Vehicle redundant braking control method and system, electronic device, and vehicle

Abstract

A vehicle redundant braking control method, applied to the technical field of autonomous driving. The method comprises: when a vehicle is in a redundant standby state, acquiring the state of an autonomous driving primary actuator, the state of an automatic parking primary actuator, the state of an autonomous driving backup actuator, and the state of an automatic parking backup actuator of the vehicle; on the basis of the state of the autonomous driving primary actuator, the state of the automatic parking primary actuator, the state of the autonomous driving backup actuator, and the state of the automatic parking backup actuator, controlling the vehicle to enter a redundant braking state from the redundant standby state; and when the vehicle is in the redundant braking state, acquiring a brake signal of the vehicle, determining a target braking force of the vehicle on the basis of the priority of the brake signal, and performing redundant braking on the vehicle on the basis of the target braking force. The vehicle redundant braking control method realizes redundant braking control under L3 autonomous driving working conditions, significantly increasing the response speed of redundant braking, achieving a better redundant braking effect, and improving the safety of autonomous driving. Also provided are a system realizing the vehicle redundant braking control method, an electronic device, and a vehicle.

Description

Vehicle redundant braking control method, system, electronic device and vehicle Technical Field

[0001] The present invention relates to the field of autonomous driving technology, and in particular to a vehicle redundant braking control method, system, electronic equipment, and vehicle. Background Art

[0002] In L3 autonomous driving scenarios, the reliability of the braking system is particularly important. To improve vehicle safety in emergency situations, relevant technologies propose the application of redundant braking technology to autonomous driving systems. Redundant braking technology aims to switch to a backup actuator when the vehicle's main actuator fails to ensure normal driving or parking of the vehicle. However, although existing autonomous driving systems have a certain degree of redundant braking design, in the process of switching to the backup actuator when the main actuator fails, switching delays may occur due to operations such as fault detection and activation of the backup actuator, which may lead to serious consequences in high-speed driving or emergency braking.

[0003] Summary of the Invention

[0004] The purpose of the present invention is to solve one of the technical problems existing in the prior art to at least a certain extent.

[0005] To this end, an object of the present invention is to provide a vehicle redundant braking control method, system, electronic device and vehicle.

[0006] In order to achieve the above technical objectives, the technical solutions adopted by the embodiments of the present invention include:

[0007] In one aspect, an embodiment of the present invention provides a vehicle redundant braking control method, comprising the following steps:

[0008] When the vehicle is in a redundant standby state, obtaining states of an automatic driving main actuator, an automatic parking main actuator, an automatic driving backup actuator, and an automatic parking backup actuator of the vehicle;

[0009] controlling the vehicle to enter a redundant braking state from the redundant standby state according to the states of the automatic driving main actuator, the automatic parking main actuator, the automatic driving backup actuator, and the automatic parking backup actuator;

[0010] When the vehicle is in the redundant braking state, a braking signal of the vehicle is acquired, a target braking force of the vehicle is determined according to a priority of the braking signal, and redundant braking is performed on the vehicle based on the target braking force.

[0011] In another aspect, an embodiment of the present invention provides a vehicle redundant brake control system, comprising a redundant brake controller, an automatic driving main actuator, an automatic parking main actuator, an automatic driving backup actuator, and an automatic parking backup actuator;

[0012] Wherein, the redundant brake controller includes:

[0013] an acquisition module, configured to acquire the states of the automatic driving main actuator, the automatic parking main actuator, the automatic driving backup actuator, and the automatic parking backup actuator of the vehicle when the vehicle is in a redundant standby state;

[0014] a state processing module, configured to control the vehicle to enter a redundant braking state from the redundant standby state according to states of the automatic driving main actuator, the automatic parking main actuator, the automatic driving backup actuator, and the automatic parking backup actuator;

[0015] A redundant braking control module is used to obtain a braking signal of the vehicle when the vehicle is in the redundant braking state, determine a target braking force of the vehicle according to a priority of the braking signal, and perform redundant braking on the vehicle based on the target braking force.

[0016] On the other hand, an embodiment of the present invention provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the aforementioned vehicle redundant braking control method when executing the computer program.

[0017] In yet another aspect, an embodiment of the present invention provides a vehicle, comprising the aforementioned vehicle redundant braking control system or the aforementioned electronic device.

[0018] The beneficial effects of the present invention are as follows: providing a vehicle redundant braking control method, system, electronic device, and vehicle, wherein first, when the vehicle is in a redundant standby state, the states of the vehicle's automatic driving main actuator, automatic parking main actuator, automatic driving backup actuator, and automatic parking backup actuator are obtained; then, based on the states of the automatic driving main actuator, automatic parking main actuator, automatic driving backup actuator, and automatic parking backup actuator, the vehicle is controlled to enter a redundant braking state from the redundant standby state; when the vehicle is in the redundant braking state, the vehicle's brake signal is obtained, the target braking force of the vehicle is determined based on the priority of the brake signal, and the vehicle is redundantly braked based on the target braking force. This application, by monitoring the states of the vehicle's automatic driving main actuator, automatic parking main actuator, automatic driving backup actuator, and automatic parking backup actuator, can quickly and seamlessly switch to the backup actuator when a main actuator fails, thereby achieving redundant braking control under L3 autonomous driving conditions, significantly improving the response speed of redundant braking, and achieving a better redundant braking effect, thereby improving the safety of autonomous driving. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] FIG1 is a flow chart of a vehicle redundant braking control method provided by the present invention;

[0020] FIG2 is a schematic diagram of a redundant braking control system for a vehicle according to the present invention;

[0021] FIG3 is a schematic diagram of a vehicle state switching method according to the present invention;

[0022] FIG4 is a flow chart of a first trigger condition provided by the present invention;

[0023] FIG5 is another flow chart of a vehicle redundant braking control method provided by the present invention;

[0024] FIG6 is a flow chart of a second trigger condition provided by the present invention;

[0025] FIG7 is another flow chart of a vehicle redundant braking control method provided by the present invention;

[0026] FIG8 is a flow chart of a third trigger condition provided by the present invention;

[0027] FIG9 is another flow chart of a vehicle redundant braking control method provided by the present invention;

[0028] 10 is a flowchart of redundant braking control in a redundant braking state provided by the present invention;

[0029] FIG11 is a structural diagram of a vehicle redundant braking control system provided by the present invention;

[0030] FIG12 is a structural diagram of an electronic device provided by the present invention. DETAILED DESCRIPTION

[0031] First, the nouns and terms involved in the present invention are explained:

[0032] L3 autonomous driving: conditional autonomous driving. Under normal circumstances, the autonomous driving system will complete all driving operations and surrounding environment monitoring within the operational scenario ODD (Operational Design Domain), and the driver can be freed from the driving task; when the vehicle has a systemic failure or an event occurs that exceeds the vehicle's operating range, the driver needs to accept the takeover instructions given by the autonomous driving system and take over the vehicle.

[0033] IBC: Integrated Brake Control, which refers to the automatic driving master actuator and the automatic parking master actuator in this invention;

[0034] RBU: Redundant Brake Unit, redundant brake backup function. The redundant brake backup function of the vehicle in the present invention is achieved by activating the automatic driving backup actuator or the automatic parking backup actuator;

[0035] ABS: Antilock Brake System, anti-lock braking system;

[0036] VLC: Vehicle Longitudinal Control, vehicle longitudinal control, usually implemented using Adaptive Cruise Control (ACC);

[0037] APC: Automatic Paking Control, vehicle automatic parking control;

[0038] HAL: Hardware Abstraction Layer, which refers to the vehicle's hydraulic control model in this invention. The hydraulic control model represents the integrated model of the vehicle's solenoid valves and motors, and is used to adjust the pressure of the vehicle's tires.

[0039] RBU Standby: Redundant Brake Unit Standby, redundant standby state, that is, the vehicle's redundant brake backup function is available but not activated. When the vehicle is in redundant standby state, the automatic driving backup actuator and the automatic parking backup actuator are both inactive;

[0040] RBU Takeover: Redundant Brake Unit Takeover, redundant braking state, that is, the vehicle's redundant braking backup function is available and activated. When the vehicle is in the redundant braking state, the automatic driving backup actuator and the automatic parking backup actuator are both activated;

[0041] RBU Not Available: Redundant Brake Unit Not Available, redundancy disabled state, that is, the vehicle's redundant brake backup function module is unavailable. When the vehicle is in the redundancy disabled state, the automatic driving backup actuator and the automatic parking backup actuator are both disabled;

[0042] KL15: The power cable that supplies power to the positive terminal of the vehicle's battery, usually refers to the vehicle's standby power supply.

[0043] The present invention will be further explained and illustrated below with reference to the accompanying drawings and specific embodiments.

[0044] In response to the problems and defects existing in the related technologies, embodiments of the present invention provide a vehicle redundant braking control method, system, electronic device and vehicle, with the aim of enabling rapid and seamless switching to a backup actuator when a main actuator fails under L3 autonomous driving conditions, thereby improving the response speed of redundant braking.

