EMB control system having safety redundancy, control method for EMB control system having safety redundancy, and vehicle

Abstract

The present application discloses an EMB control system having safety redundancy, a control method for the EMB control system having safety redundancy, and a vehicle. The control system comprises a central control unit (CCU) and a wheel-end control unit (WCU). The CCU is configured to receive a superordinate computer request signal; the CCU processes the request signal to output a corresponding clamping force instruction to the WCU; and the WCU is configured to control a drive motor to output a braking force. The CCU comprises a primary control system and a secondary control system; the primary control system and the secondary control system operate in an active / standby configuration; and when a fault or failure has occurred in either the primary control system or the secondary control system, the other system takes over and starts operating.

Description

Redundant and safe EMB control system, control method of redundant and safe EMB control system and vehicle

[0001] This disclosure claims priority to Chinese Patent Application No. 202510373062.5, filed on March 27, 2025, entitled "A Redundant and Safe EMB Control System and Method", the entire contents of which are incorporated herein by reference. Technical Field

[0002] This application relates to the field of automotive braking systems, and in particular to a redundant and safe EMB control system, a control method for the redundant and safe EMB control system, and a vehicle. Background Technology

[0003] Currently, all braking systems are EHB (Electronic Hydraulic Brake) systems, with no mass-produced EMB (Electro Mechanical Brake) systems available. Because the EMB system eliminates brake fluid and hydraulic components, the braking torque is generated entirely by motor-driven actuators mounted on the four wheel ends. This eliminates the need for solenoid valves, master cylinders, hydraulic lines, and other structural elements, significantly simplifying the braking system and resulting in more efficient and accurate braking performance. Since braking control is achieved using four motors, the control strategy of the EMB system is crucial.

[0004] In related technologies, the design of EMB systems can generally be divided into two parts: one part considers the protection and control of the motor drive, and the other part considers the control of the EMB system itself. Traditional EMB systems are too simple in their system composition design and do not consider redundant safety control. As a result, when some control units of the EMB system fail, effective vehicle control cannot be performed, and no corresponding control strategy is designed, thus failing to guarantee the reliability of the EMB system. Summary of the Invention

[0005] In view of this, this application provides a redundant and safe EMB control system, a control method for the redundant and safe EMB control system, and a vehicle, which improves the reliability of the EMB system and also enhances redundancy and safety.

[0006] On one hand, this application provides a redundant and safe EMB control system, which includes a CCU (Central Control Unit) and a WCU (Wheel-Side Control Unit); wherein, the Central Control Unit (CCU) is used to receive a request signal from a host computer, and the CCU processes the request signal to output a corresponding clamping force command to the Wheel-Side Control Unit (WCU), and the Wheel-Side Control Unit (WCU) is used to control the drive motor to output braking force;

[0007] The central control unit (CCU) includes a main control system and an auxiliary control system, which serve as backups for each other. If one of them fails or malfunctions, the other system takes over and starts working.

[0008] The host computer request signal includes one or more of the following: human driver, vehicle driver, external request, and equipment request signal.

[0009] The control system includes dual redundant power supplies, namely vehicle power supply 1 and vehicle power supply 2. The dual redundant power supplies are respectively connected to the central control unit (CCU) and the wheel-side control unit (WCU) to provide power redundancy for the EMB system.

[0010] The power supply terminals of the driver's electronic brake pedal are connected to the power supply terminals of the central control unit (CCU) and also connected to a dual redundant power supply via hard wiring.

[0011] The wheel-side control unit (WCU) backs up the CCU control function, and the host computer request signal is connected to both the central control unit (CCU) and the wheel-side control unit. The wheel-side control unit executes the backed-up CCU control function to achieve braking control after the central control unit (CCU) fails or malfunctions. Alternatively, the CCU control function is backed up in the PCU (Pedal Control Unit), and the host computer request signal is connected to both the central control unit (CCU) and the PCU. The PCU is communicatively connected to the wheel-side control unit (WCU) to output a corresponding braking signal to the WCU. The PCU executes the backed-up CCU control function to achieve braking control after the central control unit (CCU) fails or malfunctions.

