-layer control assembly, a redundant communication network and an execution end control assembly arranged at a wheel; the core of the application is that a bottom-layer direct-connection physical link is arranged, so that the execution end control unit directly obtains a second stroke signal across the upper-layer network; in a fault working condition of communication or upper-layer control paralysis, the bottom-layer execution end independently looks up a table to execute degraded braking, and cooperates with a steering auxiliary system to inhibit a yaw attitude. The application avoids the risk of single-point failure of a controller, and still guarantees driving brake safety under an extreme communication fault.

Description

Technical Field

[0001] This invention relates to the fields of electronic control of automotive chassis and brake-by-wire technology in vehicle engineering, and particularly to a fully redundant electromechanical braking system and its control method that meets the safety requirements of advanced autonomous driving functions. Background Technology

[0002] With the popularization of new energy vehicles and the rapid development of advanced autonomous driving technology, vehicle braking systems are undergoing a profound technological evolution from traditional hydraulic braking to electro-mechanical braking (EMB) systems. EMB systems, with their core advantages such as no hydraulic lines, extremely fast response speed, and high braking control precision, have become the mainstream development direction for the cornerstone of future intelligent driving safety. In advanced autonomous driving, the brake-by-wire system is a key component ensuring the safety of occupants.

[0003] To meet the highest functional safety level (ASIL D) specified in the ISO 26262 standard, existing mainstream EMB brake-by-wire systems typically employ a primary / secondary dual-redundant controller architecture. For example, patent document CN118722549A discloses a primary / secondary controller redundancy architecture for an EMB parking system. This system is configured with two controllers (a primary controller and a secondary controller) having the same EMB control logic, communicating with EMB actuators located at the wheel ends via at least two communication lines (such as a dual-channel CAN bus), thereby achieving independent control of the braking force of all four wheels.

[0004] However, experts in this field have discovered through long-term research and engineering practice that the existing technical architecture still has significant functional safety blind spots when facing extreme failure conditions. The fundamental technical pain point lies in the fact that data interaction and control command issuance between the upper-level control terminals (main and auxiliary controllers) and the lower-level execution terminals (four-wheel EMB actuators) are highly, if not entirely, dependent on the communication bus link. In extremely harsh electromagnetic interference environments or severe physical collisions, if the main and auxiliary controllers simultaneously fail (i.e., a common cause failure of the upper-level computing nodes), or if the dual-channel CAN communication network of the entire vehicle experiences a physical break (i.e., a complete communication failure), the braking control commands calculated by the upper layer will be completely unable to be effectively transmitted to the EMB actuators of the four wheels. At this time, although the EMB brake actuators and their mechanical calipers at the wheel end are in a completely normal standby and usable state, they cannot actively apply any braking because they are isolated from the outside world. This will result in a complete interruption of the vehicle's braking control link, severely insufficient backup braking deceleration, and a serious threat to vehicle driving safety.

[0005] Another prior art, CN223850594U, proposes a scheme to increase the hard-wire receiving source by introducing a hard-wired signal from the accelerator pedal as a backup for the domain controller. However, this scheme has two obvious drawbacks: first, it does not disclose the redundancy isolation and power supply anti-interference design of the hard-wired signal at the sensor end; second, its hard-wired signal is only connected to a single wheel EMB caliper, and in the event of a global CAN communication failure, this hard-wired braking request cannot be transmitted to the EMB calipers of the other three wheels, which will ultimately lead to severe unbalanced braking and is very likely to cause the vehicle to lose control and fishtail.

[0006] Therefore, how to overcome the limitations of existing EMB systems that rely excessively on upper-level control centers and global communication networks, and how to still activate the safe braking capability of the underlying EMB calipers under extreme common-cause failure conditions where the controller or communication bus fails simultaneously, thus achieving full-link safety redundancy, is a core technical challenge that urgently needs to be overcome in this field. Summary of the Invention

[0007] To address the serious technical shortcomings of existing EMB architectures in the background art, which fail to transmit braking commands to the underlying execution end under extreme conditions such as dual controller failure or global communication bus interruption, resulting in the loss of braking capability of the entire vehicle, this invention provides a fully redundant electromechanical braking system and its control method. It aims to solve the core technical problem of how to ensure reliable and coordinated degraded braking control of the four-wheel EMB system even in extreme scenarios where the upper-level central control and global bus communication are lost.