[0045] First, the implementation steps of a vehicle redundant braking control method provided by an embodiment of the present invention will be described in detail below with reference to the accompanying drawings.

[0046] A vehicle redundant braking control method provided by an embodiment of the present invention can be applied to a terminal, a server, or software running on a terminal or server. A terminal can be, but is not limited to, a tablet computer, a laptop computer, or a desktop computer. A server can be a standalone physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content distribution networks, and big data and artificial intelligence platforms. Furthermore, a server can be, but is not limited to, a node server in a blockchain network. Blockchain is a novel application model for computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms.

[0047] 1 , a vehicle redundant braking control method provided by an embodiment of the present invention may include but is not limited to the following steps S100 - S300 .

[0048] S100 , when the vehicle is in a redundant standby state, obtaining states of the vehicle's automatic driving main actuator, automatic parking main actuator, automatic driving backup actuator, and automatic parking backup actuator.

[0049] It should be noted that the states of the automatic driving backup executor and the automatic parking backup executor include any one of an inactivated state, an activated state or a disabled state; the states of the automatic driving main executor and the automatic parking main executor include any one of a fault state or a non-fault state.

[0050] In this step, under L3 autonomous driving conditions, the vehicle is assumed to be in a redundant standby state. This state indicates that the vehicle's redundant brake backup function is available but inactive. In this state, both the automatic driving backup actuator and the automatic parking backup actuator are inactive. While in this state, signals indicating the current status of the vehicle's automatic driving primary actuator, automatic parking primary actuator, automatic driving backup actuator, and automatic parking backup actuator are obtained to determine whether the vehicle's primary actuator has failed and, therefore, whether the vehicle's redundant brake backup function requires activation.

[0051] It is understood that L3 autonomous driving conditions generally include parking conditions or driving conditions. Specifically, when the vehicle's VLC function is activated, the vehicle is in driving conditions; when the vehicle's APC function is activated, the vehicle is in parking conditions.

[0052] S200 , controlling the vehicle to enter a redundant braking state from a redundant standby state according to the states of the automatic driving main actuator, the automatic parking main actuator, the automatic driving backup actuator, and the automatic parking backup actuator.

[0053] It should be noted that the redundant braking state of the vehicle is used to indicate that the redundant braking backup function of the vehicle is available and activated.

[0054] In this step, after obtaining the status of the automatic driving master actuator, automatic parking master actuator, automatic driving backup actuator, and automatic parking backup actuator, a determination is made as to whether the vehicle's automatic driving master actuator and automatic parking master actuator have failed based on the status of the automatic driving master actuator and automatic parking master actuator. If the vehicle's automatic driving master actuator and automatic parking master actuator are determined to have failed, the vehicle is controlled to enter a redundant braking state from a redundant standby state. In this redundant braking state, both the automatic driving backup actuator and the automatic parking backup actuator are activated, enabling the vehicle's redundant braking backup function.

[0055] It can be understood that the redundant brake backup function under parking conditions is realized by activating the automatic parking backup actuator, while the redundant brake backup function under driving conditions is realized by activating the automatic driving backup actuator.

[0056] S300, when the vehicle is in a redundant braking state, obtaining a braking signal of the vehicle, determining a target braking force of the vehicle according to a priority of the braking signal, and performing redundant braking on the vehicle based on the target braking force.

[0057] In this step, after activating the vehicle's redundant braking backup function, the vehicle will perform redundant braking. Specifically, the current vehicle braking signal is first acquired. The vehicle's braking signal may include but is not limited to the vehicle's longitudinal force control interface signal, brake pedal interface signal, and degraded anti-lock braking interface signal. Then, the vehicle's braking signals are prioritized and the target braking force is output. Finally, the vehicle's braking control is performed based on the target braking force obtained through arbitration, thereby achieving redundant braking.

[0058] The following illustrates the process of implementing redundant braking according to an embodiment of the present invention, with reference to the accompanying drawings. Referring to Figure 2, under L3 autonomous driving conditions, the vehicle's functional signals are first acquired. These functional signals primarily include the status of the automatic driving primary actuator with redundant braking, the automatic parking primary actuator, the automatic driving backup actuator, and the automatic parking backup actuator, as well as the status of the VLC and APC functions. L3 autonomous driving conditions primarily include parking and driving conditions. When the VLC function is activated, the vehicle is in the driving condition, while when the APC function is activated, the vehicle is in the parking condition. Then, based on the status signals from the primary and backup actuators, it is determined whether the primary actuator has failed, thereby determining whether the redundant braking backup function should be enabled. Simultaneously, the vehicle's operating condition is identified based on the status of the VLC and APC functions, primarily including parking and driving conditions. If it is determined that the vehicle meets the activation conditions for the redundant braking backup function, the automatic driving backup actuator and the automatic parking backup actuator are activated to enable the vehicle's redundant braking backup function, causing the vehicle to enter the redundant braking state for the corresponding operating condition. After the vehicle enters the redundant braking state under the corresponding operating conditions, it determines whether it has received at least one of the following: a brake pedal interface signal, an ABS interface signal, or a longitudinal force control interface signal from the upper-level intelligent driving controller. It then prioritizes these received interface signals to determine a target braking force, which is the target wheel cylinder pressure for the vehicle's tires. Based on this target braking force, the HAL module controls the vehicle's tires to adjust and control tire pressure, thereby achieving redundant braking.

[0059] In some embodiments of the present invention, in step S200, the implementation process of controlling the vehicle from the redundant standby state to the redundant braking state according to the states of the automatic driving main actuator, the automatic parking main actuator, the automatic driving backup actuator and the automatic parking backup actuator may include but is not limited to the following step S210.

[0060] S210, when the automatic driving backup executor and the automatic parking backup executor are both in the inactive state and the vehicle meets the start-up conditions of the redundant braking backup function, the vehicle is controlled to enter the redundant braking state from the redundant standby state, and the states of the automatic driving backup executor and the automatic parking backup executor are updated to the active state, and information is output to indicate that the redundant braking backup function of the vehicle is fault-free.

[0061] Specifically, embodiments of the present invention utilize an RBU takeover trigger strategy to control a vehicle's transition from a redundant standby state to a redundant braking state. Referring to Figure 3 and Table 1, which illustrates the state logic of the backup actuator and the primary actuator, the RBU takeover trigger strategy comprises a first precondition, a first trigger condition, and a first output. The first precondition represents a necessary condition for the RBU takeover trigger strategy; only when the first precondition is met can the vehicle be determined to have met the first trigger condition. The first trigger condition represents the activation condition for the redundant braking backup function described above. When the vehicle meets the first trigger condition, the vehicle's redundant braking backup function is enabled and the corresponding output is executed.

[0062] Table 1

[0063] More specifically, the first precondition mainly includes that the redundant brake backup function is available but not activated, that is, the automatic driving backup actuator and the automatic parking backup actuator are both in an inactive state.

[0064] Optionally, the first precondition can be defined as "the automatic parking backup actuator is in an inactive state && the automatic driving backup actuator is in an inactive state". Among them, "&&" is the AND logical operator. For "A&&B", when A is true, it is judged whether B is true, and when A is false, the judgment is ended directly; when B is true, the corresponding output is executed, and when B is false, the judgment is ended. Therefore, it should be noted that when the automatic parking backup actuator is not in an inactive state, the vehicle is deemed to not meet the first precondition. At this time, the judgment is ended directly, and whether the automatic driving backup actuator is in an inactive state will not be judged. This improves the judgment efficiency of the first precondition and reduces the amount of data calculation, thereby improving the response speed of redundant braking.

[0065] The first trigger condition mainly includes any one of the following sub-conditions (1.1)-(1.3):

[0066] (1.1) The automatic driving master actuator or the automatic parking master actuator loses communication, but other nodes communicate normally;

[0067] (1.2) When both the automatic driving master actuator and the automatic parking master actuator are not disconnected from communication, the automatic parking master actuator is in a fault state, that is, the automatic parking master actuator is in a fault state when sub-condition (1.1) is not satisfied;

[0068] (1.3) When both the automatic driving master actuator and the automatic parking master actuator are not disconnected from communication and the automatic parking master actuator is in a non-fault state, the automatic driving master actuator is in a fault state, that is, the automatic driving master actuator is in a fault state when sub-condition (1.2) is not satisfied.

[0069] For the above sub-condition (1.1), provided that the first precondition is met, when the vehicle is in a parking condition and it is detected that the vehicle's automatic parking master actuator is disconnected from communication but other nodes are communicating normally, it indicates that normal data interaction with the automatic parking master actuator is impossible. At this time, it is determined that the vehicle meets the activation conditions of the redundant braking backup function, and the vehicle is controlled from the redundant standby state to the redundant braking state to enable the vehicle's redundant braking backup function.

