CN117382595A - Redundant braking system and method for automatic driving automobile - Google Patents

Abstract

The invention is applicable to the technical field of automobile braking, and provides a redundant braking system for an automatic driving automobile, which comprises the following components: the system comprises a main braking module and an auxiliary braking module, wherein the main braking module comprises a PBM electronic control unit, a PBM hydraulic circuit and at least one sensor; the auxiliary braking module comprises an SBM electronic control unit, an SBM hydraulic circuit and at least one sensor; a vehicle controller; a braking device associated with each wheel of the vehicle for providing braking torque to the wheel; a hydraulic circuit connected between the PBM and the brake device and also connected between the SBM and the brake device; and a communication bus for communication between the modules. The system can execute improved braking operation when one of the braking modules has communication failure, does not need to change the existing communication bus and hydraulic circuit core hardware, and provides a new method for the braking design of the automatic driving automobile.

Description

Redundant braking system and method for automatic driving automobile

Technical Field

The invention belongs to the technical field of automobile braking, and particularly relates to a redundant braking system and method for an automatic driving automobile.

Background

An autopilot is a car that is able to sense the environment and plan a route with little or no user input. Vehicle automation technology has been classified into a number level, from zero level (corresponding to no automation relying entirely on manual control) to five level (corresponding to full automation without manual control). Various automatic driving assistance systems, such as cruise control, adaptive cruise control and auxiliary parking systems, correspond to lower levels of automation, while real "unmanned" vehicles correspond to higher levels of automation. Despite the tremendous advances made in automatically driving automobiles in recent years, designers continue to seek improvements, particularly in terms of navigation functionality.

Some autopilot designs have a primary braking module and a secondary braking module to provide redundant braking control. The modules may communicate with each other and with the autopilot controller via a communication bus. It is therefore desirable to provide a system and method that is capable of performing improved braking operations in the event of a communication failure of one of the brake modules, particularly without requiring modification of the existing communication bus and hydraulic circuit core hardware.

Disclosure of Invention

An object of an embodiment of the present invention is to provide a redundant braking system and method for an automatic driving automobile, which aims to solve the problems set forth in the background art.

Embodiments of the present invention are thus implemented, a redundant brake system for an autonomous vehicle, comprising:

a main brake module (PBM) and an auxiliary brake module (SBM), the main brake module (PBM) comprising a PBM electronic control unit, a PBM hydraulic circuit and at least one sensor; an auxiliary brake module (SBM) includes an SBM electronic control unit, an SBM hydraulic circuit, and at least one sensor;

a vehicle controller comprising a computer readable storage device or medium for storing various operating variables when the processor is de-energized, and at least one processor for providing input to the vehicle controller regarding braking and vehicle operating conditions, while the computer readable storage device or medium is also for storing executable instructions for use by a main brake module electronic control unit and an auxiliary brake module electronic control unit of the controller in controlling the vehicle, in controlling the brake system;

a braking device for providing braking torque to the wheels;

a hydraulic circuit that selectively activates the brake device during operation of the vehicle by delivering pressurized fluid to the brake device, and the primary and auxiliary brake modules effect independent braking of the vehicle by sharing a portion of the fluid lines that make up the hydraulic circuit,

and the communication bus is used for carrying out communication between the main braking module or the auxiliary braking module and other modules in the system, and is also used for carrying out communication between the main braking module and the auxiliary braking module.

A braking device associated with each wheel of the vehicle for providing braking torque to the wheel;

the hydraulic circuit is connected between the PBM and the brake device, and is also connected between the SBM and the brake device

The communication bus is connected between the autopilot system and the PBM, and between the autopilot system and the SBM, respectively, and the SBM electronic control unit is configured to detect a communication failure of the PBM electronic control unit via the communication bus and to apply a predetermined hydraulic operation in the hydraulic circuit in response to the detected communication failure. The PBM electronic control unit is configured to recognize a predetermined hydraulic operation applied by the SBM electronic control unit based on an output from the at least one sensor, and select and execute the predetermined hydraulic operation based on a recognition result of the predetermined hydraulic operation.