[0008] To solve the above-mentioned technical problems, in a first aspect, the present invention provides the following technical solution:

[0009] A fully redundant electromechanical braking system includes: a braking intent acquisition assembly, which includes at least a physically isolated first sensing module and a second sensing module for independently acquiring braking operation stroke and outputting a first stroke signal and a second stroke signal; an upper-level control assembly including a first braking control unit, which is directly electrically connected to the first sensing module via a first physical link to acquire the first stroke signal; a redundant communication network, to which the upper-level control assembly is connected; and an actuator control assembly including multiple actuator control units configured at the vehicle wheel end, all of which are connected to the redundant communication network to receive braking commands from the upper-level control assembly; all of which are directly electrically connected to the second sensing module via a second physical link independent of the redundant communication network to synchronously acquire the second stroke signal; when the upper-level control assembly fails or the redundant communication network is in a communication interruption state, the actuator control units are configured to autonomously output drive control signals to perform degraded braking control based on the second stroke signal acquired via the second physical link.

[0010] By employing a technique that directly connects the second sensing module to the underlying execution control unit via a second physical link, this invention achieves distributed hardware redundancy. Even if the vehicle experiences a combined failure due to the main control center crashing and the entire bus being disconnected, the control units of the four wheels at the bottom layer can still capture the driver's braking intention in real time via hardwired connections and perform autonomous degraded braking. This solution eliminates the single point of failure dependent on the upper-level controller and communication link from the bottom layer of the architecture, significantly improving the system's extreme survivability.

[0011] In a preferred embodiment of the present invention, the upper-level control assembly further includes a second braking control unit. Both the first and second braking control units are mounted on the redundant communication network, which includes a first communication bus and a second communication bus in parallel. The first braking control unit serves as the master control unit, and the second braking control unit serves as the redundant monitoring unit, used to take over braking control when a logic failure occurs in the first braking control unit. By further adopting a dual-controller and dual-communication bus architecture, the present invention can also achieve hot standby switching of the upper-level computing stage. When a software logic failure or random hardware failure occurs within the first braking control unit, the second braking control unit can quickly intervene, ensuring the continuity of braking computing power under normal fault conditions.

[0012] In a preferred embodiment of the present invention, both the first and second sensing modules include a dual-wafer chip redundancy structure. Each sensing module is configured with two independent physically isolated signal output links. Each output link is configured to output a single-sided half-byte transmission protocol signal and a pulse width modulation hard-wired signal in parallel, forming a fully redundant signal output architecture. By further employing the technical features of dual-wafer chip redundancy and simultaneous output of SENT + PWM heterogeneous signals, the present invention can also shield data distortion caused by physical damage to a single sensor or a single type of electromagnetic interference from the source information acquisition end. The parallel transmission of multi-modal signals enhances the reliability of braking demand analysis.

[0013] As a preferred embodiment of the present invention, it further includes a power supply system comprising a first independent redundant power supply and a second independent redundant power supply. The first sensing module is powered by the first independent redundant power supply, and the second sensing module is powered by the second independent redundant power supply. The first and second independent redundant power supplies are physically and electrically isolated from each other and have independent common ground loops. By further employing the dual-redundant independent power supply technology feature of full physical and electrical isolation, the present invention can also prevent common-cause failures at the power tree level. A short circuit or power failure of a single power supply will not cause the entire pedal signal acquisition system to fail, ensuring the availability of the pedal signal under electrical faults.

[0014] In a preferred embodiment of the present invention, both the upper-level control assembly and the actuator control unit are embedded with dual-channel signal cross-checking logic. This logic is configured to decode the travel values ​​corresponding to the two acquired physical signals respectively, and compare the consistency of the two travel values. If the deviation between the two travel values ​​is less than or equal to a preset consistency threshold, the current travel signal is deemed valid. By further employing a dual-channel signal cross-checking mechanism with a set tolerance threshold, the present invention can also effectively filter out system errors or line glitches caused by mechanical wear, avoiding the risk of the underlying actuator implementing erroneous braking based on incorrect signals and improving the robustness of control commands.

[0015] As a preferred embodiment of the present invention, at least one of the execution end control units is configured with information broadcasting logic to broadcast the second travel signal acquired based on the second physical link synchronously via the first communication bus and the second communication bus at a broadcasting frequency not exceeding a preset time period, so that the upper-level control assembly can acquire the second travel signal when the first travel signal fails. By further employing a reverse signal broadcasting mechanism from the lower layer to the upper layer, the present invention can also maximize the utilization of sensor resources. When the main acquisition channel of the upper layer fails, the upper-level control assembly can read the backup signal transmitted back from the wheel end via the bus, ensuring that advanced and complex braking distribution strategies (such as ABS and ESC) can still operate.