[0070] Similarly, under the premise of meeting the first prerequisite, when the vehicle is in a driving condition and it is detected that the vehicle's automatic driving main actuator is disconnected from communication but other nodes are communicating normally, it means that normal data interaction with the automatic driving main actuator is impossible. At this time, it is determined that the vehicle meets the start-up conditions of the redundant braking backup function, and the vehicle is controlled from the redundant standby state to the redundant braking state to enable the vehicle's redundant braking backup function.

[0071] With respect to the above sub-condition (1.2), provided that the first precondition is satisfied and the above sub-condition (1.1) is not satisfied, if a fault message or fault signal is received from the automatic parking master actuator, indicating that the automatic parking master actuator is in a faulty state, the vehicle is determined to have met the activation conditions for the redundant brake backup function, and the vehicle is controlled from the redundant standby state to the redundant braking state to activate the vehicle's redundant brake backup function.

[0072] Optionally, as shown in Table 1, the fault information of the automatic parking main actuator may be "IBCRBU_StopMain2BackupState=0x0~2, not available". Those skilled in the art will appreciate that other signals or information for representing a fault of the automatic parking main actuator are also applicable, and this embodiment of the present invention does not specifically limit this.

[0073] With respect to the above sub-condition (1.3), provided that the first precondition is satisfied and the above sub-condition (1.2) is not satisfied, if a fault message or fault signal from the automatic driving master actuator is received, indicating that the automatic driving master actuator is in a faulty state, the vehicle is determined to have satisfied the activation conditions for the redundant brake backup function, and the vehicle is controlled from the redundant standby state to the redundant braking state to activate the vehicle's redundant brake backup function.

[0074] Optionally, as shown in Table 1, the fault information of the automatic driving main actuator may be "IBCRBU_DriveMain2Back upState=0x0~2, not available". Those skilled in the art will appreciate that other signals or information used to characterize the fault of the automatic driving main actuator are also applicable, and the embodiment of the present invention does not specifically limit this.

[0075] In short, the first trigger condition can be defined as "the automatic driving master actuator or the automatic parking master actuator loses communication || the automatic driving master actuator is in a faulty state || the automatic driving master actuator is in a faulty state." The "||" symbol represents a logical OR. For "A||B||C," when A is true, the output is executed; when A is false, a check is made to see if B is true, and if so, an output is executed; when B is false, a check is made to see if C is true, and if so, an output is executed; and when C is false, the check ends.

[0076] Based on this, referring to Figure 4 , when the vehicle's automatic driving master actuator or automatic parking master actuator loses communication, the vehicle is deemed to have met the first trigger condition, and the first output portion is executed directly. When both the automatic driving master actuator and the automatic parking master actuator are still communicating, a determination is made as to whether the vehicle's automatic parking master actuator is in a faulty state. If so, the vehicle is deemed to have met the first trigger condition, and the first output portion is executed directly. If not, the first output portion is not executed, and the vehicle remains in the current redundant standby state, with the determination looping. This improves the efficiency of determining the first trigger condition, thereby increasing the response speed of redundant braking and reducing the amount of data computation required for redundant braking.

[0077] The first output section primarily includes internal output and external output. The internal output primarily controls the vehicle's transition from redundant standby to redundant braking. The external output simultaneously outputs the following three pieces of information: information indicating the vehicle's redundant braking backup function is functioning properly, information indicating the automatic driving backup actuator is active, and information indicating the automatic parking backup actuator is active.

[0078] It should be noted that the external part may be an in-vehicle application such as an instrument application, or other terminals or devices such as an in-vehicle display, a central control system, etc., and the embodiment of the present invention does not specifically limit this.

[0079] It can be understood that the information indicating that the automatic driving backup executor is in the activated state and the information indicating that the automatic parking backup executor is in the activated state are equivalent to updating the states of the automatic driving backup executor and the automatic parking backup executor to the activated state.

[0080] Optionally, the information used to indicate that the redundant braking backup function of the vehicle is fault-free may be "RBRDC_ErrorStatus==0x0:NoError". Those skilled in the art will appreciate that other information used to characterize that the redundant braking backup function is fault-free is also applicable, and the embodiment of the present invention does not specifically limit this.

[0081] Optionally, as shown in Table 1, the information used to indicate that the automatic driving backup executor is in an activated state may be "RB UIBC_DriveBackup2MainState==0x8:Activated_FullAvailable". Those skilled in the art will appreciate that other information used to indicate that the automatic driving backup executor is in an activated state is also applicable, and the embodiments of the present invention do not specifically limit this.

[0082] Alternatively, as shown in Table 1, the information indicating that the automatic parking backup executor is in an activated state may be "RB UIBC_StopBackup2MainState==0x8:Activated_FullAvailable". Those skilled in the art will appreciate that other information indicating that the automatic parking backup executor is in an activated state may also be applicable, and this embodiment of the present invention does not specifically limit this.

[0083] In an embodiment of the present invention, when a vehicle is in a redundant standby state, it is determined whether the vehicle satisfies the first precondition, i.e., whether both the vehicle's automatic driving backup actuator and the automatic parking backup actuator are in an inactive state. When the vehicle satisfies the first precondition, it indicates that the vehicle's redundant braking backup function can be enabled. At this time, it is determined whether the vehicle satisfies the subcondition (1.1), i.e., whether the vehicle's automatic driving main actuator or the automatic parking main actuator is disconnected from communication but other nodes are still communicating normally. If so, the first output portion is executed. If not, it is determined whether the vehicle satisfies the subcondition (1.2), i.e., whether the vehicle's automatic driving main actuator is faulty. If so, the first output portion is executed. If not, it is determined whether the vehicle satisfies the subcondition (1.3), i.e., whether the vehicle's automatic parking main actuator is faulty. If so, the first output portion is executed, thereby enabling the vehicle's redundant braking backup function and causing the vehicle to enter the redundant braking state from the redundant standby state. If not, the first output portion is not executed, and the judgment cycle is repeated until the vehicle satisfies the first trigger condition.

[0084] In some embodiments of the present invention, the redundant braking state includes either an automatic driving takeover state or a driver takeover state; in step S200, the process of controlling the vehicle to enter the redundant braking state from the redundant standby state may include but is not limited to the following steps:

[0085] According to the preset takeover strategy, the vehicle is controlled from the redundant standby state to the automatic driving takeover state or the driver takeover state.

[0086] Optionally, the takeover strategy may be set according to actual conditions, and is not specifically limited in this embodiment of the present invention.

[0087] For example, when the vehicle's redundant braking backup function is functioning normally, the redundant braking state the vehicle enters is an automatic driving takeover state, and the driver does not need to take over the driving of the vehicle; when the vehicle's redundant braking backup function fails, the redundant braking state the vehicle enters is a driver takeover state, and the driver takes over the driving of the vehicle.

[0088] In some embodiments of the present invention, referring to FIG. 5 , a vehicle redundant braking control method provided by an embodiment of the present invention may further include but is not limited to the following steps A1-A2.

[0089] A1, when the vehicle is in a redundant braking state, obtain the states of the automatic driving main actuator, the automatic parking main actuator, the automatic driving backup actuator, and the automatic parking backup actuator, and obtain the state of the vehicle's redundant braking function task.

[0090] It should be noted that the redundant braking function task status includes either a completed state or an uncompleted state. It should be understood that the specific content of the redundant braking function task can be configured based on actual circumstances and is not specifically limited in this embodiment of the present invention. However, it should be noted that the redundant braking function task should be related to the redundant braking backup function.

[0091] For example, in Level 3 automated driving conditions, the vehicle's primary actuator operates while a redundant braking function task is initiated. This redundant braking function task monitors the status of the primary actuator. During this redundant braking function task, the vehicle's backup actuator is available but inactive. If it detects a failure or loss of communication with the primary actuator, the backup actuator switches to operation. When the Level 3 automated driving condition ends, the redundant braking function task terminates.

[0092] In this step, under L3 autonomous driving conditions, when the vehicle's primary actuator fails, the vehicle's backup actuator is activated, and the vehicle enters a redundant braking state. In this redundant braking state, both the automatic driving backup actuator and the automatic parking backup actuator are active. While in this redundant braking state, signals such as the current status of the vehicle's automatic driving primary actuator, automatic parking primary actuator, automatic driving backup actuator, and automatic parking backup actuator are obtained. Simultaneously, the current status of the vehicle's redundant braking task is obtained to determine whether the vehicle needs to terminate the redundant braking backup function.

[0093] A2: When both the automatic driving backup actuator and the automatic parking backup actuator are in the activated state and the vehicle meets the standby conditions of the redundant braking backup function, the vehicle is controlled to return from the redundant braking state to the redundant standby state, and the states of the automatic driving backup actuator and the automatic parking backup actuator are updated to the inactivated state, and information indicating that the vehicle has returned to the redundant standby state is output.