In a further aspect, the predetermined hydraulic operation of the SBM is a hydraulic pulse, and at least one sensor in the PBM is configured as a pressure sensor that senses the hydraulic pulse.

In a further aspect, the PBM predetermined braking operation includes a hydraulic pulse and applying sufficient hydraulic pressure to perform the braking operation, at least one sensor in the SBM being configured to sense a pressure sensor of the hydraulic pulse, the at least one sensor being configured to sense an effect of the braking on the movement of the autonomous vehicle.

In a further aspect, the SBM electronic control unit is configured to detect a communication failure of the PBM electronic control unit via the communication bus and to apply a hydraulic pulse of a predetermined pattern in the hydraulic circuit in response to the detected communication failure. The PBM electronic control unit is configured to identify a predetermined pattern of hydraulic pulses applied by the SBM electronic control unit, or to identify the absence of hydraulic pulses, based on an output from the at least one pressure sensor. The PBM electronic control unit or the automatic vehicle controller is configured to select and perform a braking operation by identifying a predetermined pattern of hydraulic pulses.

Further, the SBM electronic control unit is configured to select and execute the emergency braking operation when the predetermined hydraulic operation from the PBM is not recognized. The SBM electronic control unit or the automatic vehicle controller is configured to select and perform a braking operation by which the vehicle is parked alongside when a predetermined hydraulic operation is identified.

Further aspects, the instructions, when executed by the processor, receive and process signals from the sensor system, perform logic, calculations, methods, and/or algorithms for automatically controlling components of the vehicle and the brake system, and generate control signals to the actuator system to automatically control the components of the vehicle and the brake system based on the logic, calculations, methods, and/or algorithms.

Further aspects of the computer readable storage device or medium include volatile and nonvolatile storage in read-only memory, random access memory, and keep-alive memory.

Further technical solution, when a fault is detected in the primary braking module, the auxiliary braking module becomes a new active module to independently provide braking and stability functions, while the original primary braking module becomes a dormant state.

In a further aspect, the main brake module and the auxiliary brake module are each connected to an output of a pressure sensor for sensing hydraulic pressure in the hydraulic circuit and to a wheel speed sensor for determining a speed of each wheel, which is used for calculating a vehicle speed and an acceleration.

Another object of the embodiment of the present invention is to provide a redundant braking method for an automatic driving automobile, based on the above-mentioned redundant braking system for an automatic driving automobile, comprising the following steps:

step 1, judging whether the main brake module has communication faults or not by detecting whether a communication signal sent by the main brake module exists on a communication bus, if not, periodically repeating the step 1, and if the communication faults are detected, jumping to the step 2;

and 2, judging whether the main braking module fails by detecting whether a hydraulic pulse signal sent by the main braking module exists in the hydraulic circuit, selecting a more gentle braking mode if the hydraulic pulse from the main braking module is detected, and selecting and executing a preset emergency braking operation by the auxiliary braking module if the hydraulic pulse from the main braking module is not detected.

According to a further technical scheme, the auxiliary braking module comprises the following specific steps of: when a fault is detected in the primary braking module, the auxiliary braking module becomes the new active module to independently provide braking and stability functions, while the primary braking module becomes the dormant state.

The redundant braking system for the automatic driving automobile provided by the embodiment of the invention can execute improved braking operation when one of the braking modules has communication failure, does not need to change the existing communication bus and hydraulic circuit core hardware, and provides a new method for the braking design of the automatic driving automobile.

Drawings

FIG. 1 is a block diagram of an autonomous vehicle system provided by an embodiment of the present invention;

FIG. 2 is a block diagram of a braking system of an autonomous vehicle system provided by an embodiment of the present invention;

FIG. 3 is a schematic block diagram of a braking system provided by an embodiment of the present invention;

fig. 4 is a flowchart of a redundant braking method for an automatic driving automobile according to an embodiment of the present invention.