[0016] In a preferred embodiment of the present invention, the actuator control assembly includes four actuator control units independently located at the left front wheel, right front wheel, left rear wheel, and right rear wheel of the vehicle. Each actuator control unit stores a preset travel-braking force mapping table. In the degraded braking control state, the actuator control unit queries the mapping table to convert the verified second travel signal into the target braking force parameter. By further employing a four-wheel distributed independent calibration lookup table logic, the present invention can also achieve low-level control capabilities at all four wheels even when the vehicle's computing power is offline. Based on the factory-preset calibration curves, the four wheels can apply a balanced braking force corresponding to the pedal depth, suppressing loss of vehicle attitude control during emergency braking.

[0017] As a preferred embodiment of the present invention, it further includes a steering assist system communicatively connected to the system; when the system is in a communication interruption state and performs degraded braking control, if the steering assist system detects that the difference between the actual yaw rate and the theoretical yaw rate of the vehicle deviates from the normal range, it triggers yaw suppression cooperative control logic, and the steering assist system is configured to output a reverse assist compensation torque to counteract the vehicle yaw moment. By further adopting a cross-domain (braking domain and steering domain) underlying cooperative mechanism, the present invention can also achieve active application of a reverse torque by means of the electric power steering (EPS) system under independent braking conditions of each wheel, correcting the vehicle attitude and eliminating the yaw risk caused by sudden changes in the adhesion coefficient of the road surface on one side.

[0018] To solve the above-mentioned technical problems, in a second aspect, the present invention provides the following control method:

[0019] A control method for an electromechanical braking system based on the aforementioned full-link redundancy includes the following hierarchical redundancy control steps: Environmental state perception step: real-time monitoring of the validity of the first stroke signal, the operating status of the upper-level control assembly, and the link connectivity of the redundant communication network; Basic braking execution step: when the first stroke signal is valid and there are no abnormalities in the upper-level control assembly and the redundant communication network, the upper-level control assembly calculates the vehicle-wide target braking force distribution strategy based on the first stroke signal and sends it to each execution-end control unit via the redundant communication network; First-level degradation control step: when the first stroke signal is determined to be faulty, but there are no abnormalities in the upper-level control assembly and the redundant communication network, the upper-level control assembly extracts the second stroke signal broadcast by the execution-end control unit via the redundant communication network and issues a braking command based on the second stroke signal; Second-level emergency control step: when a failure of the upper-level control assembly is detected, or a communication failure occurs in the redundant communication network, all execution-end control units block the response to network commands, directly read the second stroke signal through their own second physical link, and independently generate drive commands to execute emergency backup braking.

[0020] By employing a dynamically perceptive environment and a hierarchical, stepped degradation-tolerant logic, this invention enables a smooth transition from minor faults to extreme operating conditions. The control strategy ensures that the highest level of control performance is maintained when conditions permit, and activates the underlying control mechanism when communication or upper-level failures occur, establishing a multi-functional safety defense.

[0021] As a preferred control method, in the basic braking execution step, the second braking control unit synchronously performs control calculations, and its calculation results are periodically compared with the calculation results of the first braking control unit. If the comparison deviation exceeds the tolerance range, the second braking control unit revokes the master control authority of the first braking control unit within a control cycle and continues to send braking commands to the execution control unit. By further employing a dual-core synchronous calculation and cross-monitoring mechanism, this invention can also achieve fault arbitration and seamless hot switching within a single control cycle, maintaining a consistent braking experience.

[0022] As a preferred control method, in the first-level degraded control step, the transition response time from the basic braking execution step to the first-level degraded control step is configured to be no more than 20 milliseconds, so as to achieve a smooth transition in the issuance of braking torque commands. By further strictly limiting the time window of state machine switching (≤20ms), the present invention can also suppress braking force jitter caused by state switching and avoid sudden changes in longitudinal acceleration.

[0023] As a preferred control method, the second-level emergency control steps specifically include: each actuator control unit independently verifies the second stroke signal it acquires; upon successful verification, the actuator control unit uses the second stroke signal as input to query the braking force mapping table stored in its non-volatile memory to obtain the target braking mechanical thrust value for the corresponding wheel; and through an internal closed-loop control algorithm, drives the corresponding braking actuator to achieve the target braking mechanical thrust value. By further employing wheel-end autonomous data verification, static table lookup, and low-level closed-loop servo control, this invention can also ensure that even with the loss of global communication clock synchronization, the four wheel actuators can still convert pedal displacement into mechanical clamping force.

[0024] As a preferred embodiment of the control method, a single-point communication loss fault-tolerant step is also included: when the upper-level control assembly detects a communication failure with the actuator control unit of a single target wheel, while the communication links of the other three wheels are normal: if it is determined that the actuator control unit of the target wheel can still output basic braking force based on the second physical link, the upper-level control assembly dynamically adjusts the target braking force distribution ratio of the other three wheels according to the basic braking force to maintain the vehicle's braking balance and trigger the vehicle yaw correction logic. By further employing adaptive compensation logic under single-wheel communication failure, this invention can also reorganize the braking force field distribution when only a local network failure occurs, preventing incoordination between the fixed output of a single wheel and the intelligent output of the other three wheels.