[0012] The wheel-side control unit (WCU) includes four ECUs (Electronic Control Units), which can be specifically braking units, such as a left front braking unit, a right front braking unit, a left rear braking unit, and a right rear braking unit, each used to control the braking of one wheel. One or more backup WCUs control functions within the four ECUs. In some embodiments, each ECU corresponds to a caliper, and each ECU controls its corresponding caliper. The four ECUs are interconnected, forming a distributed control system.

[0013] The human driver request signal, vehicle driver request signal, and external request signal in the external request signals are all connected to the CCU and WCU through at least two of the following: CAN (Controller Area Network), CANFD (CAN with Flexible Data rate), Ethernet, and hardwire; the CCU and WCU are connected through one private CAN and one public CAN.

[0014] The four electronic control units (ECUs) in the WCU are all connected to the four wheel speed sensors via hardwires. The four wheel speed sensors are dual-chip redundant sensor assemblies.

[0015] In the WCU, at least one of the four electronic control units (ECUs) acts as the master controller, and the other ECUs are controlled by the master controller. The ECUs are interconnected. The backup CCU function is located in the master controller. When there are multiple master controllers, one of them is selected to execute the backup CCU function according to the priority order.

[0016] On the other hand, this application also provides a control method for a redundant and safe EMB control system. The method is used to control the redundant and safe EMB control system described in any one of the embodiments of this application. The method includes receiving a request signal and processing it into a clamping force command when the central control unit (CCU) is in a normal state. The CCU then processes and converts the request signal into a clamping force command, which is input into the wheel-side control unit (WCU). The wheel-side control unit (WCU) executes and controls the braking. When the CCU is detected to be malfunctioning or failing, the wheel-side control unit (WCU) takes over the control function of the EMB system. The WCU obtains the request signal, processes and calculates the control command according to its pre-backed-up CCU function, and executes the output control.

[0017] On the other hand, this application also provides a vehicle that includes the redundant and secure EMB control system described in any one of the above embodiments.

[0018] The advantages of this application are: by redesigning the EMB system and its control strategy, the system's safety redundancy is significantly improved. It fully utilizes the relationships between EMB system architectures, defining strategies for power redundancy, hardwired redundancy, signal redundancy, wheel speed redundancy, functional arbitration, execution control, state transition conditions, and single-point / multi-point failures, thus giving the EMB system a higher degree of safety redundancy and a reasonable and effective control strategy. Within the EMB system, based on redundancy principles, arbitration logic, and state transition conditions, multiple aspects are defined, resulting in a control strategy with high safety redundancy and reasonable and effective execution. Attached Figure Description

[0019] The following is a brief explanation of the contents of each of the accompanying drawings and the markings in the drawings:

[0020] Figure 1 is a system architecture diagram of the EMB control system of Embodiment 1 of this application;

[0021] Figure 2 is a system architecture diagram of the EMB control system of Embodiment 2 of this application;

[0022] Figure 3 is a schematic diagram of the control strategy for single-person driving, vehicle driving, and external request scenarios in an embodiment of this application.

[0023] Figure 4 is a schematic diagram of the control strategy for two-person driving, vehicle driving, and external request scenarios in an embodiment of this application.

[0024] Figure 5 is a schematic diagram of the workflow of the equipment request working condition system in this application. Detailed Implementation

[0025] The specific implementation of this application will be further described in detail below with reference to the accompanying drawings and the description of the preferred embodiments.

[0026] This embodiment primarily employs a redundant design for the EMB system, combining hardware and functional redundancy to improve system reliability and prevent braking failure due to EMB malfunction, thus ensuring vehicle driving safety. The redundant design, with redundant hardware and software functions, allows the EMB system to continue operating normally even if one fails, improving its overall reliability and consequently enhancing vehicle braking reliability, thus mitigating safety hazards caused by brake failure. The specific solution is described below:

[0027] As shown in Figure 1, in this embodiment, the EMB system mainly consists of four EMBs: a central control unit (CCU), wheel-side control units (WCUs), and an electronic brake pedal. The CCU has a dual-system architecture, receiving requests from the driver / vehicle / external / equipment, and inputting clamping force commands to the WCU, thereby driving the motor for full-function control of the braking system. It should be noted that clamping force refers to the pressure applied by the caliper to the brake disc in the braking system. The WCU can transmit wheel speed signals to the CCU and can assume backup CCU control functions when the CCU fails. The CCU control functions include ABS (Anti-lock Braking System) control functions. The EMB system control architecture is shown in Figure 1, and will be described in detail below:

[0028] As shown in Figure 1, a redundant and safe EMB control system is provided, which includes a central control unit (CCU) and wheel-side control units (WCU).