Detailed Description

The present invention will be described in further detail with reference to the drawings and examples, in order to make the objects, technical solutions and advantages of the present invention more apparent. It should be understood that the specific embodiments described herein are for purposes of illustration only and are not intended to limit the scope of the invention.

Specific implementations of the invention are described in detail below in connection with specific embodiments.

As shown in fig. 1-3, a redundant brake system for an autonomous vehicle is provided for one embodiment of the present invention,

in various embodiments, the vehicle is an autonomous vehicle that may be automatically controlled for pick up passengers. In general, an autonomous vehicle system includes a brake system 200, the brake system 200 using a hydraulic communication path for transmitting brake commands in the event of a communication failure on a communication bus. As used herein, an autonomous vehicle system refers to various hardware, software components, and systems that enable a vehicle to operate automatically, and may be considered to include the vehicle as well as cooperating elements external to the vehicle.

The vehicle in fig. 1 is a passenger vehicle, but it should be understood that any other vehicle, including motorcycles, trucks, sport Utility Vehicles (SUVs), recreational Vehicles (RVs), and the like, may also be used.

As shown in fig. 1, the vehicle generally includes a chassis 110, a body 113, front wheels 115, rear wheels 116, a propulsion system 120, a transmission system 130, a steering system 160, a braking device 123, a sensor system 140, an actuator system 150, at least one data storage device 131, at least one vehicle controller 171, and a communication system 180. The body 113 is disposed on the chassis 110 and substantially encloses the components of the vehicle. The body 113 and chassis 110 together form a frame. Front wheels 115 and rear wheels 116 are each rotatably coupled to chassis 110 near a respective corner of body 113, and propulsion system 120 may include an internal combustion engine, an electric motor (e.g., a traction motor), and/or a fuel cell propulsion system. The transmission 130 is configured to transfer power from the propulsion system 120 to the front wheels 115 and the rear wheels 116 according to a selectable speed ratio. According to various embodiments, the transmission system 130 may include a stepped automatic transmission, a continuously variable transmission, or other suitable transmission. The braking device 123 is part of a braking system 200 (described further below) and is configured to provide braking torque to the front and rear wheels 115, 116. In various embodiments, the braking device 123 may include a friction brake, a brake-by-wire, a regenerative braking system such as an electric motor, and/or other suitable braking device. Steering system 160 affects the position of front wheels 115 and rear wheels 116. In some embodiments, steering system 160 may not include a steering wheel within the scope of the present invention.

The sensor system 140 includes sensing means 172 (the sensing means 172 is provided with a plurality of sensing means 172, which may be defined as sensing means 172a-172 n) for sensing an observable state of the external environment and/or the internal environment of the vehicle.

As shown in fig. 2, brake system 200 includes a main brake module (PBM) 322 and an auxiliary brake module (SBM) 324, with main brake module 322 and auxiliary brake module 324 each including an Electronic Control Unit (ECU) 220a, 220b, a processor 221a, 221b, and a computer readable storage device or medium 332a, 332b.

The vehicle controller 171 of fig. 2 includes at least one processor 172, and a computer-readable storage device or medium 173. The processors 172, 221a, 221b may be any custom made or commercially available processor, a Central Processing Unit (CPU), a Graphics Processing Unit (GPU), an auxiliary processor among several processors, a semiconductor based microprocessor (in the form of a microchip or chip set), a macroprocessor, or any combination thereof, or generally any device for executing instructions. The computer readable storage devices or media 173, 332a, 332b may include volatile and nonvolatile storage in Read Only Memory (ROM), random Access Memory (RAM), and Keep Alive Memory (KAM). KAM is a permanent or non-volatile memory that may be used to store various operating variables when processor 172 is powered down. The computer readable storage device or medium 173 may be implemented using any of a variety of known memory means, such as PROMs (programmable read Only memory), EPROM (electrically PROM), EEPROMs (electrically erasable PROM), flash memory, or any other electrical, magnetic, optical, or combination memory means capable of storing data, some of which represent executable instructions for use by the controller 171 in controlling the vehicle and for use by the PBM ECU 220a and the SBM ECU 220b in controlling the brake system 200.