[0025] As a preferred control method, in the single-point communication loss fault-tolerant step, if it is determined that the actuator control unit of the target wheel has lost its braking output capability, the upper-level control assembly immediately triggers a three-wheel backup control strategy. Based on the total braking force required by the entire vehicle, it is redistributed and superimposed onto the other three normal actuator control units to compensate for the vehicle deceleration. By further introducing a residual wheel redistribution strategy for the vehicle's required force, this invention can also fully utilize the road adhesion limit of the remaining three wheels to provide deceleration that meets regulatory requirements even under conditions of partial braking efficiency loss.

[0026] As a preferred control method, in the second-level emergency control step, when the individual actuator control units are in an information silo state, distributed steady-state control is implemented through a joint steering assist system. Specifically, this includes: the steering assist system acquiring steering wheel angle and vehicle speed signals in real time; and based on a two-degree-of-freedom vehicle dynamics model, using formulas... Calculate the theoretical yaw rate γ th Where V is the vehicle speed, L is the vehicle wheelbase, and K GAs a stability factor, the front wheel steering angle δ is obtained based on the steering wheel angle signal and a preset steering gear ratio. When the absolute difference between the actual yaw rate obtained by the actual sensor and the theoretical yaw rate is greater than a threshold, the steering assist system applies an active self-centering torque. By further combining the deviation with a dynamic mathematical model, this invention can also achieve rapid correction of the yaw rate. The risk of lateral instability caused by longitudinal braking is mitigated through the steering system, achieving cross-domain integrated protection.

[0027] Compared with the prior art, the present invention has the following substantial features and significant beneficial effects:

[0028] First, the system-level hardware redundancy architecture has been optimized, achieving a high degree of system-level hardware redundancy. This invention solves the technical problem of global functional loss due to the failure of a single node in traditional linear architectures by setting up a low-level physical direct connection channel (second physical link). This allows core braking commands to reach the execution end directly, bypassing upper-level control nodes and communication networks. This end-to-end hardware redundancy architecture spans five major components: sensors, power supply, controller, communication, and actuators, reducing the risk of complete braking function failure from the very source of the architecture design.

[0029] Secondly, a highly flexible multi-dimensional hierarchical braking control system was constructed. The control method designed in this invention achieves smooth transition between normal operating conditions and various severe fault modes. Whether facing a single control node failure, a unilateral network channel interruption, or a full-link communication interruption, the system retains different levels of degraded control strategies. In particular, the independent emergency braking logic at the bottom layer endows the bottom actuator with autonomous output capability, avoiding the loss of braking force caused by decision logic deadlock or communication network paralysis from the architectural source, and greatly reducing the dependence on the availability of computing power of the upper-level domain controller.

[0030] Third, it possesses excellent cross-domain coordination and chassis steady-state compensation capabilities. The fault-tolerance strategy of this invention is not limited to the self-degradation output of longitudinal braking force, but also extends the scope to the global stability of the vehicle's multi-degree-of-freedom dynamics. By triggering the yaw suppression coordination function of the steering assist system (EPS) under extreme fault conditions, the yaw torque that may be generated by blind braking at the underlying level is specifically counteracted, ensuring the vehicle's driving stability under extreme conditions and providing a highly reliable safety foundation for advanced autonomous driving. Attached Figure Description

[0031] To more clearly illustrate the technical solutions of the embodiments disclosed in this invention, the accompanying drawings of the embodiments will be briefly described below. These drawings are for illustrative purposes only and are not intended to limit the scope of protection of this invention.

[0032] Figure 1This is a block diagram of the overall architecture of a fully redundant electromechanical braking system provided in an embodiment of the present invention.

[0033] Figure 2 The flowchart of the hierarchical redundancy and emergency braking control logic in the system control method provided in the embodiment of the present invention is shown.

[0034] Figure 3 This is a schematic diagram of the underlying hardware signal processing and lookup table mapping control principle of the execution control unit provided in an embodiment of the present invention. Detailed Implementation

[0035] The technical solutions (including preferred technical solutions) of the present invention will be further described in detail below with reference to the accompanying drawings and by way of listing some optional embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0036] Example 1

[0037] like Figure 1 As shown, this embodiment provides an electromechanical braking system with full-link redundancy.

[0038] The system mainly comprises five core physical subsystems: the braking intent acquisition assembly 100, which ensures highly reliable acquisition of source information; the power supply system, which provides isolated power for the entire system; the upper-level control assembly 200, which is responsible for coordinating the braking strategy of the entire vehicle; the redundant communication network 300, which is responsible for the data throughput of each component; and the execution end control assembly 400, which is deployed at each wheel and is responsible for action output.