[0094] Specifically, embodiments of the present invention utilize a function exit-to-standby strategy to control a vehicle's return from a redundant braking state to a redundant standby state. Referring again to Figure 3 and Table 1, the function exit-to-standby strategy comprises a second precondition, a second trigger condition, and a second output. The second precondition represents a necessary condition for the function exit-to-standby strategy; only when the second precondition is met can the vehicle be determined to have met the second trigger condition. The second trigger condition represents the standby condition for the redundant brake backup function described above. When the second trigger condition is met, the redundant brake backup function terminates and the corresponding output is executed.

[0095] More specifically, the second precondition mainly includes: the redundant brake backup function is available and activated, that is, the automatic driving backup actuator and the automatic parking backup actuator are both in an activated state.

[0096] The second trigger condition mainly includes the following sub-conditions (2.1)-(2.3):

[0097] (2.1) The main actuator of the automatic driving is in a non-fault state;

[0098] (2.2) The automatic parking master actuator is in a non-faulty state;

[0099] (2.3) The redundant braking function task is in the end state.

[0100] In short, the second trigger condition can be defined as "the automatic driving main actuator is in a normal state && the automatic parking main actuator is in a normal state && the redundant braking function task is in a terminated state." Here, "&&" is the logical AND operator. For "A&&B&&C," if A is false, the judgment ends immediately. If A is true, the judgment is made on whether B is true. If B is true, the judgment is made on whether C is true. If B is false, the judgment ends. If C is true, the corresponding output is executed. If C is false, the judgment ends.

[0101] It can be understood that, as shown in Figure 6, under the premise that the second precondition is met, the vehicle is sequentially determined to determine whether it meets subconditions (2.1), (2.2), and (2.3). When the vehicle simultaneously meets subconditions (2.1), (2.2), and (2.3), the vehicle is deemed to have met the second trigger condition, and the vehicle is controlled to return from the redundant braking state to the redundant standby state, thereby terminating the vehicle's redundant braking backup function. Specifically, when information or a signal indicating that the automatic driving master actuator is not faulty is received, it indicates that the vehicle's automatic driving master actuator is available, and the vehicle is deemed to have met subcondition (2.1); when information or a signal indicating that the automatic parking master actuator is not faulty is received, it indicates that the vehicle's automatic parking master actuator is available, and the vehicle is deemed to have met subcondition (2.2); when information or a signal indicating that the redundant braking function task has ended is received, it indicates that the redundant braking function task has ended, and the vehicle is deemed to have met subcondition (2.3). If the vehicle does not meet sub-condition (2.1), it is considered that the vehicle does not meet the second trigger condition. In this case, the second output portion is not executed and the judgment ends. Sub-condition (2.2) and sub-condition (2.3) are not judged to be true, thereby improving the judgment efficiency of the second trigger condition and reducing the data calculation volume of redundant braking control. Optionally, when the vehicle does not meet sub-condition (2.1), a loop judgment is performed, that is, returning to judging whether the vehicle meets the second pre-condition until the vehicle meets the second trigger condition.

[0102] Optionally, as shown in Table 1, the information used to indicate that the automatic driving main actuator is not faulty may be "IBCRBU_DriveMain2BackupState!=0x0~2, not available". Those skilled in the art will appreciate that other information used to indicate that the automatic driving main actuator is not faulty is also applicable, and the embodiment of the present invention does not specifically limit this.

[0103] Alternatively, as shown in Table 1, the information used to indicate that the automatic parking main actuator is not faulty may be "IBCRBU_StopMain2BackupState!=0x0~2, not available." Those skilled in the art will appreciate that other information used to indicate that the automatic parking main actuator is not faulty may also be applicable, and this embodiment of the present invention does not specifically limit this.

[0104] The second output section mainly includes internal output and external output. The internal output mainly controls the vehicle's return from the redundant braking state to the redundant standby state. The external output is to simultaneously output the following three pieces of information to the outside world: information indicating that the vehicle has returned to the redundant standby state, information indicating that the automatic driving backup actuator is inactive, and information indicating that the automatic parking backup execution processor is inactive.

[0105] It should be noted that the external part may be an in-vehicle application such as an instrument application, or other terminals or devices such as an in-vehicle display, a central control system, etc., and the embodiment of the present invention does not specifically limit this.

[0106] It can be understood that the information indicating that the automatic driving backup executor is in an inactive state and the information indicating that the automatic parking backup execution processor is in an inactive state are equivalent to updating that both the automatic driving backup executor and the automatic parking backup executor are in an inactive state.

[0107] Optionally, as shown in Table 1, the information used to indicate that the automatic driving backup executor is in an inactivated state may be "RBUIBC_DriveBackup2MainState==0x3, not activated full available". Those skilled in the art will understand that other information used to indicate that the automatic driving backup executor is in an inactivated state is also applicable, and the embodiments of the present invention do not specifically limit this.

[0108] Optionally, as shown in Table 1, the information used to indicate that the automatic parking backup execution processor is in an inactivated state may be "RBUIBC_StopBackup2MainState==0x3, not activated full available". Those skilled in the art will appreciate that other information used to indicate that the automatic parking backup execution processor is in an inactivated state is also applicable, and the embodiments of the present invention do not specifically limit this.

[0109] In an embodiment of the present invention, when the vehicle is in a redundant braking state, a determination is made as to whether the vehicle satisfies the second precondition, namely, whether both the vehicle's automatic driving backup actuator and the automatic parking backup actuator are in an activated state. When the vehicle satisfies the second precondition, indicating that the vehicle's redundant braking backup function is functioning normally, the vehicle then sequentially determines whether it satisfies subconditions (2.1), (2.2), and (2.3), namely, whether the automatic driving main actuator is in a non-faulty state, whether the automatic parking main actuator is in a non-faulty state, and whether the redundant braking function task is in a terminated state. If the vehicle satisfies subconditions (2.1), (2.2), and (2.3) simultaneously, the vehicle's redundant braking backup function is terminated and the second output portion is executed, causing the vehicle to return from the redundant braking state to the redundant standby state. When the vehicle does not meet sub-condition (2.1), it is directly deemed that the vehicle does not meet the second trigger condition. At this time, the second output part is not executed and the judgment ends. No judgment is made on whether sub-condition (2.2) and sub-condition (2.3) are true. This improves the response speed of terminating the redundant brake backup function and reduces the data load of the redundant brake control.

[0110] In some embodiments of the present invention, referring to FIG. 7 , a vehicle redundant braking control method provided by an embodiment of the present invention may further include but is not limited to the following steps B1 - B2 .

[0111] B1, when the vehicle is in a redundant braking state, obtaining the state of the vehicle's ignition switch and detecting the vehicle's redundant braking program.

[0112] It should be noted that the redundant braking program refers to the program run by the relevant controller or relevant actuator of the vehicle after the redundant braking backup function is enabled in the vehicle.

[0113] In this step, under L3 autonomous driving conditions, if the vehicle's primary actuator fails, the vehicle's backup actuator is activated, and the vehicle enters a redundant braking state. In this redundant braking state, both the automatic driving backup actuator and the automatic parking backup actuator are active. While in this redundant braking state, the vehicle obtains signals such as the current ignition switch status and simultaneously monitors the vehicle's redundant braking program to determine whether the vehicle's redundant braking backup function is malfunctioning.

[0114] B2: When the ignition switch is on and the vehicle meets the disabling conditions of the redundant braking backup function, the vehicle is controlled to switch from the redundant braking state to the redundant disabled state, and the states of the automatic driving backup actuator and the automatic parking backup actuator are updated to the disabled state, and information is output to characterize the failure of the vehicle's redundant braking backup function.

[0115] Specifically, embodiments of the present invention utilize a function exit-to-disable strategy to control the vehicle's transition from a redundant braking state to a redundant disabled state. Referring again to FIG3 and Table 1, the function exit-to-disable strategy comprises a third precondition, a third trigger condition, and a third output. The third precondition represents a necessary condition for the function exit-to-disable strategy; only when the third precondition is met can the vehicle be determined to have met the third trigger condition. The third trigger condition represents the aforementioned disabling condition for the redundant brake backup function. When the third trigger condition is met, the vehicle's redundant brake backup function is disabled and the corresponding output is executed.

[0116] More specifically, the third precondition mainly includes: the ignition switch is in the on state, that is, information or a signal indicating that the ignition switch is on is received.

[0117] Optionally, the information used to indicate that the ignition switch is on may be "KL15==on". Those skilled in the art will appreciate that other information or signals used to indicate that the ignition switch is on are also applicable, and this embodiment of the present invention does not specifically limit this.

[0118] The third trigger condition mainly includes any one of the following sub-conditions (3.1)-(3.2):

[0119] (3.1) It is detected that there is a valve pump degradation failure point in the current cycle of the redundant braking program;

[0120] (3.2) When there is no valve pump degradation failure point in the current cycle of the redundant braking program, it is detected that the storage area reads the valve pump degradation failure point of the current cycle recorded by the redundant braking program, that is, when sub-condition (3.1) is not met, it is detected that the storage area reads the valve pump degradation failure point of the current cycle recorded by the redundant braking program.