[0029] The system consists of: a central control unit (CCU) receiving request signals from the host computer, processing the CCU to output corresponding clamping force commands to the wheel-side control unit (WCU), and the WCU controlling the drive motor to output braking force. Under normal circumstances, the CCU processes the received signals and inputs the clamping force command to the WCU, which then controls the motor to achieve braking control. To improve system safety, the CCU's functions are backed up to the WCU via software backup. When the CCU is working normally, the WCU is passively controlled. When the CCU fails or malfunctions, the WCU executes the backed-up CCU functions, calculates the corresponding clamping force information using the backed-up CCU functions, and then executes the clamping force to achieve braking control.

[0030] To improve system reliability, the Central Control Unit (CCU) includes a main control system and an auxiliary control system. The main and auxiliary control systems serve as backups for each other; if one fails or malfunctions, the other system takes over and starts operating. The CCU is divided into a main control system and an auxiliary control system. The main control system is the default operating system, executing data and sending it to the WCU based on the received request signals from the host computer. The auxiliary control system is in a non-operating state, merely monitoring the main control system for faults or malfunctions. It only starts operating when it detects a failure or malfunction in the main control system. At this time, the auxiliary control system switches to its default operating state, while the main control system remains in a non-operating state due to the fault or malfunction. The auxiliary control system then calculates and outputs the corresponding clamping force command to the WCU based on the host computer request signals.

[0031] Since the CCU contains a main control system and an auxiliary control system, a CCU failure or malfunction means that both the main control system and the auxiliary control system fail simultaneously. Because the probability of both the main control system and the auxiliary control system failing at the same time is small, this method can greatly reduce the instability of the EMB system.

[0032] The host computer request signals include one or more of the following: driver request signals, vehicle request signals, external request signals, and device request signals. Driver request signals refer to signals issued by the driver while driving, including but not limited to electronic brake pedal signals, single-pedal signals, and EPB (Electronic Parking Brake) button signals. Vehicle request signals refer to request signals issued by the vehicle's intelligent driving system or driver assistance system, including but not limited to DAS (Driver Assistance System) signals. External request signals refer to request signals from outside the EMB system, generally referring to in-vehicle data during vehicle operation, including the Transmission Control Unit (TCU) and Airbag Control Unit (ACU). For example, when implementing secondary protection based on the ACU airbag controller, the corresponding braking control function needs to be executed based on the airbag controller's request signal. Device request signals refer to request signals from devices such as diagnostic tools, used to implement braking control during diagnostic control.

[0033] Based on the host computer's request signals, the operating conditions can be divided into human-driven, vehicle-driven, and external request conditions, as well as equipment request conditions, thereby realizing different control strategies under different operating conditions.

[0034] The EMB control system in this scheme employs a power redundancy configuration, using dual redundant power supplies to provide redundant power to various components of the EMB system, thereby meeting the reliability requirements of the EMB. As shown in Figure 1, the dual redundant power supplies include vehicle power supply 1 and vehicle power supply 2, which are respectively connected to the central control unit (CCU) and wheel-side control units (WCU) to provide power redundancy for the EMB system. To improve the stability and reliability of the power supply, vehicle power supply 1 and vehicle power supply 2 are both hard-wired to the CCU and WCU, thus achieving stable and reliable power supply.

[0035] The power supply terminals of the driver-controlled electronic brake pedal are connected to the power supply terminals of the central control unit (CCU) and also to a dual-redundant power supply via hard wiring. The driver-controlled electronic brake pedal provides a braking request signal during manual driving; therefore, it requires stable power supply and also features power redundancy. The electronic brake pedal draws power from the CCU's main and auxiliary systems while simultaneously being directly hard-wired to the vehicle's power supply, achieving power redundancy for all control modules.

[0036] To achieve further redundancy, the driver-controlled electronic brake pedal can be connected to the main control system and auxiliary control system of the CCU via hard wires and CAN wires (at least one of them). It also has the function of connecting to the WCU via hard wires and CAN wires (at least one of them). This achieves hard wire redundancy while also enabling connection with the WCU, providing basic data for the WCU to perform CCU backup functions.