[0039] First, the braking intention acquisition assembly 100 in this embodiment is specifically embodied as a redundant electronic brake pedal assembly. A non-contact travel sensor array is mounted inside it, which includes a first sensing module 110 and a second sensing module 120 that are completely isolated from each other in physical position and electrical circuit. To prevent sudden damage caused by a single silicon-based chip under extreme thermal stress or lattice defects, both the first sensing module 110 and the second sensing module 120 adopt an automotive-grade ASIL D level Dual-DIE packaging architecture. Specifically, two independent Hall or eddy current sensing dies are arranged in the package of one sensor. This design means that even if the DIE chip on one side fails, the other DIE chip in the same module can still maintain seamless operation. On this basis, each individual sensing module is externally provided with two output pin arrays that are completely electrically isolated, which respectively output one SENT (Single Edge Nibble Transmission) digital protocol signal and one PWM (Pulse Width Modulation) analog duty cycle signal. The four outputs form a rigorous "dual-channel dual-protocol" redundant heterogeneous signal source.

[0040] The power supply system supporting the above sensors adopts an isolation strategy. The vehicle power grid is divided into two independent branches here: the first independent redundant power supply 130 is specifically configured to supply power to the first sensing module 110; the second independent redundant power supply 140 is specifically configured to supply power to the second sensing module 120. These two power supplies are physically cut off and insulated from each other in terms of physical wiring, ground loop (GND) and filter coupling capacitors. Therefore, if a single-circuit short circuit, virtual connection power loss or surge fault occurs in the vehicle power supply network, the fault energy cannot be coupled across circuits, thus ensuring that the braking intention acquisition assembly 100 has high availability under a single electrical fault.

[0041] In the design of the upper-layer control architecture, the upper-layer control assembly 200 includes a first brake control unit 210 and a second brake control unit 220, both of which are internally equipped with microprocessors. The first brake control unit 210 is directly connected to the output pins of the aforementioned first sensing module 110 through a first independent physical link (that is, a hard wiring harness with a dedicated electromagnetic shielding layer), and introduces the collected first travel signal to the underlying ADC and digital decoding input ports of the controller. The second brake control unit 220 also reads the first travel signal synchronously through a parallel wiring harness, so as to implement hot backup of the control logic.

[0042] In establishing the communication interaction channel, the system deploys a redundant communication network 300. A first communication bus 310 and a second communication bus 320 are laid in parallel (in this embodiment, a CAN-FD bus supporting high baud rates is preferred). The two control units within the upper-level control assembly 200, as well as the four actuator control units 410 located at the chassis end, are all designed with dual-channel CAN transceiver nodes, physically connected to the aforementioned first communication bus 310 and second communication bus 320. This topology allows the system to maintain communication between all vehicle nodes even if any single bus experiences strong electromagnetic interference causing bit errors or physical wiring breakage.

[0043] The innovative structure of this invention is reflected in the connection method of the actuator control assembly 400. The actuator control assembly 400 includes a left front actuator control unit 411, a right front actuator control unit 412, a left rear actuator control unit 413, and a right rear actuator control unit 414, all independently integrated within the four wheel EMB calipers. Not only can the upper-level control center issue commands via the network, but these four distributed wheel-side controllers also have their own independent physical signal acquisition terminals. In this embodiment, the second sensing module 120 in the brake intent acquisition assembly 100, via a second physical link, crosses all upper-level devices and is directly connected to the hard-wired acquisition ports of these four actuator control units (411, 412, 413, 414) using physical wiring harnesses. The signal acquisition branches from each actuator control unit to the second sensing module 120 are all independent and equipped with electrical backflow prevention and overcurrent protection modules. When a local wiring harness short circuit occurs, the fault is confined to that single branch and does not affect the other three wheels obtaining signals from the second sensing module 120.

[0044] At the signal processing logic level, both the first braking control unit 210 and the execution control unit 410 have a built-in "dual-channel signal cross-checking mechanism" in their microprocessors (MCUs). Taking the execution control unit 410 processing the second stroke signal as an example, the controller simultaneously reads the SENT digital message and the PWM analog square wave. The MCU's capture and comparison module calculates the PWM duty cycle in real time and converts it into a percentage pedal displacement. At the same time, the SENT decoder unpacks the message, extracts its built-in CRC checksum, and verifies its data load, thereby calculating the corresponding percentage displacement. Then, the controller performs a difference calculation on the two sets of stroke values ​​extracted in a heterogeneous manner. In this embodiment, the consistency tolerance threshold is set to 2% of the total stroke. If the absolute value of the difference is ≤2%, the controller determines that the current intention signal is valid; once the difference is >2%, the controller will raise the internal error flag bit to mark the signal as invalid. The reliability of the instruction is ensured through software-level cross-checking.