[0121] In short, the third trigger condition can be defined as "detection of a valve and pump degradation failure point in the current cycle of the redundant braking program || detection of a valve and pump degradation failure point in the current cycle recorded in the redundant braking program read from the storage area." "||" is a logical OR operator. For "A||B," if A is true, the output is executed; if A is false, the determination of whether B is true is made, and if B is true, the output is executed.

[0122] As shown in Figure 8, when a valve pump degradation fault point is detected in the current cycle of the redundant braking program, the vehicle is deemed to have met the third trigger condition and the third output portion is directly executed. If no valve pump degradation fault point is detected in the current cycle of the redundant braking program, a determination is made as to whether the valve pump degradation fault point for the current cycle, as recorded in the redundant braking program, has been read from the storage area. If so, the vehicle is deemed to have met the third trigger condition and the third output portion is executed. If not, the third output portion is not executed, the vehicle maintains the current redundant braking state, and the determination cycle continues. This improves the efficiency of determining the third trigger condition, thereby increasing the redundant braking control's response speed to valve pump degradation faults while reducing the amount of data computation required for redundant braking control.

[0123] The third output section mainly includes internal output and external output. The internal output mainly controls the vehicle's switching from the redundant braking state to the redundant disabled state. The external output is to simultaneously output the following three pieces of information to the outside world: information indicating a failure in the vehicle's redundant braking backup function, information indicating that the automatic driving backup actuator is disabled, and information indicating that the automatic parking backup actuator is disabled.

[0124] It should be noted that the external part may be an in-vehicle application such as an instrument application, or other terminals or devices such as an in-vehicle display, a central control system, etc., and the embodiment of the present invention does not specifically limit this.

[0125] It can be understood that the information indicating that the automatic driving backup executor is in a disabled state and the information indicating that the automatic parking backup executor is in a disabled state are equivalent to updating the states of the automatic driving backup executor and the automatic parking backup executor to be disabled states.

[0126] Optionally, as shown in Table 1, the information used to characterize that the automatic driving backup executor is in a disabled state may be "RBUIBC_DriveBackup2MainState==0x0~0x2". Those skilled in the art will appreciate that other information used to characterize that the automatic driving backup executor is in a disabled state is also applicable, and the embodiments of the present invention do not specifically limit this.

[0127] Alternatively, as shown in Table 1, the information used to characterize that the automatic parking backup executor is in a disabled state may be "RBUIBC_StopBackup2MainState==0x0~0x2". Those skilled in the art will appreciate that other information used to characterize that the automatic parking backup executor is in a disabled state is also applicable, and the embodiments of the present invention do not specifically limit this.

[0128] In this embodiment of the present invention, when a vehicle is in a redundant standby state, a determination is made as to whether the vehicle satisfies the third precondition, namely, whether the vehicle's ignition switch is on. If the vehicle satisfies the third precondition, indicating that the vehicle is operating, a determination is then made as to whether the vehicle satisfies subcondition (3.1), namely, whether a valve pump degradation failure has occurred in the current cycle of the vehicle's RBU. If so, this indicates a failure in the vehicle's redundant brake backup function, and the third output portion is executed. If not, a determination is made as to whether the vehicle satisfies subcondition (3.2), namely, whether the valve pump degradation failure point recorded in the current cycle has been read from the storage area. If so, this indicates a failure in the vehicle's redundant brake backup function, and the third output portion is executed, thereby disabling the redundant brake backup function and causing the vehicle to switch from the redundant brake state to the redundant disabled state. It is understood that when the vehicle enters the redundant disabled state, the driver takes over driving control of the vehicle. If the vehicle does not satisfy subcondition (3.2), it is deemed that the vehicle does not satisfy the third trigger condition, and the determination is repeated repeatedly until the vehicle satisfies the third trigger condition.

[0129] In some embodiments of the present invention, referring to FIG. 3 , in step B2 , the implementation process of controlling the vehicle to transition from the redundant braking state to the redundant disabled state may include but is not limited to the following steps B21 - B22 .

[0130] B21, controls the vehicle to return from the redundant braking state to the redundant standby state;

[0131] B22, after the vehicle enters the redundant standby state, control the vehicle to switch from the redundant standby state to the redundant disabled state.

[0132] In the above steps, the redundant standby state and the redundant braking state can switch between each other. That is, the redundant standby state can be directly switched to the redundant braking state, and the redundant braking state can be directly switched to the redundant standby state. However, it should be noted that the redundant braking state and the redundant disabled state cannot be switched directly. To switch from the redundant braking state to the redundant disabled state, you must first return from the redundant braking state to the redundant standby state, and then enter the redundant disabled state from the redundant standby state. Similarly, to switch from the redundant disabled state to the redundant braking state, you must first return from the redundant disabled state to the redundant standby state, and then enter the redundant braking state from the redundant standby state.

[0133] In some embodiments of the present invention, referring to FIG. 9 , a vehicle redundant braking control method provided by an embodiment of the present invention may further include but is not limited to the following steps C1 - C2 .

[0134] C1 : When the vehicle is in the redundancy disabled state, the states of the ignition switch, the automatic driving backup actuator, and the automatic parking backup actuator are obtained.

[0135] In this step, when the vehicle's automatic driving backup actuator and automatic parking backup actuator fail, the vehicle enters a redundantly disabled state. In this redundantly disabled state, both the automatic driving backup actuator and the automatic parking backup actuator are disabled. While in this redundantly disabled state, signals such as the current status of the vehicle's ignition switch, automatic driving backup actuator, and automatic parking backup actuator are obtained to determine whether the vehicle can restore its redundant braking backup function.

[0136] C2, when the ignition switch is on and the vehicle meets the recovery conditions of the redundant brake backup function, controls the vehicle to enter the redundant standby state from the redundant disabled state, and at the same time updates the status of the automatic driving backup actuator and the automatic parking backup actuator to the inactive state, and outputs information used to indicate that the vehicle has returned to the redundant standby state.

[0137] Specifically, embodiments of the present invention utilize a disable-to-standby strategy to control the vehicle's return from a redundant disable state to a redundant standby state. Referring again to Figure 3 and Table 1, the disable-to-standby strategy includes a fourth precondition, a fourth trigger condition, and a fourth output. The fourth precondition characterizes the necessary conditions for the disable-to-standby strategy; only when the fourth precondition is met can the vehicle be determined to have met the fourth trigger condition. The fourth trigger condition represents the aforementioned condition for restoring the redundant brake backup function. When the fourth trigger condition is met, the vehicle's redundant brake backup function is restored and the corresponding output is executed.

[0138] More specifically, the fourth precondition mainly includes: the ignition switch is in the on state, that is, information or a signal indicating that the ignition switch is on is received.

[0139] Optionally, the information used to indicate that the ignition switch is on may be "KL15==on". Those skilled in the art will appreciate that other information or signals used to indicate that the ignition switch is on are also applicable, and this embodiment of the present invention does not specifically limit this.

[0140] The fourth trigger condition mainly includes the following sub-conditions (4.1):

[0141] (4.1) The vehicle’s backup actuator is fault-free, i.e., both the vehicle’s automatic driving backup actuator and automatic parking backup actuator are fault-free.

[0142] It can be understood that, under the premise of meeting the fourth precondition, when the vehicle meets the above sub-condition (4.1), it means that the vehicle's redundant brake backup function has been cleared of the fault, and the vehicle will be controlled from the redundant disabled state to the redundant standby state to restore the vehicle's redundant brake backup function.

[0143] The fourth output section mainly includes internal output and external output. The internal output mainly controls the vehicle from the redundant disabled state to the redundant standby state. The external output refers to the simultaneous output of the following three pieces of information to the outside: information indicating that the vehicle has returned to the redundant standby state, information indicating that the automatic driving backup actuator is inactive, and information indicating that the automatic parking backup execution processor is inactive.

[0144] It should be noted that the external part may be an in-vehicle application such as an instrument application, or other terminals or devices such as an in-vehicle display, a central control system, etc., and the embodiment of the present invention does not specifically limit this.

[0145] It can be understood that the information indicating that the automatic driving backup executor is in an inactive state and the information indicating that the automatic parking backup execution processor is in an inactive state are equivalent to updating that both the automatic driving backup executor and the automatic parking backup executor are in an inactive state.

[0146] Optionally, as shown in Table 1, the information used to indicate that the automatic driving backup executor is in an inactivated state may be "RB UIBC_DriveBackup2MainState==0x3, not activated full available". Those skilled in the art will appreciate that other information used to indicate that the automatic driving backup executor is in an inactivated state is also applicable, and the embodiments of the present invention do not specifically limit this.

[0147] Optionally, as shown in Table 1, the information used to indicate that the automatic parking backup execution processor is in an inactivated state may be "RBUIBC_StopBackup2MainState==0x3, not activated full available". Those skilled in the art will appreciate that other information used to indicate that the automatic parking backup execution processor is in an inactivated state is also applicable, and the embodiments of the present invention do not specifically limit this.