[0037] The wheel-side control unit (WCU) backs up the CCU control function. The host computer request signal is connected to both the central control unit (CCU) and the wheel-side control unit. The wheel-side control unit executes the backup CCU control function to achieve braking control after the CCU fails or malfunctions. The host computer request signal is sent to both the CCU and WCU so that, in the event of a CCU failure or malfunction, the WCU can execute the corresponding host computer request signal and perform the corresponding braking control function.

[0038] Figure 2 shows a schematic diagram of the EMB system architecture in this embodiment 2. The CCU function backup is set in the pedal control unit. The driver request signal is sent to the pedal control unit PCU through CAN, hard wire, etc. When the CCU function fails, the PCU performs CCU function backup. After the CCU function backup is executed, the corresponding control signal is output to the WCU and executed by the WCU.

[0039] As shown in Figure 1, the driver request signal is connected to the CCU via both CAN and hardwired connections to achieve redundancy in sending the driver request signal to the CCU. The driver request signal is also connected to the WCU via both the common CAN bus for driver signals and hardwired connections, enabling the driver signal to be sent to both the CCU and WCU with dual redundancy. Vehicle and external requests are connected to the CCU and WCU via CAN signals, respectively, allowing both the CCU and WCU to receive vehicle, external, and device request signals.

[0040] The wheel-side control unit (WCU) includes four braking ECUs: left front brake ECU1, right front brake ECU2, left rear brake ECU3, and right rear brake ECU4, each controlling the braking of one wheel. One or more backup WCUs within these four braking ECUs also control functions. The four ECUs operate independently but are interconnected via hardwired or network connections, allowing one ECU to receive control signals from the others for interactive control.

[0041] The external request signals, including the driver request signal, vehicle request signal, and external request signal, are all connected to the CCU and WCU via at least one of CAN, CANFD, Ethernet, or hardwire. The CCU and WCU are connected via one private CAN and one public CAN. This ensures that both the WCU and CCU can receive the request signals, allowing the WCU to receive the signals and execute the corresponding braking control functions even after a CCU failure or malfunction. Since the CCU and WCU communicate and exchange control commands under normal circumstances, the reliability of the connection between them needs to be guaranteed. Therefore, one private CAN and one public CAN connection are used to ensure reliable interaction between the two.

[0042] As shown in Figure 1, the four braking units (ECUs) in the WCU are all connected to the four wheel speed sensors via hard wires. The four wheel speed sensors are dual-chip redundant sensor assemblies, thereby enabling reliable acquisition of the four wheel speeds and providing basic wheel speed signals for the corresponding braking control.

[0043] Since the CCU acts as the master controller, it can directly process the acquired request signals and output control commands when it is in operation. However, when it fails or malfunctions, the WCU needs to execute the CCU backup function. The backup CCU function is the control strategy in the CCU, which calculates the corresponding clamping force based on the CCU function. Since the WCU includes four ECUs, when backing up the CCU function, at least one of the four braking unit ECUs in the WCU can be the master controller, and the other braking unit ECUs are controlled by the master controller. The braking unit ECUs are connected to each other. The backup CCU function is set in the master controller. When there are multiple master controllers, one of them is selected to execute the backup CCU function according to the priority order.

[0044] When a master ECU is set, signals from the driver, vehicle, external requests, and equipment requests are all input into the master ECU. The master ECU then executes the backup CCU function to control the braking. When multiple ECUs are selected as master ECUs, priorities can be set for them. The master ECU with higher priority processes the received request signal data to obtain the corresponding clamping force and other control information. The master ECU then transmits the control signals to other ECUs for execution to achieve braking control of the four wheels.

[0045] In human-driven, vehicle-driven, and externally requested states, the request signals for the operating status of each EMB system can be connected to the CCU and WCU via CAN / CAN-FD / Ethernet and hardwired connections. The CCU and WCU are connected via one private CAN and one public CAN. Operating requests from the EMB systems are preferentially executed by the CCU. The CCU processes the received request signals to obtain control signals such as the clamping force required for braking, and inputs the required clamping force to the WCU. The WCU then controls the four wheel-end motors to achieve the desired function.