[0045] Example 2

[0046] This embodiment focuses on providing a hierarchical fault-tolerant control method based on the system hardware architecture described in Embodiment 1. For example... Figure 2 The control logic flow shown in this method divides the system response into multiple degradation strategies. The specific operation steps are as follows:

[0047] After the system is powered on and woken up, it enters the environmental status perception step. The first braking control unit 210, the second braking control unit 220, and the four distributed actuator control units 410 respectively verify their associated independent sensors. At the same time, the CAN transceiver periodically transmits heartbeat messages to detect the physical integrity of the entire redundant communication network 300.

[0048] In the basic braking execution steps where all components of the system are functioning normally, the validity of the first stroke signal is confirmed via dual-path cross-checking. The first brake control unit 210, acting as the main control unit, begins operating its internal chassis dynamics distribution model. Based on the first stroke signal, it analyzes the driver's desired total vehicle deceleration and, combined with the current slip ratio of the four wheels and the vehicle load transfer state, divides the total braking force into four target braking force parameters. These parameters are simultaneously transmitted to the four execution control units 410 via the first communication bus 310 and the second communication bus 320. During this process, the second brake control unit 220 synchronously captures the first stroke signal and performs redundant calculations using its independent kernel. Only when the second brake control unit 220 finds a significant deviation in the calculation results of the first brake control unit 210, or when the first brake control unit 210 directly crashes, will the second brake control unit 220 take over the bus transmission authority within one control cycle, achieving a seamless switch between primary and secondary control.

[0049] Once the environmental perception mechanism detects a physical break in the first physical link, causing the first stroke signal verification to fail or be lost, the system switches to the first-level degradation control step. In this state, the actuator control unit 410 with hard-wired acquisition capability activates its "information broadcast logic," sending the second stroke signal, which it has read and verified, to the communication bus at a broadcast period of no more than 10ms. The upper-level main brake control unit 210 then acquires the underlying redundant signal in real time, reactivates its dynamic distribution algorithm, completes the target torque calculation, and issues instructions to the four actuator control units again. The delay of the entire switching time is strictly controlled to ≤20 milliseconds, ensuring that the driver will not feel a sudden interruption of braking force when pressing the pedal, thus guaranteeing braking smoothness.

[0050] If the system suffers a common failure due to electrical damage to both the first and second braking control units, or the simultaneous disconnection of the dual CAN buses 310 and 320, it means the system enters the second-level emergency control step without upper-level scheduling. At this time, network communication is interrupted, and the four actuator control units (411, 412, 413, 414) are activated by their internally integrated low-level emergency codes after detecting network timeout errors. They rely entirely on their directly connected second physical links to directly read the backup signal sent by the second sensor module 120. Each actuator control unit independently performs rigorous verification on the second stroke signal it acquires. Once the data is determined to be safe, it immediately consults a "pedal displacement-target braking force" mapping table stored in its local non-volatile memory. This table is a fitted curve calibrated based on preset vehicle parameters to ensure the output of a safe mechanical clamping force while maintaining wheel lock-up. The PI closed-loop servo algorithm embedded in the wheel-side controller quickly mobilizes the power drive axle, driving the motor inside the EMB actuator 420 to rotate and convert it into caliper thrust, thereby ensuring the vehicle's basic braking capability under extreme fault conditions.

[0051] Example 3

[0052] Based on the method in Example 2, this embodiment further provides a chassis domain collaborative control strategy for vehicle body lateral slip caused by the failure of a single network node and a global failure.

[0053] This embodiment introduces a single-point communication loss fault-tolerant step. Assume the communication network of the left front actuator control unit 411 is interrupted. After the upper-level control assembly 200 detects the loss of communication with the left front wheel, the control system performs a branch decision:

[0054] Firstly, if the hardwired network of the left front actuator control unit 411 is not broken, it will automatically enter the autonomous emergency mode in Embodiment 2 to output braking force. Considering that the left front wheel is in an autonomous braking state, the upper control unit dynamically adjusts the target braking force of the right front wheel and the two rear wheels to compensate for the vehicle's yaw tendency due to the uncoordinated braking force of the left front wheel with the other three wheels. This asymmetric distribution suppresses the potential yaw tendency.

[0055] Secondly, if the left front actuator control unit 411 not only loses communication but also fails to output any torque, the upper control assembly 200 activates the "three-wheel backup control strategy". By recalculating the friction limit of the remaining three healthy wheels under the current road conditions, the braking and deceleration demand missing from the left front wheel is proportionally distributed to the right front wheel and the two rear wheels to make up for the overall deceleration of the vehicle.