[0148] In this embodiment of the present invention, when the vehicle is in the redundancy disabled state, a determination is made as to whether the vehicle satisfies the fourth precondition, namely, whether the vehicle's ignition switch is on. If the vehicle satisfies the fourth precondition, indicating that the vehicle is operating, a determination is then made as to whether the vehicle satisfies subcondition (4.1), namely, whether the vehicle's backup actuator is fault-free. If the vehicle satisfies subcondition (4.1), indicating that the fault in the vehicle's redundant brake backup function has been resolved, the redundant brake backup function is restored, and the fourth output portion is executed, thereby returning the vehicle from the redundancy disabled state to the redundant standby state.

[0149] In some embodiments of the present invention, the method may further include the following step D1.

[0150] D1, when a system failure is detected, controls the vehicle to enter the redundant disabled state from the redundant standby state or the redundant braking state.

[0151] It should be noted that the vehicle system failure includes at least one of the following:

[0152] (1) Failure of the vehicle's brake electronic control system;

[0153] (2) The vehicle's pressure sensor fails;

[0154] (3) The vehicle's braking system fails to assist;

[0155] (4) The solenoid valve of the vehicle's HAL module fails;

[0156] (5) The power supply voltage of the vehicle's electronic control unit (ECU) is higher than a first threshold, or the power supply voltage of the vehicle's electronic control unit is lower than a second threshold;

[0157] (6) Failure of any hardware component of the vehicle’s computer control module.

[0158] It should be noted that, within the current braking event, the above faults are not recoverable. Among them, the system faults at points (2) to (4) are all internal faults. Optionally, for the fault at point (2), it can be determined by specific information, which can be "BrakePedalApply_Valid = Invalid." It will be understood by those skilled in the art that the specific information can also be other information, and the embodiments of the present invention do not specifically limit this.

[0159] Optionally, both the first threshold and the second threshold may be set according to actual conditions, and this embodiment of the present invention does not specifically limit this.

[0160] It should be understood that, in addition to the system failures described in points (1) to (6) above, in other embodiments of the present invention, other types of system failures may be configured based on customer needs or actual conditions, and the embodiments of the present invention do not specifically limit this.

[0161] In some embodiments of the present invention, referring to FIG. 10 , in step S300 , the process of obtaining the braking signal of the vehicle mainly includes the following step S310 .

[0162] S310 , obtaining at least one of a longitudinal force control interface signal, a brake pedal interface signal, or a degraded anti-lock braking interface signal of the vehicle as a braking signal of the vehicle.

[0163] In this step, when the upper-level intelligent driving controller sends a driving deceleration request or a parking deceleration request, the vehicle's longitudinal force control interface signal is obtained; when the driver steps on the brake pedal, it indicates that the driver has a braking intention, and the vehicle's brake pedal interface signal is obtained; when the vehicle triggers ABS control, the vehicle's degraded anti-lock braking interface signal is obtained.

[0164] It should be understood that in addition to the vehicle's longitudinal force control interface signal, brake pedal interface signal or degraded anti-lock braking interface signal, there are other signals such as steering wheel angle, steering wheel angle velocity, driving speed, etc. that can be used as the vehicle's braking signal, and the embodiments of the present invention do not specifically limit this.

[0165] In some embodiments of the present invention, referring to FIG. 10 , in step S300 , the process of determining the target braking force of the vehicle according to the priority of the braking signal mainly includes the following step S320 .

[0166] S320: When there are at least two braking signals of the vehicle, determine, according to the priorities of the at least two braking signals, a braking force corresponding to the braking signal with the highest priority as a target braking force of the vehicle.

[0167] In this step, when the number of the vehicle's braking signals is greater than or equal to 2, priority arbitration is performed on all the braking signals according to the priority of each braking signal, and the braking force corresponding to the braking signal with the highest priority is selected as the target braking force of the vehicle.

[0168] It should be noted that priority arbitration means that the stability control function takes precedence over non-stability control functions. For example, the ABS control pressure target takes precedence over the autonomous driving pressure target. Based on this, the brake pedal interface signal may optionally have the highest priority, the longitudinal force control interface signal the second highest priority, and the degraded anti-lock braking interface signal the lowest priority. However, it should be understood that in other embodiments of the present invention, the priority of each interface signal may be set based on actual circumstances, and this is not specifically limited in this embodiment of the present invention.

[0169] In some embodiments of the present invention, referring to FIG. 10 , in step S300 , the process of implementing redundant braking of the vehicle based on the target braking force may include but is not limited to the following steps S330 - S340 .

[0170] S330 , based on the target braking force, calculate a target rotational speed of a motor of a hydraulic control module of the vehicle and a target opening and closing time of a solenoid valve.

[0171] It should be noted that the target braking force is the target braking force of the four tires of the vehicle, that is, the braking force of the four tires of the vehicle is the same.

[0172] In this step, after determining the target braking force of the vehicle, the target speed of the motor of the HAL module and the target opening and closing time of the solenoid valve are calculated based on the braking force of the vehicle's four tires. The calculation method can be implemented using existing flow formulas, which will not be further described in this embodiment of the present invention.

[0173] S340 , according to the target speed and the target opening and closing time, simultaneously pressurize or depressurize all tires of the vehicle to perform redundant braking on the vehicle.

[0174] Traditional ABS control independently regulates the pressure of the vehicle's four tires. However, this step differs from traditional ABS control in that it simultaneously increases or decreases the pressure of the vehicle's four tires based on the motor's target speed and the target opening and closing time of the solenoid valve. This can reduce the number of solenoid valves in the vehicle's HAL model, thereby reducing costs.

[0175] 2 and 3 again, an example will be used below to illustrate the switching principle between the RBU takeover triggering strategy, the function exit to standby strategy, the function exit to disable strategy, and the disable to standby strategy, as well as the redundant braking principle of an embodiment of the present invention.

[0176] 1) Enable the vehicle's redundant brake backup function, that is, the vehicle enters the redundant braking state from the redundant standby state:

[0177] Under L3 autonomous driving conditions, the vehicle is in redundant standby state by default, and obtains signals such as the status of the automatic driving main actuator with redundant braking, the automatic parking main actuator, the automatic driving backup actuator and the automatic parking backup actuator, the status of the VLC function and the APC function.

[0178] Based on these signals, it is determined whether the vehicle meets the first precondition, that is, whether the vehicle's automatic driving backup actuator and automatic parking backup actuator are both in an inactive state. When the vehicle meets the first precondition, it indicates that the vehicle's redundant brake backup function can be activated. At this time, it is determined whether the vehicle meets the sub-condition (1.1), that is, whether the vehicle's automatic driving main actuator or automatic parking main actuator is disconnected from communication but other nodes are still communicating normally. If so, the first output part is executed; if not, it is determined whether the vehicle meets the sub-condition (1.2), that is, whether the vehicle's automatic driving main actuator is faulty. If so, the first output part is executed; if not, it is determined whether the vehicle meets the sub-condition (1.3), that is, whether the vehicle's automatic parking main actuator is faulty. If so, the first output part is executed, thereby achieving the purpose of activating the vehicle's redundant brake backup function, allowing the vehicle to enter the redundant braking state from the redundant standby state; if not, the first output part is not executed and the judgment is repeated until the vehicle meets the first trigger condition.

[0179] When the vehicle is in the redundant braking state, redundant braking begins. When the upper-level intelligent driving controller sends a driving deceleration request or a parking deceleration request, the vehicle's longitudinal force control interface signal is obtained. When the driver presses the brake pedal, indicating braking intent, the vehicle's brake pedal interface signal is obtained. When the vehicle triggers ABS control, the vehicle's downgraded anti-lock braking interface signal is obtained. After receiving the interface signal, if the number of braking signals is greater than or equal to two, all braking signals are prioritized and the braking force corresponding to the highest-priority braking signal is selected as the target braking force. The HAL module then calculates the target motor speed and target solenoid valve opening and closing times based on the braking forces of the vehicle's four tires. Based on this information, the vehicle's four tires are simultaneously pressurized or depressurized, achieving redundant braking.

[0180] 2) End the vehicle's redundant braking backup function, that is, the vehicle returns from the redundant braking state to the redundant standby state:

[0181] When the vehicle is in a redundant braking state, signals such as the status of the vehicle's automatic driving main actuator, automatic parking main actuator, automatic driving backup actuator and automatic parking backup actuator at the current moment are obtained, and the status of the vehicle's redundant braking function task at the current moment is also obtained to determine whether the vehicle needs to end the redundant braking backup function.