[0046] The CCU prioritizes public CAN communication with system request signals and WCU. When network communication between the CCU and system request signals and WCU is abnormal, hard-wired signals or private CAN signals are used to ensure functionality, thereby guaranteeing the communication connection between the CCU and request signals such as the electronic brake pedal, as well as the communication connection between the CCU and WCU, to meet the signal interaction requirements between the two.

[0047] The WCU monitors the communication connection status between the WCU and CCU, as well as the CCU's own fault or failure status. When the WCU detects problems with the communication connection between the WCU and CCU, or when the CCU identifies a fault or communication anomaly through self-testing or its own software, the CCU sends a status bit corresponding to the system request communication error. Request signals for the operating status of each EMB system are directly connected to the WCU via CAN / CAN-FD / Ethernet, and the WCU directly executes the requested function. If the network connection between the WCU and the system request is abnormal, a hard-wired signal is used to ensure function implementation. If neither the network nor the hard-wired signal can receive the request signal, an error is reported. The WCU and CCU can detect whether their communication connection is normal through a heartbeat mechanism or other mechanisms. If communication between the WCU and CCU is abnormal, the WCU switches to the master controller, and the WCU controls the braking according to the request signal. The CCU checks itself or monitors whether the communication interaction with the request signal device is abnormal. When an abnormality occurs, the CCU sends a status bit corresponding to the communication abnormality via the CAN network. After receiving this status bit, the WCU switches to the master controller, and the WCU controls the braking according to the request signal.

[0048] In this embodiment, when the CCU can communicate normally with the system request signal and the WCU (CAN / CAN-FD / Ethernet, hard wire or proprietary CAN any one is valid), the CCU is responsible for processing the request signal, determining the control strategy for the caliper, and sending the control command to the WCU for execution; if the CCU and at least one of the system request signal or the WCU completely loses communication (CAN / CAN-FD / Ethernet, hard wire or proprietary CAN both appear), and the WCU can communicate normally with the system request (CAN / CAN-FD / Ethernet or hard wire any one is valid), then the WCU processes the request signal, determines the control strategy for the caliper, performs arbitration, and determines the control of the caliper.

[0049] When the CCU and WCU receive a function request signal synchronously, they arbitrate the signal and select the request signal with higher priority for execution; there are two methods:

[0050] The first method involves EMB providing internal arbitration for each working status:

[0051] 1) Upon receiving a driver request signal, the braking signal in the driver request signal takes priority and is executed first. When multiple braking request signals are received, the last one received is executed within the same execution cycle. Because the EMB system has a corresponding signal output cycle, if multiple braking signals are received before the output command, the last braking request signal received will be executed to match the user's actual needs as much as possible.

[0052] 2) When receiving requests from the vehicle driver or external sources, arbitration is conducted according to the functional safety level. A functional safety level is set for each request signal, and then the received request signals are prioritized, with those having higher functional safety levels being executed first.

[0053] 3) Device request signals: When responding to device requests, the priorities of human, vehicle, external, and device requests are set. When a request signal is received that one of the human, vehicle, or external requests is needed, the execution of the device request is stopped, and the request from the human, vehicle, or external request is executed. If multiple requests are sent at the same time, they are arbitrated according to the cross-system working status. The arbitration strategy is that if the functions corresponding to multiple requests do not conflict, all functions are executed. If the functions conflict, they are executed according to the pre-set priority of the request signal function.

[0054] The second type is that EMB provides arbitration between working states: human driving has the highest priority. When a human driving request signal is received, it directly enters human driving mode and records the execution state of the vehicle before entering human driving. When human driving exits, it needs to re-enter or restore the previous execution state.

[0055] Redundancy for the WCU can be achieved by placing at least one of the four braking units (ECUs), which will take the lead and send signals to the other three braking units (ECUs) to execute their control requirements. If the redundant control is placed in two or more ECUs, failover will be performed according to the defined priority order. The ECU with the highest priority will be selected to execute the operation, and after the ECU with the highest priority fails, the operation will be switched to the ECU with the next lower priority.