[0056] Furthermore, when a complete communication failure causes all four wheels to enter distributed autonomous braking (i.e., the second-level emergency control step in Example 2), the independently output braking force of the four wheels may disrupt the vehicle's torque balance. This example involves the vehicle's EPS (Electrical Steering) system. After recognizing a chassis communication timeout, the EPS enters a "yaw suppression coordination state."

[0057] The EPS module acquires high-speed data from the steering wheel angle sensor and wheel speed sensor. Specifically, based on a two-degree-of-freedom vehicle dynamics model, it uses the formula...

[0058]

[0059] Calculate the theoretical yaw rate γ th Where V is the vehicle's current speed, L is the vehicle's wheelbase, and K... G The front wheel angle δ is obtained based on the steering wheel angle signal and the preset steering ratio, using a preset vehicle stability factor. Then, the actual yaw rate transmitted from the inertial measurement unit (IMU) installed at the vehicle's center of gravity is extracted and compared. If the difference between the actual and theoretical yaw rates exceeds a threshold (e.g., a preset 3° / s), it indicates that the independent braking force of the four wheels has caused yaw. At this time, the power assist motor in the EPS system actively applies precise reverse assist torque to help straighten the steering wheel and counteract the yaw torque caused by uneven braking.

[0060] Through the above-mentioned architecture design and control logic, this invention constructs a functional safety system that encompasses structural redundancy, hierarchical fault tolerance, and cross-domain chassis collaboration.

[0061] It will be readily understood by those skilled in the art that the above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, combinations, substitutions, improvements, etc., made under the spirit and principles of the present invention are included within the protection scope of the present invention.

Claims

1. A fully redundant electromechanical braking system, characterized in that, include: A braking intent acquisition assembly, comprising at least a physically isolated first sensing module and a second sensing module, for independently acquiring braking operation stroke and outputting a first stroke signal and a second stroke signal, respectively; The upper-level control assembly includes a first brake control unit, which is directly electrically connected to the first sensing module via a first physical link to obtain the first stroke signal. A redundant communication network, wherein the upper-layer control assembly is connected to the redundant communication network; as well as An actuator control assembly includes multiple actuator control units configured at the wheel ends of the vehicle, all of which are connected to the redundant communication network to receive braking commands from the upper control assembly. All of the aforementioned execution control units are directly electrically connected to the second sensing module via a second physical link independent of the redundant communication network, for synchronously acquiring the second travel signal; When the upper-level control assembly fails or the redundant communication network is in a communication interruption state, the execution end control unit is configured to autonomously output a drive control signal to perform degraded braking control based on the second stroke signal obtained via the second physical link.

2. The fully redundant electromechanical braking system according to claim 1, characterized in that, The upper-level control assembly also includes a second braking control unit. Both the first and second braking control units are connected to the redundant communication network, which includes a first communication bus and a second communication bus in parallel. The first braking control unit serves as the master control unit, and the second braking control unit serves as the redundant monitoring unit, used to take over braking control when a logic failure occurs in the first braking control unit.

3. The fully redundant electromechanical braking system according to claim 1, characterized in that, Both the first sensing module and the second sensing module include a dual-wafer chip redundancy structure. Each sensing module is configured with two independent physically isolated signal output links. Each output link is configured to output a single-sided half-byte transmission protocol signal and a pulse width modulation hard-wire signal in parallel, forming a fully redundant two-way physical signal output architecture.

4. The fully redundant electromechanical braking system according to claim 1, characterized in that, It also includes a power supply system, which includes a first independent redundant power supply and a second independent redundant power supply; the first sensing module is powered by the first independent redundant power supply, the second sensing module is powered by the second independent redundant power supply, and the first independent redundant power supply and the second independent redundant power supply are physically and electrically isolated from each other and have independent common ground loops.

5. The fully redundant electromechanical braking system according to claim 3, characterized in that, Both the upper-level control assembly and the execution-end control unit have embedded dual-channel signal cross-verification logic. The verification logic is configured to decode the travel values ​​corresponding to the two physical signals respectively and compare the consistency of the two travel values. If the deviation of the two travel values ​​is less than or equal to a preset consistency threshold, the current travel signal is determined to be valid.

6. The fully redundant electromechanical braking system according to claim 2, characterized in that, At least one of the execution end control units is configured with information broadcasting logic, which is used to broadcast the second travel signal collected based on the second physical link to the outside via the first communication bus and the second communication bus at a broadcasting frequency not greater than a preset time period, so that the upper-level control assembly can obtain the second travel signal when the first travel signal fails.