[0182] Based on these data, a determination is made as to whether the vehicle satisfies the second precondition, namely, whether both the vehicle's automatic driving backup actuator and the automatic parking backup actuator are in an activated state. If the vehicle satisfies the second precondition, indicating that the vehicle's redundant braking backup function is functioning normally, the vehicle then sequentially determines whether it satisfies subconditions (2.1), (2.2), and (2.3), namely, whether the vehicle's automatic driving main actuator is in a non-faulty state, whether the automatic parking main actuator is in a non-faulty state, and whether the vehicle's redundant braking function task is in a terminated state. If the vehicle satisfies subconditions (2.1), (2.2), and (2.3) simultaneously, the vehicle's redundant braking backup function is terminated and the second output portion is executed, causing the vehicle to return from the redundant braking state to the redundant standby state. If the vehicle does not meet sub-condition (2.1), it is directly deemed that the vehicle does not meet the second trigger condition, and the judgment ends at this time without judging whether sub-condition (2.2) and sub-condition (2.3) are true. This improves the response speed of terminating the redundant brake backup function and reduces the data load of the redundant brake control.

[0183] 3) Disable the vehicle's redundant brake backup function. This disablement is divided into two situations: one is a valve pump degradation failure during redundant braking, and the other is a system failure is detected during redundant braking or redundant standby.

[0184] For the first case, when the vehicle is in a redundant braking state, signals such as the status of the vehicle's ignition switch at the current moment are obtained, and information such as the reading status of the vehicle's redundant braking program at the current moment is also obtained to determine whether the vehicle's redundant braking backup function is abnormal.

[0185] Based on this data, a determination is made as to whether the vehicle satisfies the third precondition, namely, whether the vehicle's ignition switch is on. If the vehicle satisfies the third precondition, indicating that the vehicle is operating, a determination is made as to whether the vehicle satisfies subcondition (3.1), namely, whether a valve pump degradation failure has occurred in the current cycle of the vehicle's RBU. If so, this indicates a failure in the vehicle's redundant brake backup function, and the third output portion is executed. If not, a determination is made as to whether the vehicle satisfies subcondition (3.2), namely, whether the valve pump degradation failure point recorded in the current cycle has been read from the storage area. If so, this indicates a failure in the vehicle's redundant brake backup function, and the third output portion is executed, disabling the redundant brake backup function and causing the vehicle to switch from a redundant braking state to a redundantly disabled state. If the vehicle does not satisfy subcondition (3.2), it is deemed that the vehicle does not satisfy the third trigger condition. The third output portion is not executed, and the determination is repeated repeatedly until the vehicle satisfies the third trigger condition.

[0186] It will be appreciated that when the vehicle enters the redundancy disabled state, the driving operation of the vehicle is taken over by the driver.

[0187] It should be noted that the Redundant Braking State and the Redundant Disabled State cannot be switched directly. If you need to switch from the Redundant Braking State to the Redundant Disabled State, you must first return from the Redundant Braking State to the Redundant Standby State, and then return from the Redundant Standby State to the Redundant Disabled State.

[0188] For the second case, when the vehicle is in a redundant braking state or a redundant standby state, when a system failure is detected, the vehicle is controlled to enter a redundant disabled state from the redundant standby state or the redundant braking state. The system failure of the vehicle includes at least one of the following: a failure of the vehicle's brake electronic control product system; a failure of the vehicle's pressure sensor; a failure of the vehicle's brake system booster; a failure of the solenoid valve of the vehicle's HAL module; (5) the power supply voltage of the vehicle's ECU is higher than a first threshold, or the power supply voltage of the vehicle's computer control module is lower than a second threshold; or a failure of any hardware component of the vehicle's ECU.

[0189] 4) Restore the vehicle's redundant brake backup function, that is, the vehicle enters the redundant standby state from the redundant disabled state:

[0190] When the vehicle is in a redundancy disabled state, signals such as the status of the vehicle's ignition switch, automatic driving backup actuator, and automatic parking backup actuator at the current moment are obtained to determine whether the vehicle can restore the redundant braking backup function.

[0191] Based on these data, a determination is made as to whether the vehicle satisfies the fourth precondition, namely, whether the vehicle's ignition switch is on. If the vehicle satisfies the fourth precondition, indicating that the vehicle is operating, a determination is then made as to whether the vehicle satisfies subcondition (4.1), namely, whether the vehicle's backup actuator is fault-free. If the vehicle satisfies subcondition (4.1), indicating that the redundant brake backup function of the vehicle has been rectified, the redundant brake backup function is restored and the fourth output portion is executed, thereby returning the vehicle from the redundant disabled state to the redundant standby state.

[0192] Next, an implementation of a vehicle redundant braking control system provided by an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

[0193] 11 , the system mainly includes a redundant brake controller, an automatic driving main actuator, an automatic parking main actuator, an automatic driving backup actuator, and an automatic parking backup actuator, wherein the redundant brake controller mainly includes:

[0194] an acquisition module 101 for acquiring the states of the vehicle's automatic driving primary actuator, automatic parking primary actuator, automatic driving backup actuator, and automatic parking backup actuator when the vehicle is in a redundant standby state;

[0195] a state processing module 102 for controlling the vehicle to enter a redundant braking state from a redundant standby state according to the states of the automatic driving main actuator, the automatic parking main actuator, the automatic driving backup actuator, and the automatic parking backup actuator;

[0196] The redundant braking control module 103 is used to obtain the vehicle's braking signal when the vehicle is in a redundant braking state, determine the vehicle's target braking force according to the priority of the braking signal, and perform redundant braking on the vehicle based on the target braking force.

[0197] Furthermore, the redundant brake control module 103 mainly performs at least one of the following:

[0198] The longitudinal force control interface module is used to obtain the longitudinal force control interface signal of the vehicle.

[0199] In this module, when the upper-level intelligent driving controller sends a driving deceleration request or a parking deceleration request, the vehicle's longitudinal force control interface signal is obtained.

[0200] The driver intention recognition module is used to obtain the vehicle's brake pedal interface signal.

[0201] In this module, when the driver steps on the brake pedal, it indicates that the driver has a braking intention and obtains the vehicle's brake pedal interface signal.

[0202] The ABS control module is used to obtain the vehicle's degraded anti-lock braking interface signal.

[0203] In this module, when the vehicle triggers ABS control, the vehicle's downgraded anti-lock braking interface signal is obtained.

[0204] Furthermore, the redundant brake control module 103 further includes:

[0205] The longitudinal force arbitration module is used to determine, when there are at least two braking signals of the vehicle, the braking force corresponding to the braking signal with the highest priority as the target braking force of the vehicle according to the priorities of the at least two braking signals.

[0206] In this module, when the number of vehicle braking signals is greater than or equal to 2, priority arbitration is performed on all braking signals according to the priority of each braking signal, and the braking force corresponding to the braking signal with the highest priority is selected as the target braking force of the vehicle.

[0207] The hydraulic control module is used to calculate the target speed of the motor of the vehicle's hydraulic control module and the target opening and closing time of the solenoid valve based on the target braking force, and to simultaneously increase or decrease the pressure on all tires of the vehicle according to the target speed and target opening and closing time to perform redundant braking on the vehicle.

[0208] In this module, the target speed of the HAL module's motor and the target opening and closing time of the solenoid valve are calculated based on the braking force of the vehicle's four tires. Then, based on the target speed of the motor and the target opening and closing time of the solenoid valve, the four tires of the vehicle are pressurized or depressurized simultaneously. This can reduce the number of solenoid valves in the vehicle's HAL model, thereby reducing costs.

[0209] The contents of the above method embodiments are all applicable to the present system embodiments. The functions specifically implemented by the present system embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0210] Furthermore, an embodiment of the present invention provides an electronic device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the aforementioned vehicle redundant braking control method. The electronic device can be any intelligent terminal, including a tablet computer and an in-vehicle computer.

[0211] 12 , which illustrates a hardware structure of an electronic device according to another embodiment, the electronic device includes:

[0212] The processor 201 may be implemented as a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application.

[0213] The memory 202 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 202 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program codes are stored in the memory 202 and are called by the processor 201 to execute a vehicle redundant braking control method according to the embodiments of this application.

[0214] Input / output interface 203, used to implement information input and output;

[0215] Communication interface 204, used to implement communication interaction between this device and other devices, which can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WiFi, Bluetooth, etc.);

[0216] bus 205 , which transmits information between the various components of the device (e.g., processor 301 , memory 202 , input / output interface 203 , and communication interface 204 );

[0217] The processor 201 , the memory 202 , the input / output interface 203 and the communication interface 204 are connected to each other in communication within the device via the bus 205 .

[0218] Similarly, the contents of the above method embodiments are applicable to the present device embodiments. The functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0219] Finally, an embodiment of the present invention further provides a vehicle, comprising the aforementioned vehicle redundant braking control system or the aforementioned electronic device.

[0220] Similarly, the contents of the above method embodiments are applicable to the present vehicle embodiment. The functions specifically implemented by the present vehicle embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0221] It is understandable that the vehicle can be a private car, such as a sedan, a Sport Utility Vehicle (SUV), a Multi-Purpose Vehicle (MPV) or a pickup truck, etc., or an operating vehicle, such as a van, a bus, a small truck or a large trailer, etc., or a gasoline vehicle or a new energy vehicle such as a hybrid or pure electric vehicle.