The instructions may comprise separate programs, each comprising an ordered listing of executable instructions for implementing logical functions. When executed by the processors 172, 221a, 221b, the instructions receive and process signals from the sensor system 140, execute logic, calculations, methods, and/or algorithms for automatically controlling components of the vehicle and brake system 200, and generate control signals to the actuator system 150 to automatically control the components of the vehicle and brake system 200 based on the logic, calculations, methods, and/or algorithms. Although only one controller 171 is shown in fig. 1, an embodiment of an autonomous vehicle may include more than one controller 171 that communicates over any suitable communication medium or combination of communication media and that cooperate to process sensor signals, execute logic, calculations, methods, and/or algorithms, and generate control signals to automatically control features of the vehicle.

In various embodiments, the instructions of the controller 171 are embodied to generate and exchange data and commands between the brake system 200 and the controller 171 to perform braking operations. Further, referring to fig. 2, instructions of the PBM ECU 220a and the SBM ECU 220b, when executed by the respective processors 221a, 221b, detect a communication failure of the main brake module PBM322 and control the SBM324 to generate a communication signal on a communication path through the hydraulic circuit 210 in response to the failure. These commands control the PBM322 to sense the hydraulic communication signal (or its absence) and determine a braking operation based thereon.

As previously described with respect to fig. 1, the PBM ECU 220a and the SBM ECU 220b are configured to execute the brake system 200 in cooperation with the vehicle controller 171 and various hardware (to be described in further detail), the brake system 200 establishing a communication path through which hydraulic communication signals are sent from the PBM322 and detected by the SBM as part of an autonomous vehicle system when the communication bus of the PBM fails. The hydraulic communication path provides for transmitting information from the brake module experiencing a communication failure to another module, the transmitted information being used to identify whether the brake module experiencing a communication failure is experiencing a component failure at the same time; it is also possible that one brake module is transmitted to a brake module suffering from a communication failure, and the transmitted information is used for deciding a brake operation of the brake module suffering from the communication failure.

Fig. 2 is a block or functional diagram of the braking system 200 of fig. 1 according to an exemplary embodiment. In one embodiment, the braking system 200 is configured to determine an appropriate braking response when the PBM322 loses communication with the vehicle controller 171 and the SBM 324. The brake system 200 is configured to apply a hydraulic pulse through the SBM324 that encodes the communication signal, allowing the PBM322 to read the hydraulic communication signal and determine a brake response based thereon.

Automatic vehicles typically do not have a brake pedal that is manually operated by the vehicle occupant. The automatic vehicle includes a braking system 200 for selectively controlling braking inputs of the front wheels 115 and the rear wheels 116 in response to commands for automatic braking from the controller 171. Referring to fig. 1 and 3, a brake device 123a-d is typically associated with each wheel and is typically provided by a brake caliper or other braking element. In the present embodiment, the wheels include left and right front wheels 115a and 115b and left and right rear wheels 116a and 116b.

A hydraulic circuit 210 including fluid lines is used to deliver pressurized fluid to the braking devices 123a-d to selectively activate the brakes during vehicle operation. The hydraulic circuit 210 is connected to at least four fluid lines with the respective brake devices 123a-d.

In the case of an autonomous vehicle, it may be desirable to have some redundancy in the brake system 200 to ensure that braking capability is maintained in the event of a brake component failure or failure. During normal operation, the PBM322 is used to selectively operate the brake devices 123a-d. In the event of a component failure in the PBM322, the SBM324 may take over the failed component. The PBM ECU 220a and the SBM ECU 220b may communicate with any number of components within the brake system 200 to perform the functions described herein. In an embodiment, the primary and auxiliary brake modules are designed to share at least a portion of the fluid lines that make up the hydraulic circuit 210, and both the PBM322 and the SBM324 are capable of independently controlling the braking torque of each wheel. In some embodiments, during normal operation, PBM322 independently performs the required braking and stability functions. When a fault is detected in the PBM322, the SBM324 becomes the active module to independently provide braking and stability functions, while the PBM322 becomes dormant. However, embodiments are also contemplated in which the PBM322 and the SBM324 may operate cooperatively, e.g., both modules may operate simultaneously even in the absence of a failure of either the PBM322 or the SBM 324.