7. The fully redundant electromechanical braking system according to claim 1 or 2, characterized in that, The actuator control assembly includes four actuator control units independently located on the left front wheel, right front wheel, left rear wheel, and right rear wheel of the vehicle. Each actuator control unit stores a preset travel-braking force mapping table. In the degraded braking control state, the actuator control unit queries the mapping table to convert the verified second travel signal into the target braking force parameter.

8. The fully redundant electromechanical braking system according to claim 1, characterized in that, It also includes a steering assist system that is connected to the system in communication; when the system is in a communication interruption state and performs degraded braking control, if the steering assist system detects that the difference between the actual yaw rate and the theoretical yaw rate of the vehicle deviates from the normal range, it triggers the yaw suppression cooperative control logic, and the steering assist system is configured to output a reverse assist compensation torque to counteract the vehicle yaw moment.

9. A control method for an electromechanical braking system with full-link redundancy as described in claim 1, characterized in that, This includes the following hierarchical redundancy control steps: Environmental status perception steps: Real-time monitoring of the validity of the first travel signal, the operating status of the upper-level control assembly, and the link connectivity of the redundant communication network; Basic braking execution steps: When the first stroke signal is valid and there are no abnormalities in the upper control assembly and the redundant communication network, the upper control assembly calculates the target braking force distribution strategy for the whole vehicle based on the first stroke signal, and sends it down to each execution control unit through the redundant communication network. First-level degradation control steps: When it is determined that the first stroke signal is faulty, but there is no abnormality between the upper-level control assembly and the redundant communication network, the upper-level control assembly extracts the second stroke signal broadcast by the execution control unit through the redundant communication network, and issues a braking command based on the second stroke signal; The second-level emergency control procedure is as follows: When the upper-level control assembly fails or the redundant communication network breaks down, all the execution-end control units block the response to network commands, directly read the second travel signal through their own second physical link, and independently generate drive commands to execute emergency backup braking.

10. The control method according to claim 9, characterized in that, When the upper-level control assembly includes a second braking control unit, and the first braking control unit acts as the master control unit, in the basic braking execution step, the second braking control unit performs control calculations synchronously, and its calculation results are periodically compared with the calculation results of the first braking control unit; if the comparison deviation exceeds the tolerance range, the second braking control unit deprives the first braking control unit of its master control authority within a control cycle, and then sends braking commands to the execution end control unit.

11. The control method according to claim 9, characterized in that, In the first-level degraded control step, the transition response time of the system from the basic braking execution step to the first-level degraded control step is configured to be no more than 20 milliseconds, so as to achieve a smooth transition in the issuance of braking torque command.

12. The control method according to claim 9, characterized in that, The second-level emergency control steps specifically include: Each of the aforementioned execution end control units performs independent data verification on the second stroke signal it acquires; Once the verification is successful, the execution control unit uses the second stroke signal as input to query the braking force mapping table stored in its non-volatile memory to obtain the target braking mechanical thrust value of the corresponding wheel. The internal closed-loop control algorithm drives the braking actuator corresponding to the actuator control unit to reach the target braking mechanical thrust value.

13. The control method according to claim 9, characterized in that, It also includes single-point communication loss fault tolerance steps: When the upper-level control assembly detects a communication failure with the actuator control unit of a single target wheel, while the communication links of the other three wheels are normal: If it is determined that the actuator control unit of the target wheel can still output basic braking force based on the second physical link, the upper control assembly dynamically adjusts the target braking force distribution ratio of the other three wheels according to the basic braking force, so as to maintain the braking balance of the whole vehicle and trigger the vehicle yaw correction logic.

14. The control method according to claim 13, characterized in that, In the single-point communication loss fault-tolerant step, if it is determined that the actuator control unit of the target wheel has lost its braking output capability, the upper control assembly immediately triggers the three-wheel backup control strategy. Based on the total braking force required by the vehicle, it is redistributed and superimposed on the other three normal actuator control units to make up for the vehicle deceleration.

15. The control method according to claim 9, characterized in that, In the second-level emergency control step, when each actuator control unit is in an information silo state, distributed steady-state control is implemented in conjunction with the steering assist system, specifically including: The steering assist system collects steering wheel angle signals and vehicle speed signals in real time. Based on a two-degree-of-freedom vehicle dynamics model, using the formula δ calculates the theoretical yaw rate γ th Where V is the vehicle speed, L is the vehicle wheelbase, and K G As a stability factor, the front wheel angle δ is obtained based on the steering wheel angle signal and the preset steering transmission ratio; when the absolute difference between the actual yaw rate obtained by the actual sensor and the theoretical yaw rate is greater than the threshold, the steering assist system applies an active return torque.

Images