[0222] In summary, embodiments of the present invention provide a vehicle redundant braking control method, system, electronic device, and vehicle. On the one hand, by configuring state transition conditions for the redundant braking backup function, such as activation, standby, disabling, and recovery, and combining them with the states of the vehicle's automatic driving primary actuator, automatic parking primary actuator, automatic driving backup actuator, and automatic parking backup actuator, the present invention controls the activation, standby, disabling, and recovery of the vehicle's redundant braking backup function. This enables redundant braking control under Level 3 autonomous driving conditions. This system enables rapid and seamless switching to the backup actuator in the event of a primary actuator failure, significantly improving the response speed of redundant braking and achieving superior redundant braking effectiveness, thereby enhancing autonomous driving safety. Furthermore, unlike traditional ABS control, during redundant braking, the present invention simultaneously increases or decreases pressure on all four tires based on the motor's target speed and the target opening and closing times of the solenoid valves, achieving RBU-degraded ABS control. This reduces the number of solenoid valves in the vehicle's HAL model, thereby reducing costs.

[0223] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to the embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the claims and their equivalents.

[0224] The above is a specific description of the preferred implementation of the present invention, but the present invention is not limited to the embodiments. Those skilled in the art can make various equivalent modifications or substitutions without violating the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of the present invention.

Claims

1. A vehicle redundant braking control method, characterized in that: The steps include: When the vehicle is in a redundant standby state, obtaining states of an automatic driving main actuator, an automatic parking main actuator, an automatic driving backup actuator, and an automatic parking backup actuator of the vehicle; controlling the vehicle to enter a redundant braking state from the redundant standby state according to the states of the automatic driving main actuator, the automatic parking main actuator, the automatic driving backup actuator, and the automatic parking backup actuator; When the vehicle is in the redundant braking state, a braking signal of the vehicle is acquired, a target braking force of the vehicle is determined according to a priority of the braking signal, and redundant braking is performed on the vehicle based on the target braking force.

2. A vehicle redundant braking control method according to claim 1, characterized in that: The controlling the vehicle to enter the redundant braking state from the redundant standby state according to the states of the automatic driving main actuator, the automatic parking main actuator, the automatic driving backup actuator, and the automatic parking backup actuator includes: When both the automatic driving backup executor and the automatic parking backup executor are in an inactive state and the vehicle meets the activation conditions of the redundant braking backup function, controlling the vehicle to enter the redundant braking state from the redundant standby state, simultaneously updating the states of the automatic driving backup executor and the automatic parking backup executor to an active state, and outputting information indicating that the redundant braking backup function of the vehicle is fault-free; Among them, the activation conditions of the redundant braking backup function include any one of the following: the automatic driving master actuator or the automatic parking master actuator is disconnected from communication, the automatic parking master actuator is in a fault state when both the automatic driving master actuator and the automatic parking master actuator are not disconnected from communication, or the automatic driving master actuator is in a fault state when both the automatic driving master actuator and the automatic parking master actuator are not disconnected from communication and the automatic parking master actuator is in a non-fault state.

3. The vehicle redundant braking control method according to claim 1, characterized in that: The redundant braking state includes any one of an automatic driving takeover state and a driver takeover state; and controlling the vehicle to enter the redundant braking state from the redundant standby state includes: According to a preset takeover strategy, the vehicle is controlled to enter the automatic driving takeover state or the driver takeover state from the redundant standby state.

4. The vehicle redundant braking control method according to claim 1, characterized in that: The method further comprises the steps of: When the vehicle is in the redundant braking state, obtaining the states of the automatic driving main actuator, the automatic parking main actuator, the automatic driving backup actuator, and the automatic parking backup actuator, and obtaining the state of the redundant braking function task of the vehicle; When the automatic driving backup executor and the automatic parking backup executor are in an activated state and the vehicle satisfies When the redundant braking backup function reaches a standby condition, controlling the vehicle to return from the redundant braking state to the redundant standby state, simultaneously updating the states of the automatic driving backup actuator and the automatic parking backup actuator to inactive states, and outputting information indicating that the vehicle has returned to the redundant standby state; The standby condition of the redundant braking backup function includes: the redundant braking function task is in a terminated state and both the automatic driving master actuator and the automatic parking master actuator are in a non-faulty state.

5. The vehicle redundant braking control method according to claim 1, characterized in that: The method further comprises the steps of: When the vehicle is in the redundant braking state, obtaining a state of an ignition switch of the vehicle and detecting a redundant braking program of the vehicle; When the ignition switch is in the on state and the vehicle meets the disabling condition of the redundant brake backup function, controlling the vehicle to switch from the redundant brake state to the redundant disabled state, simultaneously updating the states of the automatic driving backup actuator and the automatic parking backup actuator to the disabled state, and outputting information indicating a fault in the redundant brake backup function of the vehicle; Among them, the disabling conditions of the redundant braking backup function include: detecting that there is a valve pump degradation failure point in the current cycle of the redundant braking program, or detecting that the storage area reads the valve pump degradation failure point of the current cycle recorded by the redundant braking program when it is detected that there is no valve pump degradation failure point in the current cycle of the redundant braking program.

6. A vehicle redundant braking control method according to claim 5, characterized in that: The controlling the vehicle to transition from the redundant braking state to a redundant disabled state includes: controlling the vehicle to return from the redundant braking state to the redundant standby state; After the vehicle enters the redundant standby state, the vehicle is controlled to transition from the redundant standby state to the redundant disabled state.

7. The vehicle redundant braking control method according to claim 5, characterized in that: The method further comprises the steps of: When the vehicle is in the redundancy disabled state, obtaining states of the ignition switch, the automatic driving backup actuator, and the automatic parking backup actuator; When the ignition switch is in the on state and the vehicle meets the restoration conditions of the redundant brake backup function, controlling the vehicle to enter the redundant standby state from the redundant disabled state, simultaneously updating the states of the automatic driving backup actuator and the automatic parking backup actuator to inactive states, and outputting information indicating that the vehicle has returned to the redundant standby state; The restoration condition of the redundant braking backup function includes: both the automatic driving backup executor and the automatic parking backup executor are free of faults.

8. The vehicle redundant braking control method according to claim 1, characterized in that: The method further comprises the steps of: When a system failure of the vehicle is detected, controlling the vehicle to enter a redundant disabled state from the redundant standby state or the redundant braking state; Among them, the system failure includes at least one of the following: failure of the vehicle's brake electronic control product system; failure of the vehicle's pressure sensor; failure of the vehicle's brake system booster; failure of the solenoid valve of the vehicle's hydraulic control module; the power supply voltage of the vehicle's computer control module is higher than the first threshold or the power supply voltage of the vehicle's computer control module is lower than the second threshold; failure of any hardware component of the vehicle's computer control module.

9. The vehicle redundant braking control method according to claim 1, characterized in that: The obtaining of the braking signal of the vehicle includes: At least one of a longitudinal force control interface signal, a brake pedal interface signal, or a degraded anti-lock braking interface signal of the vehicle is acquired as a braking signal of the vehicle.

10. The vehicle redundant braking control method according to claim 9, characterized in that: Determining the target braking force of the vehicle according to the priority of the braking signal includes: When there are at least two braking signals for the vehicle, the braking force corresponding to the braking signal with the highest priority is determined as the target braking force for the vehicle according to the priorities of the at least two braking signals.

11. The vehicle redundant braking control method according to claim 1, characterized in that: The redundant braking of the vehicle based on the target braking force includes: Calculating a target speed of a motor and a target opening and closing time of a solenoid valve of a hydraulic control module of the vehicle based on the target braking force; According to the target rotation speed and the target opening and closing time, pressure is simultaneously increased or decreased on all tires of the vehicle to perform redundant braking on the vehicle.

12. A vehicle redundant braking control system, characterized in that: Includes redundant brake controllers, automatic driving master actuator, automatic parking master actuator, automatic driving backup actuator and automatic parking backup actuator; Wherein, the redundant brake controller includes: an acquisition module, configured to acquire the states of the automatic driving main actuator, the automatic parking main actuator, the automatic driving backup actuator, and the automatic parking backup actuator of the vehicle when the vehicle is in a redundant standby state; a state processing module, configured to control the vehicle to enter a redundant braking state from the redundant standby state according to states of the automatic driving main actuator, the automatic parking main actuator, the automatic driving backup actuator, and the automatic parking backup actuator; A redundant braking control module is configured to obtain the braking information of the vehicle when the vehicle is in the redundant braking state. signal, determining a target braking force of the vehicle according to the priority of the braking signal, and performing redundant braking on the vehicle based on the target braking force.

13. An electronic device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, a vehicle redundant braking control method according to any one of claims 1 to 11 is implemented.

14. A vehicle, characterized in that: It includes a vehicle redundant braking control system as claimed in claim 12 or an electronic device as claimed in claim 13.

Images