[0056] Under normal conditions, the EMB system is controlled by the CCU main control system for vehicle braking. When the CCU main control system fails, the auxiliary control system takes over vehicle braking control. When both the CCU main and auxiliary systems fail, the main control ECU in the WCU, in conjunction with the four calipers, performs backup ABS control. Because the ECU has limited computing power and resources, implementing braking control in response to request signals already consumes a significant portion of the chip resources. Therefore, to ensure vehicle reliability, the main control ECU only backs up the ABS control function. That is, when the main control ECU performs braking control, it executes the backup ABS control function to ensure vehicle safety and reliability during braking.

[0057] When the WCU experiences single-point, double-point, or triple-point failure, a tiered degradation approach must be implemented to ensure maximum utilization of the ground adhesion coefficient for deceleration and braking. The four ECUs (ECU1, ECU2, ECU3, and ECU4) within the WCU can determine the normality of their braking control over the wheels. If one ECU fails to control the vehicle's braking, it's considered a single-point braking control failure. Similarly, double-point or triple-electric failures may occur. In these cases, tiered degradation of braking control is implemented based on the different failure modes to ensure maximum utilization of the ground adhesion coefficient for deceleration and braking. The braking control strategy corresponding to the requested signal is executed according to the different failure modes to achieve vehicle braking control.

[0058] When the WCU controls the braking motor, ECU1, ECU2, ECU3, and ECU4 each control the braking motor corresponding to one wheel. Each ECU has a corresponding detector to check whether the braking force at the corresponding vehicle is normal. If the braking fails, that is, the current vehicle cannot apply effective braking force to brake, the failure fault is reported to the main control ECU. The main control ECU determines whether it is a single-point, double-point, or three-point failure fault based on the number of failure faults. When it is a single-point, double-point, or three-point failure fault, the main control ECU controls the braking force applied to the left and right ECUs, and meets the vehicle braking control in the case of single-point, double-point, or three-point failure by making the braking force on the left and right sides the same and reducing the braking force.

[0059] Braking failure can be determined by collecting the wheel speeds after the ECU applies braking force. When the ECU controls the vehicle's brake motor to apply braking force, the wheel speed will decelerate differently depending on the braking force. By detecting the vehicle speed and calculating the deceleration changes, it is determined whether the ECU's wheel braking control has failed. Pre-set deceleration standard values ​​for different braking forces are used for judgment. If the decelerations are different or significantly different under the same braking force collected in real time, braking failure is judged. After determining that braking failure has occurred, if the main control ECU identifies an ECU that is currently in a normal state, it first reduces the braking force, and then controls the braking force on both sides to be the same. That is, if at least one ECU on both sides is detected to be braking normally in the failure state, the braking force is reduced from the original braking force when all four ECUs are normal to the braking force in the failure state. Then, the braking force is distributed according to the number of normal ECUs on the left and right sides of the vehicle and transmitted to each ECU for execution. The purpose of this is to ensure that the braking force on both sides is consistent, avoiding vehicle tail-wagging and tilting caused by braking. At the same time, reducing the braking force is to accommodate situations where braking failure occurs on one side and full braking force cannot be met. When a request signal arrives, the main control ECU calculates the standard braking force or receives the standard braking force calculated based on the request signal from the CCU. When all four ECUs are functioning normally, the main control ECU controls the other ECUs to output braking control according to the standard braking force. When there is a single-point, double-point, or triple-point failure, the number of braking ECUs and brake motors decreases, thus reducing the available braking force. To ensure consistent braking force on both sides, the standard braking force needs to be reduced. The main control ECU reduces the standard braking force according to a set ratio to obtain the reduced braking force, and then applies braking according to this force based on the number of ECUs on the left and right sides. When the WCU experiences a single-point, double-point, or triple-point failure, a tiered degrading process is implemented (by adjusting the braking force of the remaining effective wheels to maintain a balanced braking force on both sides, ensuring maximum utilization of the ground adhesion coefficient for deceleration and braking).

[0060] This application also provides a control method for a redundant and safe EMB control system, including receiving a request signal and processing it into a clamping force command when the central control unit (CCU) is in normal condition. The CCU then processes and converts the request signal into a clamping force command, which is input into the wheel-side control unit (WCU). The wheel-side control unit (WCU) executes and controls the braking. When the CCU is detected to be malfunctioning or failing, the wheel-side control unit (WCU) takes over the control function of the EMB system. The WCU obtains the request signal, processes and calculates the control command according to its pre-backed-up CCU function, and executes the output control.