Each wheel has associated with it a wheel speed sensor 331a-d and a sensor (not shown) for sensing steering wheel angle, which communicates with the PBM ECU 220a and the SBM ECU 220b (not shown). The PBM ECU 220a and the SBM ECU 220b consume and use information from the inertial measurement unit to obtain the vehicle body acceleration for the stability function. The PBM322 and SBM324 also have pressure sensors 327 (see FIG. 4) to provide closed loop control of the actual pressure of the target.

Accordingly, various vehicle sensors 172a-n communicate with the PBM ECU 220a and the SBM ECU 220b to provide inputs to the controller 171 regarding braking and vehicle operating conditions, which help provide desired braking and vehicle stability. Example inputs include vehicle speed (which may be obtained from wheel speeds measured at each wheel), vehicle direction (which may also be obtained from wheel speed sensor information at each wheel), traction at each wheel (where traction at each wheel may be obtained from a wheel slip percentage obtained as the difference between an estimated vehicle speed (translation of center of gravity) and a wheel speed measured at a particular wheel), steering wheel position, inertial forces of the vehicle (e.g., linear acceleration, longitudinal or lateral acceleration, or rotational acceleration, such as yaw rate, pitch rate, roll rate), and other information. According to various embodiments described herein, each of the PBM322 and SBM324 is connected to an output of a pressure sensor 327 (see FIG. 3) for sensing hydraulic pressure in the hydraulic circuit 210, and to wheel speed sensors 331a-d (see FIG. 3) for determining the speed of the respective wheels, which is used to estimate vehicle speed and acceleration.

As shown in fig. 3, according to various embodiments, the braking system 200 is further described with reference to a schematic block diagram for explaining the braking system 200. Fig. 3 shows the primary and secondary vehicle controllers 171a and 171b, the first communication bus 311a, the second and third communication buses 311b and 311c, the PBM ECU 220a, the SBM ECU 220b, the hydraulic circuit 320, the brake fluid reservoir 321, the linear motors 322a and 322b, the servo cylinders 323a and 323b, the isolation valves 324a and 324b, the inlet valves 325a-d, the outlet valves 326a-d, the pressure sensors 327a and 327b, the brake devices 123a-d, the front wheels 115a, 115b, the rear wheels 116a, 116b, and the wheel speed sensors 331a-d.

In the exemplary embodiment of fig. 3, the above-described controller 171 includes a primary vehicle controller 171a and a secondary vehicle controller 171b. By providing the primary and secondary vehicle controllers 171a, 171b, there is redundancy in the event of failure of the primary vehicle controller 171 a.

The primary and secondary vehicle controllers 171a, 171b execute respective autonomous drivers that, when activated, provide braking commands to the PBM322 and SBM 324. The PBM322 mainly interprets commands from the vehicle controllers 171a, 171b and executes corresponding braking curves by pressurizing hydraulic fluid in the hydraulic lines of the hydraulic circuit 320 (through the motor 323a and the servo cylinder 323 a). The braking devices 123a-d react to the pressure in the hydraulic circuit 320 to apply a braking torque on the wheels, which then apply a braking force on the ground through the tires. In the event of a failure of a component or function of the PBM322, the SBM324 is provided as a redundant brake module. The brake fluid reservoir 321 is used to supply hydraulic fluid to the PBM322 and the SBM324 and the hydraulic circuit 320.