[0061] This application also provides a vehicle that includes the redundant and secure EMB control system described in any one of the embodiments of this application.

[0062] Obviously, the specific implementation of this application is not limited to the above-mentioned methods. Any non-substantial improvements made using the inventive concept and technical solution of this application are within the scope of protection of this application.

Claims

1. A redundant and secure EMB control system, wherein: The control system includes a central control unit (CCU) and a wheel-side control unit (WCU). The CCU receives request signals from the host computer, processes the request signals, and outputs corresponding clamping force commands to the wheel-side control unit (WCU). The WCU controls the drive motor to output braking force. The central control unit (CCU) includes a main control system and an auxiliary control system, which serve as backups for each other. If one of them fails or malfunctions, the other system takes over and starts working.

2. A redundantly safe EMB control system as claimed in claim 1, wherein: The host computer request signal includes one or more of the following: human driver, vehicle driver, external request, and equipment request signal.

3. A redundantly safe EMB control system as recited in claim 1 wherein: The control system includes dual redundant power supplies, namely vehicle power supply 1 and vehicle power supply 2. The dual redundant power supplies are respectively connected to the central control unit (CCU) and the wheel-side control unit (WCU) to provide power redundancy for the EMB system.

4. A redundantly safe EMB control system as claimed in claim 3, wherein: The power supply terminals of the driver's electronic brake pedal are connected to the power supply terminals of the central control unit (CCU) and also connected to a dual redundant power supply via hard wiring.

5. A redundant and secure EMB control system as described in any one of claims 1-4, wherein: The CCU control function is backed up in the wheel-side control unit (WCU), and the host computer request signal is connected to both the central control unit (CCU) and the wheel-side control unit. The wheel-side control unit executes a backup CCU control function to achieve braking control after the central control unit (CCU) fails or malfunctions; and / or the CCU control function is backed up in the pedal control unit (PCU). The host computer request signal is connected to the central control unit (CCU) and the pedal control unit (PCU) respectively. The pedal control unit (PCU) is communicatively connected to the wheel-side control unit (WCU) to output the corresponding braking signal to the WCU. The pedal control unit (PCU) executes the backup CCU control function to achieve braking control after the central control unit (CCU) fails or malfunctions.

6. A redundant and secure EMB control system as described in any one of claims 1-4, wherein: The wheel-side control unit (WCU) includes four braking units (ECUs): a left front braking unit, a right front braking unit, a left rear braking unit, and a right rear braking unit, each used to control the braking of one wheel; and one or more backup CCUs in the four braking unit ECUs control functions.

7. A redundant and secure EMB control system as described in any one of claims 1-4, wherein: The human driver request signal, vehicle driver request signal, and external request signal in the external request signals are all connected to the CCU, WCU, and PCU via at least one of CAN, CANFD, Ethernet, and hardwire; the CCU and WCU are connected via one private CAN and one public CAN; the PCU and WCU are connected via a signal private CAN.

8. A redundant and secure EMB control system as described in claim 6, wherein: The four braking units (ECUs) in the WCU are all connected to the four wheel speed sensors via hard wiring. The four wheel speed sensors are dual-chip redundant sensor assemblies.

9. A redundant and secure EMB control system as described in claim 6, wherein: In the WCU, at least one of the four braking unit ECUs acts as the master controller, and the remaining braking unit ECUs are controlled by the master controller. The braking unit ECUs are connected to each other. The backup CCU function is set in the master controller or is backed up by the PCU. The master controller ECU is controlled by the PCU. When there are multiple master controller ECUs, one of them is selected to execute the backup CCU function according to the priority order.

10. A control method for a redundant and secure EMB control system, the method being used to control the redundant and secure EMB control system as described in any one of claims 1-9, the method comprising: When the central control unit (CCU) is in normal condition, it receives request signals and processes them into clamping force commands, which are then input into the wheel-side control unit (WCU). The wheel-side control unit (WCU) executes and controls the braking. When the central control unit (CCU) is detected to be malfunctioning or failing, the wheel-side control unit (WCU) takes over the control functions of the EMB system. The WCU obtains the request signals, processes and calculates them according to its pre-backed-up CCU functions to obtain control commands, and executes the output control.

11. A vehicle, wherein, The vehicle includes a redundant and secure EMB control system as described in any one of claims 1 to 9.

Images