The PBM322 and the SBM324 are capable of communicating with each other via at least a second communication bus 311 b. The PBM322 can communicate with the master vehicle controller 117a via the first communication bus 311a, and can communicate with the master and slave vehicle controllers 117a and 117b via the second communication bus 311 b. The SBM324 is capable of communicating with the slave vehicle controller 117b via the third communication bus 311c, and is capable of communicating with the master and slave vehicle controllers 117a, 117b via the second communication bus 311 b. Although two vehicle controllers 117a, 117b are shown in the present embodiment, a different number of vehicle controllers and/or communication buses may be provided, such as only one vehicle controller 117 and one corresponding communication bus 311. In the exemplary embodiment, communication buses 311a-c are CAN (controller area network) buses, and the various processors, sensors, and control units connected to the CAN buses communicate in accordance with the CAN standard. That is, the communication buses 311a-c each cooperate with the vehicle controllers 117a, 117b and the PBM322 and SBM324 to provide a serial communication bus.

According to various embodiments, the detection method for the occurrence of communication failure of the PBM is as follows: when the PBM322 fails in communication, the SBM324 is configured to detect whether the PBM322 fails in communication because the PBM322 cannot send and receive communications over the communication buses 404a-c, and thus such communication barriers may occur as a single point of failure, e.g., caused by water in the connection between the second and third communication buses 404b, 404ccPBM 322. In one example, the SBM324 is configured to detect communication failures at the PBM322 based on the absence of communications from the PBM322 on the communication buses 404 a-c. In an embodiment, the communication failure may be determined by no communication from the PBM322 or no communication in response to a request from the SBM324 for a particular period of time.

When the SBM324 detects a loss of communication with the PBM322, it will further detect if there is a component failure in the PBM, and through a pressure sensor 327b provided in the SBM, the SBM may detect if there is a hydraulic pulse in the hydraulic circuit applied by the PBM, the presence of one or more hydraulic pulses indicating to the SBM that the PBM is still operating, and therefore, emergency braking is deferred, instead of selecting a more gentle braking mode. Since the SBM324 is still in communication with one or both of the vehicle controllers 117a, 117b, the SBM324 may encode control signals sent by the vehicle controllers with hydraulic pulses and be configured to apply the encoded hydraulic pulses in the hydraulic circuit 320, which are recognized and decoded into brake commands by the PBMECU via the pressure sensor 327a configured in the PBM, and then select and perform corresponding braking operations. When the SBM324 ceases to receive hydraulic pulses from the PBM 324, the SBM324 may then assume that the PBM322 has failed and the SBM324 may then apply the emergency braking operation. In more detail, the hydraulic pulse may be invasive or non-invasive, which may be detected by the pressure sensor 327, but is not generally perceived by an occupant of the vehicle as a braking operation because the hydraulic pulse has no substantial effect on the movement of the autonomous vehicle. The invasive hydraulic pressure pulse influences the movement of the autonomous vehicle and can be detected on the basis of this. The PBM322 is configured to detect the hydraulic pressure pulse by the output of the pressure sensor (the hydraulic pressure pulse is non-invasive) or the output from the wheel speed sensor (the hydraulic pressure pulse is non-invasive). Wherein the wheel speed sensors 331a-d or the pressure sensors 327a-b communicate directly with the PBM322 and SBM324, rather than via the communication buses 311a-c, thus allowing for the communication of information in the event of a communication failure.

The system and method described herein solves the problem of unnecessary runaway of an automated vehicle, allowing other braking actions in addition to emergency braking when PBM322 loses communication. The SBM324 is designed to have the ability to perform an emergency braking operation when it loses communication with the PBM and does not receive a hydraulic pulse sent from the PBM via a hydraulic communication path. The systems and methods described herein utilize redundant hydraulic communication paths to connect to brake modules that have had communication completely lost. The hydraulic communication path utilizes existing hardware of the brake system 200 to implement a redundant communication path without requiring modification of the hardware infrastructure. Furthermore, the systems and methods described herein allow for performing specific braking operations based on the different hydraulic modes communicated.

As shown in fig. 4, the redundant braking method for an automatic driving automobile provided by the embodiment of the invention is further described:

the first step, judging whether the PBM has communication faults or not by detecting whether communication signals sent by the PBM exist on a communication bus or not, if not, periodically repeating the step 1, and if the communication faults are detected, jumping to the second step;

and a second step of judging whether the PBM is failed by detecting whether a hydraulic pulse signal from the PBM is transmitted in the hydraulic circuit, selecting a more gentle braking mode if the hydraulic pulse from the PBM is detected, and selecting and executing a predetermined emergency braking operation by the SBM assuming that the PBM is failed if the hydraulic pulse from the PBM is not detected.

The foregoing description of the preferred embodiments of the invention is not intended to be limiting, but rather is intended to cover all modifications, equivalents, and alternatives falling within the spirit and principles of the invention.

Claims (7)

1. A redundant brake system for an autonomous vehicle, comprising:

the system comprises a main braking module and an auxiliary braking module, wherein the main braking module and the auxiliary braking module comprise computer readable storage equipment or media, an electronic control unit and a processor, and the electronic control unit and the processor are respectively provided with a plurality of electronic control units;

a vehicle controller comprising a computer readable storage device or medium for storing various operating variables when the processor is de-energized, and at least one processor for providing input to the vehicle controller regarding braking and vehicle operating conditions, while the computer readable storage device or medium is also for storing executable instructions for use by a main brake module electronic control unit and an auxiliary brake module electronic control unit of the controller in controlling the vehicle, in controlling the brake system;

a braking device for providing braking torque to the wheels;

a hydraulic circuit that selectively activates the brake device during operation of the vehicle by delivering pressurized fluid to the brake device, and the primary and auxiliary brake modules effect independent braking of the vehicle by sharing a portion of the fluid lines that make up the hydraulic circuit;

and the communication bus is used for carrying out communication between the main braking module or the auxiliary braking module and other modules in the system, and is also used for carrying out communication between the main braking module and the auxiliary braking module.

2. The redundant brake system for an autonomous vehicle of claim 1, wherein the instructions, when executed by the processor, receive and process signals from the sensor system, perform logic, calculations, methods, and/or algorithms for automatically controlling components of the vehicle and the brake system, and generate control signals to the actuator system to automatically control the components of the vehicle and the brake system based on the logic, calculations, methods, and/or algorithms.

3. A redundant braking system for an autonomous vehicle according to claim 2, wherein said computer readable storage device or medium comprises volatile and nonvolatile storage in read only memory, random access memory, and keep alive memory.

4. A redundant brake system for an autonomous vehicle according to claim 1 wherein when a fault is detected in the primary brake module, the auxiliary brake module becomes a new active module to independently provide braking and stability functions while the primary brake module becomes dormant.

5. A redundant brake system and method for an autonomous vehicle according to claim 1 wherein said primary and auxiliary brake modules are each connected to an output of a pressure sensor for sensing hydraulic pressure in the hydraulic circuit and to a wheel speed sensor for determining the speed of each wheel for calculating vehicle speed and acceleration.

6. A redundant braking method for an autonomous car based on a redundant braking system for an autonomous car as claimed in any of the foregoing claims 1-5, characterized by the steps of:

step 1, judging whether the main brake module has communication faults or not by detecting whether a communication signal sent by the main brake module exists on a communication bus, if not, periodically repeating the step 1, and if the communication faults are detected, jumping to the step 2;

and 2, judging whether the main braking module fails by detecting whether a hydraulic pulse signal sent by the main braking module exists in the hydraulic circuit, selecting a more gentle braking mode if the hydraulic pulse from the main braking module is detected, and selecting and executing a preset emergency braking operation by the auxiliary braking module if the hydraulic pulse from the main braking module is not detected.

7. The redundant braking method for an autonomous vehicle according to claim 6, wherein in said step 2, the specific step of the auxiliary braking module selecting and performing a predetermined emergency braking operation is: when a fault is detected in the primary braking module, the auxiliary braking module becomes the new active module to independently provide braking and stability functions, while the primary braking module becomes the dormant state.